The Monitoring Gap Below the State Line
State agencies are increasingly instrumented. Many states have a security operations center, log aggregation, and some version of a SIEM. The coverage problem is the institutional gap below the state line: county systems, municipal networks, school districts, and public utilities that often run aging infrastructure without 24/7 monitoring or a dedicated security team.
Until October 1, 2025, the Multi-State Information Sharing and Analysis Center (MS-ISAC) provided free around-the-clock SOC monitoring, threat intelligence, and incident response support to SLTT governments as a membership benefit funded by a CISA cooperative agreement. That cooperative agreement was not renewed; DHS/CISA support ended September 30, 2025. CIS, the nonprofit that operates the MS-ISAC, transitioned to a member-funded model; membership now carries a fee, and the 24/7 SOC services are no longer free. The MS-ISAC had served more than 18,000 SLTT entities as of 2025, before the funding change; membership contracted substantially in the months that followed. By mid-2026, reporting citing CIS indicated roughly 15 states had committed to statewide paid memberships to cover their local entities.
The gap that results is a detection gap, not just a budget gap. A county that no longer has 24/7 monitoring doesn't just lack a service—it's invisible to the state's threat picture until something breaks badly enough to surface through other channels.
Three Prerequisites That Can't Be Skipped
States that have built functional whole-of-state detection and response programs share three enabling conditions. Each requires deliberate work before detection tools matter.
1. Legal Authority or Documented Consent
A state SOC cannot collect logs from a county or school district network without some form of authorization. The strongest foundation is enabling legislation; where that does not exist, documented consent through a contract or memorandum of understanding can serve as the authorizing instrument. Without either, installing a sensor on a county system or ingesting its log feed can raise serious legal questions, however well-intentioned.
North Dakota established a legislative foundation with Senate Bill 2110 (2019), which gave the state IT authority to engage and defend the seven branches of government, as then-CISO Michael Gregg described in a 2023 GovTech interview. As Gregg described it at the time, the goal was to grow endpoint coverage from about 20,000 to 250,000 endpoints as the whole-of-state model expanded. (Chris Gergen became ND CISO in July 2025.)
Without equivalent authorization—legislative or consent-based—a state CISO can share threat intel and publish advisories, but cannot deploy sensors or ingest event data from local networks. That is not whole-of-state detection; it is threat intelligence dissemination, and its effect on actual incident dwell time is limited.
2. Technical Integration Standards, Not Just Connectivity
The second prerequisite is the harder one operationally. Offering SOC services to a county or school district is not the same as integrating their log data into the state's monitoring environment. Integration requires:
- Log normalization across different SIEM platforms, network devices, and endpoint agents
- Agreed-upon event types, severity thresholds, and escalation triggers
- Sensor deployment on endpoints and network chokepoints at the local entity
New York's Security Operations Center (NYSOC) operates 24x7x365 from facilities in Manhattan, Rochester, and Albany with more than 60 analysts. As of June 2026, it extends monitoring to 34 state and local government entities beyond the state's own agency infrastructure—with capabilities that include log collection, real-time monitoring, threat intelligence sharing, incident coordination, and proactive threat hunting. That capability was built incrementally, with each new entity requiring its own integration work—and many more still being onboarded.
The friction point is the institutional baseline. To illustrate hypothetically: an entity with a modern SIEM, accurate network diagrams, and a named technical contact is a fundamentally different integration challenge than a county with no log centralization and no dedicated IT staff. Treating these two cases as equivalent in a whole-of-state implementation plan is how projects stall and cover fewer entities than projected.
3. Incident Response Authority and Coordination Agreements
Detection without response authority is surveillance. When a county network shows signs of a ransomware precursor at 2 AM, who has the authority to isolate it, notify the county leadership, and engage incident responders? If that answer is "we'd call the county IT director and hope they answer," the SOC is providing monitoring without protection.
Effective whole-of-state programs solve this with formal agreements: memoranda of understanding that define what actions the state SOC can take autonomously, what requires county notification, and what triggers escalation to law enforcement or the state emergency management agency. The NYSOC's operational model coordinates directly with the New York Division of Homeland Security and Emergency Services, public authorities, and law enforcement—not just the state Office of Information Technology Services. That interagency structure is the response layer; the monitoring tools are the detection layer.
North Dakota's program extended this through a Joint State SOC, sharing threat intelligence and indicators of compromise with partner states. According to a September 2025 GovTech report, the partnership had grown to more than 10 states, with mutual crisis support described as a long-term goal.
The Two Operating Models With Track Records
Once the three prerequisites are in place, the practical choice is between two models:
State-operated shared SOC. The state builds and operates its own 24/7 SOC and extends it to cover local entities through the integration and authority structures described above. New York's NYSOC and North Dakota's program are the clearest documented examples. The startup cost is high—New York's NYSOC required 60+ trained analysts, multi-site infrastructure, and years of integration work—but the ceiling is also high: full state visibility into the threat picture across state agencies, local governments, and sub-state entities.
Sponsored MDR service. The state funds or facilitates access to CIS MDR or a commercial MSSP for local entities that cannot build their own capability. CIS MDR is available to SLTT governments as an add-on to paid MS-ISAC membership, backed by CIS partnerships with CrowdStrike and Sophos, and priced by quote. Some state programs have pursued sponsored MDR arrangements to extend coverage to local entities while the longer-term shared-SOC prerequisites are being built.
The critical distinction: a statewide MDR arrangement deploys detection capability *at* local entities, giving each entity its own threat monitoring. A state-operated shared SOC deploys detection capability *over* local entities, extending the state's own visibility. These are different things. MDR addresses the local entity's detection gap. A shared SOC addresses the state's situational awareness gap. Some state programs need both.
What Fails in Practice
The same failure pattern repeats across states that attempt whole-of-state coverage without the prerequisites:
Threat intelligence sharing without monitoring authority or integration. Publishing advisories and sharing indicators of compromise improves awareness but doesn't move the needle on dwell time for local entities that have no SOC to act on the intelligence. This is the most common form of premature whole-of-state branding.
State SOC expansion without signed agreements. A state SOC that covers state agency infrastructure and three counties that signed MOUs is not a whole-of-state program. It is a partial program that may not cover the county with the weakest posture, because getting the agreement signed with the most resource-constrained entity is exactly the hardest part.
Treating SLCGP as the sustained funding vehicle. The State and Local Cybersecurity Grant Program's statutory requirements expired September 30, 2026, and no FY2026 appropriation was enacted. FY2022–2025 awards continue under their periods of performance, but the federal pipeline of new money has ended. Sustained 24/7 SOC operations—whether state-run or MDR-contracted—require state budget lines, not grant cycles.
A Decision Sequence for State CISOs
Before choosing between a state-operated SOC extension, a sponsored MDR service, or the joint SOC model, work through these questions in order:
- Does your state have enabling legislation or a consent-based framework? If not, the whole-of-state model is legally constrained regardless of technical capability. The right first move is working with state counsel—and potentially the legislature—to establish a clear authorization basis, not buying more monitoring tools.
- Does your state SOC provide genuine 24/7 coverage? An on-call or daytime-only model means extending to additional entities before fixing the base. Get to 24/7 on the current scope first.
- Do you have MOUs with every entity you claim to cover? An entity without a signed agreement is not covered. Audit the MOU list against the entity list before reporting coverage numbers to the governor or legislature.
- What is each target entity's technical baseline? As a planning illustration: a well-resourced county with a modern SIEM and named contacts is a very different integration challenge than a rural county with no log centralization. The implementation plan needs to treat them differently.
For states at the beginning of this process, CIS MDR or a commercial MDR contract for specific high-priority local entities is frequently the right intermediate step—not as a substitute for building state-level coverage, but as a way to close the most critical detection gaps while the enabling prerequisites are built. What it cannot substitute for is the authorization framework, the MOUs, and the incident response coordination that let the state act when something is found.
What to Prioritize This Quarter
The 2026 NASCIO-Deloitte study's 63% local-confidence number suggests most state CISOs already know they have a problem; the gap is in the enabling work to act on it. Before the next budget cycle closes, the most useful concrete step is to audit what you actually have: a list of the local entities you claim to cover, the MOUs that authorize your involvement with each, and the SLA or coverage commitment that goes with each MOU. That audit will reveal how much of your whole-of-state program exists in policy versus in operational fact—and it is the right input to the resource case you'll need to make to sustain state-funded SOC operations once grant funding ends.
Spartan X has designed and delivered multi-agency AI platforms for state government—providing strategic advisory and platform delivery for Colorado and Florida engagements that required integrating across agency boundaries, data governance frameworks, and technical architecture simultaneously. That experience in complex multi-agency platform design and delivery translates directly to the coordination infrastructure that effective whole-of-state detection requires before any new monitoring platform changes the threat picture.
Sources and further reading
- 2026 NASCIO-Deloitte Cybersecurity Study press release, April 27, 2026
- New York State Security Operations Center (NYSOC), NASCIO Award
- MS-ISAC membership FAQ and funding transition — CIS
- MS-ISAC overview — CIS
- CIS Managed Detection and Response
- North Dakota whole-of-state cybersecurity, Chris Gergen — GovTech, September 2025
- North Dakota CISO Michael Gregg shares cyber plans — GovTech, May 2023
