Agency of Digital Services outlines modernization, cybersecurity and AI priorities to Senate committee

Secretary Denise Riley Hughes, the state’s chief information officer and head of the Vermont Agency of Digital Services, told the Senate Committee on Institutions on Wednesday the 22nd that the agency is focused on consolidating state technology, improving user experience and strengthening cybersecurity as it advances several major modernization projects.

Hughes said the agency, formed in 2017, now has six divisions and 389 positions and is working across the executive branch and elected offices to centralize standards, reduce duplication and make technology costs more predictable. “For the record, Denise Riley Hughes. I am secretary for the agency of digital services,” she said.

The agency’s work matters to Vermonters because it underpins everyday government functions — from driver services to unemployment benefits and payroll systems — and because gaps in cybersecurity and accessibility can affect both municipal services and residents’ access to state services.

Hughes told senators the agency’s top focus areas are user experience, standards, simplification and predictability. She said EDS is moving legacy services to cloud-based operating-expense models, aiming to replace fragmented CapEx purchases with clearer, ongoing cost-recovery that agencies can plan for. “We are in a cloud based world where the costs are absolutely operating expenses,” Hughes said.

Major projects cited as current “big lifts” include a modernization of the Department of Motor Vehicles, an upgrade to the unemployment insurance system, and an enterprise resource planning project (ERP) — commonly referred to as Workday — that will handle human capital, budget and finance functions across branches of state government. Hughes said the ERP rollout is intended to replace a heavy reliance on spreadsheets and improve predictability and transparency in operations.

Hughes also described the agency’s organizational structure: a security division led by a chief information security officer that coordinates with the Vermont Intelligence Center at the Department of Public Safety; an enterprise architecture team that aligns projects to standards; a combined data management and artificial intelligence division; a finance office; an Enterprise Project Management Office (EPMO); and Enterprise Services, the shared-technical staff and help-desk operations. “Vermont was the first state in the country to have a director of AI,” Hughes said, and she described the merged data-and-AI division as central to data governance and privacy for AI work.

On cybersecurity, Hughes said the agency is seeing a high volume of attempted intrusions and has partnerships to provide 24/7 monitoring. She noted the state’s cyber advisory council — created under Act 71 in 2023 — focuses on protecting critical infrastructure (energy, utilities and similar systems) and plans to release recommendations soon. Hughes also said the agency expects to administer a state-local cyber grant program (referred to in the meeting as LCGP) aimed at helping municipalities that are “underserved” on technology and security.

Hughes described the web portal board that oversees vermont.gov and said the state’s web presence includes roughly 160,000 pages that must meet U.S. Department of Justice Title II accessibility requirements; she said the agency has “until October” to meet those accessibility obligations. She indicated the portal board’s mission and funding model may be reviewed to address the scale and cost of maintaining the site.

Committee members asked how the agency communicates major upcoming costs to the legislature and how it is making technology spending more transparent. Hughes pointed to the EPMO and a service catalog the agency is building to assign dollar values to systems and model when legacy systems will need major capital investment. She said some legacy services remain on-premises, but the state has moved most capacities to cloud providers (noting use of AWS and Azure and a hosting partner in northern Vermont).

Hughes invited the committee to request follow-ups on specific topics during the session and said agency staff will return with more detailed briefings and materials. She also acknowledged using acronyms and said she would try to use fewer or to explain them in future presentations.

Less critical details: Hughes said the agency’s security team works closely with Commissioner Morrison at the Department of Public Safety on federal cyber grant funding and that the agency’s data team helped build a housing dashboard for the Agency of Commerce and Community Development. She also mentioned lidar and mapping work under state geological services.

The meeting did not record any formal committee motions or votes on the agency’s requests; the discussion was an informational briefing and a planning conversation about future committee oversight and appropriations.