Agency of Digital Services recommends in-person briefings instead of relying on annual written cybersecurity reports

Sean Naylor, program director at the Agency of Digital Services (ADS), told the Senate Government Operations Committee that written annual cybersecurity reports often ‘‘don’t land in the right places’’ and recommended more regular in-person briefings to committees with a stake in cyber resilience.

Naylor said the cybersecurity advisory council’s written reports have included recommendations (for example, membership changes) that have not led to follow-up, and he argued a live briefing—question-and-answer format—would allow the council and ADS to explain technical priorities and receive immediate direction. ‘‘Technology specifically cyber security is not static enough to be annual anything,’’ Naylor told the panel, adding that a conversation-based update helps committees apply recommendations to operational needs.

Members discussed statutory timing: some ADS and council reports are due January 15, which occurs before the Legislature is routinely in session; a number of senators supported shifting that deadline to February 15 to give agencies time to schedule a committee briefing after the report is finalized. The committee also discussed whether to retain written reports in statute, require a written submission plus an in-person briefing, or invite ADS/council testimony annually without an explicit written-report mandate.

What’s next: Committee staff and ADS will coordinate on whether a deadline adjustment (e.g., Jan. 15 → Feb. 15) or a combined written-plus-briefing approach should be included in the committee amendment.