Vermont Legislature SmartTranscripts:

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: Hello, Great.

[Rep. Kathleen James (Chair)]: Welcome everybody to House Energy and Digital Infrastructure. It is Tuesday, April 28, and we are here to receive a report, a cybersecurity report that was submitted a while back, but we never really had time to walk through. So we'll just go around the room and introduce ourselves, then we'll turn it over to you for the record. So I'm representative Kathleen James from Manchester.

[Rep. R. Scott Campbell (Vice Chair)]: Scott Campbell, Saint John's Berry.

[Rep. Richard Bailey (Member)]: Richard Bailey, one oil two. Good morning. Windham Windsor, Bennington.

[Rep. Michael "Mike" Southworth (Member)]: Michael Mike Southworth, Caledonia two. Christopher Howland, Rutland four.

[Dara Torre (Clerk)]: Dara Torre, Washington two.

[Rep. Bram Kleppner (Member)]: And Kleppner, Chittenden, thirteen bros.

[Rep. Laura Sibilia (Ranking Member)]: For the record.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: For the record, Sean Naylor, agency digital services. Current title, special programs director. But prior, I was in the role that was Denise was in and retired in 2023.

[Rep. Kathleen James (Chair)]: Great. Thank you for being here.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Yeah, so as I mentioned, I retired but I came back and I worked part time on a couple of public facing cybersecurity programs at the agency digital services that the executive branch is heavily involved in. The first of those is the Cybersecurity Advisory Council, and the second is the state Rural School Cybersecurity Grant Program. We're gonna talk about how there's a convergence of those efforts as we get towards the end, but we have a presentation and I don't know if it was submitted, but I can share it if that would be helpful.

[Rep. Kathleen James (Chair)]: That'd be great. Yes, please submit it. We'll get it posted and just for members of the committee and also for our committee assistant, annual report that you submitted in January is posted on our website. But it would great to move it to today's testimony as well. Alex, it's under reports and resources, agency of digital services, and then it's cybersecurity advisory council annual report 2026, and it was posted this past January. So alright. So we'll get that posted today as well.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Alright. There we go. A little bit of delay. So yeah, we're gonna talk about it. I'm not gonna step through the report. We can bring it up, and it is not a lengthy report. We recognize the volume of reports that this body sees, right? So we try to keep it to the very specific details that are relevant, and also identify it in the original statute from 2023. So let's get into it. Subsecurity Advisory Council, the annual report consists of, in essence, we give you the background information, right? So we talk about current membership, enabling legislation, so you don't have to go look up like all the what we're operating towards. But then we dive into the accomplishments for the year. Then we go into what we're planning for work for the next year. Then statutorily, we're asked to make recommendations to the legislature and then there is a strategic plan that is kind of wraps it up. The strategic plan was originally developed and included for the first time in the 2025 report but we included it, We're going to continue to include it because it's going to evolve just like all technology and specifically cybersecurity. It's not doesn't stand still. So it'll be a part of the annual report as we move forward. One of the things that I wanted to touch on from accomplishments this year, because it relates directly to the charge of the council, which is to in statute, and I'm going to paraphrase, right? In essence, the council should act as the connective tissue connecting with federal partners, connecting with colleges and universities, connecting with other organizations that have a vested interest in the cybersecurity of critical infrastructure in Vermont. Critical infrastructure in Vermont is unique in that there are 16 designated federal sectors, but at the same time that in 2023 session that this bill was introduced and became law, an additional Vermont specific sector was added that we consider. Its current title is essential supply chain. So think about what we concerned ourselves with back in 2023, were coming out of a pandemic. Things like food sources, PPE, those things that were essential during the pandemic may not have fit nice and neatly into the federal sectors, so a seventeenth sector was established in Vermont Statute for Essential Supply Chain. And so one of the things that we spend quite a bit of time doing is advocating for both our work of the Cybersecurity Advisory Council generating interest. We have grown to have a fairly significant public following that joins the meetings and has also started contributing. It's one thing to sit and listen and another to actually contribute, and we're seeing more of that now. But also, we believe strongly that the bad actors don't work in isolation. They work together to share information of vulnerabilities, places to exploit organizations, and that in order for us to be at our best, it is a full team effort. So when we talk to folks, we're talking to everyone from the National Guard to the FBI to the CISA, the Cybersecurity and Infrastructure Security Agency. We're talking to Champlain College, Norwich University. All of these organizations are routine groups that at the very least we've established a relationship, right? So when something happens, we have that relationship, we know who to pick up, we have contact information and we can engage. So one of the ones that I'll just step down through these quickly because I think these are the highlights. So May, so just almost a year ago, Secretary Riley Hughes and myself went to had a tremendous opportunity to go up to Vermont Air Guard Base and present to the National Guard and Military Reservists. And these are response coordinators. So this region of the country, I want say it's Region 6 by definition, but this is an annual meeting of National Guard and Military Reserves Army, Air Force and Navy, right, Marines, where they get together and they understand where the risks are. Because often when something escalates that, think about it in the context of a natural disaster, right? When resources are needed that go beyond what Vermont has capabilities to reengage the National Guard and then from the National Guard, there's opportunity to engage resources that they may not have from active military or reserve and stuff. So these are the people that work together to coordinate responses in the event of some sort of catastrophic issue. So we presented to them around cybersecurity, cybersecurity advisory council, or I went to the secretary, but I think it was really well received. We had a lot of good questions and just a lot of general interest, right? And so now whether it's Maine or Massachusetts or Connecticut or Vermont, all of those understand Vermont's approach and posture when it comes to critical infrastructure and cybersecurity protections. That was a big one. June we presented to the Governor's Council on Emergency Preparedness. July, this was not myself, this was the CISO who's a member also of the council, testified in DC to some senators on the renewal of the Cybersecurity Information Sharing Act. We aren't just in Vermont that we're advocating for these. Out of the first three, there are two of them included at the very least regional or national entities. July, we're going international now. This is not the first year. I think this might have been either the second or third year where the Vermont Council on World Affairs in Burlington works with the Department of State to bring in delegations to learn about certain topics from around the world. These people are vetted by the Department of State. They have a very specific interest. Two years ago, I think it was Latvia. The delegation was from Latvia and we presented on the work of the cybersecurity advisory council security and how we're trying to address it from a state government perspective. Last year, was a multinational effort. There was representatives from Brazil and Angola, The Philippines. I don't have them all listed here, but I mean, I think there was eight different countries that had representatives vetted by the Department of State in Burlington, really wanting to understand cybersecurity technology and state government and how it all of weaves together. Wanted

[Rep. Kathleen James (Chair)]: Yes? Question about that. I'm just curious. That's it's really interesting to me that you guys are presenting more to, like, national level delegations from other countries. And are they interested in our state level work because it's on a par with where they're at as a national government? Or are they more interested in like, oh, our provinces could do this or we could bring this to our

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: The interest, not exclusively, but the interest from what I've been able to understand in conversation with these folks and the different entities is that we are ahead of almost anyone in this space and how we're approaching this. They're curious to hear and what we're doing is not, I want to say it, is not constrained by scale.

[Rep. Kathleen James (Chair)]: Okay.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: So it's really about what Yeah, we're what we're doing, how we're approaching it. That's what's been driving the kind of the curiosity at that level.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: Cool.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: August, we participated in the Vermont Digital Summit, which is an annual event this year. We're actually have we've moved our July meeting to be in August and we're gonna have it in conjunction with the Digital Summit. So we're trying to make sure that we give the folks that are attending the digital summit the opportunity to also sit in on a council meeting and learn more about what the council does and collect feedback on our work. September was at JITOC, giving a little overview of what the council was, and then in October went to Vermont's electric utilities, so they have what started out as an annual meeting around cyber security and has grown, we'll talk about that in a minute and kind of the forward looking perspective. Spoke about the council and because obviously electric utilities is one of the key critical infrastructures in the state, right? Everything else kind of builds on top of having electricity to operate so making sure that there is connectivity there between the work of the council the representative that's on the council and the work of the all the different utilities So just kind of an overview of the higher end things that we're doing for outreach. Now we're going to kind of walk you through a little bit of the past and kind of like where we're going as a council. So the first thing that the council undertook on creation was over the course of the 2024 was conducting a survey of critical infrastructure operators in Vermont. Because one of the things that's in statute is that we have to understand kind of like what's the playing field of where everybody is from a maturity perspective. And so we did that. We conducted that survey. We had what I believe for a first time survey, good response. We had 119 partial responses and I believe two or 77 complete responses. So considering the size of Vermont for the first time, it was done anonymously. So we did not want to be able to link We were hoping for honest responses and therefore this was not meant to be punitive in any way, so we didn't want to tie your response to being associating it, A. B, we did not want to sit on that information because that would be a honeypot for any bad actor to gain access to, to know who were the weakest respondents and then therefore creates a nice little hit list. So those are important things. At times, I'm gonna sound like, I feel like when I talk about this stuff, it's almost like spy versus spy, right? It feels that way, but a lot of this has got to be really guarded because the bad actors are out there and they don't distinguish between a drinking water system in Vermont from a drinking water system in California. It's just something they're looking for vulnerabilities to exploit. So based on that survey, what we found was that, not equally, but the majority of respondents could be categorized in three different tiers. We have those that have a fairly mature cybersecurity program of some sorts. Think like what the state of Vermont has, right? Where you have professionals, that that is their responsibility, that is their title, that is their goal. Then we had like this middle tier where the organizations knew they should be doing good cybersecurity hygiene and practices, but got a lot of like, we're planning to do it in process. What felt like when you kind of interpret it all was a lot of them knew they needed to do something but lacked the resources, whether those resources were personnel, financials, right? There was constraints that were keeping them from making kind of the big next step. And then the last was those that were kind of like, we had a response that was I don't know. There was a remark that was like, don't know. Or no, they're not doing anything. And so at least they were informed but it felt like, that portion I would categorize as the organizations that likely don't recognize the risk that they're facing or just the reality of competing interests. If you're a small electric utility, you going clear the right of way to make sure that you don't have five day power outages the next time there's a significant ice event or are you going to go do a cybersecurity risk assessment? Right, I mean there are challenges for all organizations. So as a result of that, and then when you looked within the sectors, right, because one of the things we did gather even though it anonymous is we asked organizations to identify which critical infrastructure center they were in, What became apparent to the council is that the council through the results of that survey had gone about as far as it could in doing something that was, let's call it blanket impact, right? That was going to impact all 17 secondtors, was going to have a positive impact regardless of the size of the organization. The dynamics are just such that if we did something that was going to help a small rural telecom operator odds are that would have no bearing on a large healthcare organization. So where we got to was taking the results of the strategic plan which was done kind of like as universally and based on the survey and saying okay now we need to start working on a sector specific basis. We need to it's like we need to build identify, a profile for that sector and then figure out what is the priority improvements for that sector because financial sector is going to be different than wastewater, which is using operational technology, whereas financial is heavily in protecting data. And that's going to be different than local government services, that's going to be different than first responders, and that's different than defense industrial base and dams. I mean, all these sectors have very different operational requirements and therefore their risks are in different places. So starting, let's say about late summer, early fall of last year, 2025, the decision was made that each one of the representatives to the council from the different sectors. So we have five in statute representatives representing four different sectors. So remember I said there's 17, we have four sectors represented. And those are energy, healthcare, water and wastewater, and essential supply chain. And each one of them went out and kind of started a working group of their peers to understand where are the challenges in their specific sector, how to take the strategic plan and other work we're doing and kind of figure out how that helps that sector improve, right? And come up with like the tools that others maybe that aren't so fortunate to have resources can use to make improvements. The one area that we have two representatives for is healthcare. We have someone from UVM Health. Just sorry that they dropped network from their name, so GVM Health. And also vital from our information technologies leader, which is the organization that is the, I've got to remember all my acronyms, I've been retired now, the VITAL, Vermont Health Information Exchange vendor. Did I get it? Excellent. So they are the ones that, that organization is the reason that if you go see a specialist, they have access to certain records of yours, maybe even though they're not in your network, right? So certain medical records flow up through a central repository and then can be accessed by others to help improve your care. So that's the VI. So we have two representatives from the healthcare space, one focused on data, the other focused on hospitals. And so we now have these four working groups. Interestingly, I sit in on three of the four to help kind of facilitate and just offer my services as they need. And then the fourth one, none of them are working in the same thing. I've they've kind of, like, all kind of formed, got to know each other, kinda, like, shared their war stories amongst each other, and figured out, like, where's the best thing for them to spend some time right now in your working group to help their sector out? And none of them are working anywhere near each other. There's not, like, overlap by any means, which goes to show that both the maturity of the organizations and the sector vary significantly. And so what's important in one sector is that not important than others. As an example, the essential supply chain is representatives are heavily from insurance and finance sector and their area of interest that they have chosen to work on is disaster recovery and continuity of operations. In other words, if you're a financial institution and you get hit with a cyber event, A, how do you recover as quickly as possible? Because financial is based on trust and the shorter amount of time you're unavailable to your depositors, the better off you are in a vet. But more importantly, how does the financial institution continue to function while recovering from that cyber event? So they're like working at it from that perspective. Healthcare is working on like third party vendors, contractors. So due to HIPAA, right, due to things like the, when they were a network, UBM Health's issues a few years ago, right, where they were cyber security event. As a sector they are all fairly mature and so they're working on things like how do we protect ourselves against Stryker, right? So I'm not sure of those that are aware but probably about six weeks ago now, six to eight weeks ago, medical device company Stryker was in essence got owned and everything and wiped out. They provide robotic surgery devices and things like that. So there was hospitals that were just canceling procedures because their robotic surgery devices could not function because they got wiped at the Stryker main offices. Right? And so there are things you can do when you're buying into a vendor that helps protect you or at the very least in an event gives you at least some recourse for recovery, right? And so that group is looking at how do we structure better third party contracts? If we're going into, if we're having a contract with someone, how do we make sure that cyber is front and center and not an afterthought or dismissed from operations? Water and wastewater, I'm not sure how much folks pay attention in the cyber news space, but there are some tremendous stories of water supply, drinking water systems being owned by the PRC, people of global China having just credentials and access just sitting dormant on key infrastructure and waiting to just wake it up and do whatever they want when the time is right. So water and wastewater has kind of really coalesced around threat intelligence, understanding where the current set of threats are, think like Iran, but also in the event of that, how do they respond and recover because many of them are not maybe they've not done a tabletop exercise to assure that their disaster recovery tools will function in an event. Can I ask a question about that? Yes. So, do we know how, whoever it is, bad actors are accessing water and wastewater systems? What's the vector, I guess, you would say? It is really all over the place and it varies from environment to environment. So it depends on how the network is structured. They take their off? So I'm going get a little geeky for a second. So in the water systems, the things that control, if you've got automation that controls like valves, right, maybe you have a, I don't know, Siemens has a product that allows you to connect and open and close valves for distribution or modify the amount of chlorine going into stuff. So that's one big one. If you segment your network. For an internet portal or something. Well, it's web facing, so one of the things that people wanna do is segment their network and take all the stuff that runs that and make it not internet facing. Yeah. Right? So that's a good practice, but small organizations that have just one network and no network security specialist, that's, you must be talking rocket surgery. I mean, it's a challenge. Well, and we have a lot smaller. Absolutely, we do. And that is what we're focused on, right? Is really looking at the small operator that may not have the resources, how can we give them something to follow that helps them improve their posture? That's really what we're after. So that's why like water and wastewater is looking at it. The, you coming back to your question on the vectors, there are many. Each organization, how it's structured, where its risks are, are going to vary depending because everything that is tech is a risk, right? Unless it has been actively managed to reduce that risk. So some organizations may really put a heavy emphasis on the network but maybe they're not patching and updating their regular computers, And so some basic vulnerability that Microsoft has in an operating system that the laptop has or computer hasn't been updated in six months can now be exploited and the water system runs but all the credit card payment information and the invoicing system gets compromised. Mean the risks run the full breadth of what you could imagine. Well, just out of curiosity, because we have a bill that we've been considering about meters, water meters in particular, from what we're hearing, those aren't a vector because typically they're not connected to the Internet. They're just they are broadcasting to, say, a truck driving by, and all they're transmitting is two numbers, meter number and gallons, for example. Yes, typically what you're looking at is a consumption report, that's it, right? I'm meter X, And in the last month, this many gallons has passed through my system. Yeah. Period. And so when we look and we talk about network segmentation, SCADA systems, The command systems that run these environments, we look at the billing, customer information. We look at all of the other tech advanced metering tools are like, they're a long ways from making the top probably 50 of worries right now. Right. Right? Because they are a very simple tool at this point of who am I? How much water has been used here? And not connected to the internet, though. Typically, you can I think that can vary? I think the infrastructure, it depends on who implements it. They can, but I mean, often, I mean, I got it on my propane tanks at home. I never even realized it. All of sudden, I'm looking at my propane tanks and I got this gray device that sits on top of it. That will still be antenna. You know what, next time I'm getting a film, I'm like, Dude, what's that? He's like, Oh, whenever we're in the area and we go by, we have thresholds, and if you're below, it triggers us, and so we know to get you on the delivery system. I'm like, Oh, I kind of like it. I guess I'll accept the risk. But that's typically how they work, right? They're more of a fail safe than they are, or in this instance, just a tracking, right? Not tracking anything other than consumption. Anyway, it's a very low priority, right now, compared to the other risks. Yeah, okay, thank you.

[Rep. Bram Kleppner (Member)]: But on the other hand, if somebody got a two fifty gallon tank outside your house, they also know when it's full. The bad guy getting that information from that radio knows your fault. Oh,

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: there I mean, yes. But let's think about the scenario. Right? For myself, I'm on a hill in Worcester. The bad guy's gotta know where I am and drive within distance, right, of my house. Right? So, yes, there is there is a certain risk that goes with that that scales with density, but in much of Vermont, it's not worth you'll burn more in gasoline driving the back roads trying to figure out and sniff out which ones are reporting. Than to

[Rep. Bram Kleppner (Member)]: steal right from the vendor.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Yeah, there are other ways, and those are the risks, right, that we really are focused on. So that's why it's a, there is nothing that is not, that's what I'm saying, anything that includes tech at some point ends up being a risk, but you've got to prioritize and look for where your big risk is versus, and I've often, because this came up at the last, we were talking about, I think it was S-two 13, is the bill you're referring to. Yes. We talked about it at the last council and we talked about it at the previous water wastewater working group meeting, and the consensus is that anything that would be in stature would feel like a distraction from the work we're truly trying to do to make improvement on the higher risk, right? So I guess that's how I would characterize it. That's good. That's very helpful. Thank you. Yes.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: Would you

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: like to add anything, secretary? I'm I'm trying to save your voice. I already have mine.

[Rep. Laura Sibilia (Ranking Member)]: Correct, Sibilia? So anything that would be in statute would be a distraction from what we are doing. And so that make I I can understand in that in that situation. Right. What is the visibility that the legislature has into this work and into the learnings and into the progress and into the vulnerabilities, competencies that are being developed, tools that are necessary? What is the visibility that the legislature has and or the judiciary?

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Into, for the cybersecurity advisory council? What they are Yeah, we the annual report. We have any testimony that you invite us to. And we're covered under open meeting law. All the work is available at the meetings to attend and participate. We don't limit participation for the council in any way. The working groups offer work outside of that context, but everything that they do, they report out their work in the council meeting. So there are the existing avenues seem reasonable, but that's from my perspective right now because we've never had anyone from either the House, the Senate, or the judiciary join any of our meetings.

[Rep. Kathleen James (Chair)]: Well, actually, since we're talking about it now, we had had on our agenda like a little separate follow-up section. Yep. I don't know if you guys just wanna go there right now or you wanna wait, but we do have a bill on the wall, H five sixty, that would add a member well, the chair of the House Energy Committee, the chair of Senate Finance, and then our an appointee of the judiciary to the cybersecurity advisory council as working members, and that was why we put it on the agenda and sent that along to you guys. We wanted to get your opinions on that.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: I will offer my opinion as kind of like the facilitator.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: I think it fits well in your next slide as well. So it's a good transition.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Yes, so let's link that to something that's been in the annual report for two years now. From my perspective, having now been back for a couple years, worked with this council, what the council needs is the representation of critical infrastructure operators. So if someone from the House and the Senate knew judiciary have run an electric utility, a water system, a wastewater system, that would be huge and very helpful because that's what we're lacking right now. The current membership is Vermont Gas Systems, Chittenden County, strong cybersecurity program. Champlain Water District, Chittenden County, strong cybersecurity program. UBM Health, very strong cybersecurity program. Burlington Electric Department, very strong cybersecurity program. And Vermont Information Technology Leaders, very strong cybersecurity program because they hold all of our medical data that's shared through the Beehive. And through the executive branch, have the chief information officer, chief information security officer. So we heavy in experience on the technical side. What we lack is the perspective of those folks that answered in the middle tier or lower tier in our survey to help us figure out what they need to make the next step. And because we are governed under open meeting laws and our council meetings are open, advertised, posted to all the warned, all the sites and they're all done remotely so there's not a limitation for participation. I don't in my opinion, additional members would be better served to get underserved critical infrastructure operators represented. And in the last two reports of the council under legislative recommendations, we have asked for that. Remarkably, if you look right when I rattled off the working groups, there's a big one missing. Telecommunications and Internet service providers. That is the backbone of everybody's head. Right? You're air gapped if you don't have an ISP, meaning you're not getting there anywhere on the web, right? You're sitting here by yourself. So that is a And I was secretary at the time, right? And as we were working through this, definition of it, I think it was Senate gov ops at the time, right? That was something that didn't even clip with me at the point. But it's shown to be a shortcoming, lack of membership there. And then the other is that much of our critical infrastructure, but well, a significant amount is owned by local municipalities. They run a lot of the water systems. They own a lot of the wastewater systems. We have,

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: I don't know,

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: 10 villages that run electrical systems, The Orleans, the Bartons, the Swans, the Hardwicks, right? We're not talking large communities here. We're talking communities that are often resource constrained, whether that be people or financially. So we think an expansion to the council membership would be better served to include somebody from local government. I met last week with a gentleman who's the village manager in Swan. My name is Bill Sheets. Wonderful. Getsa would be a tremendous addition. Somebody like that. It doesn't happen in Cambria, but I mean, we need somebody that kind of knows that he's sitting on a really big pile of risk because they have law enforcement, they have a dam, they have water, they have wastewater, and they have electric out of the villager swamp. And so he knows he sits on a lot of risk with those other than just that his plastic dam is falling down. So that to me is where there is a need. Now, one of the things that I would offer, I've been thinking about this a lot, The way the current language for the council is written, it does not allow it's very structured in its participants. It says these, what would be, I don't know if this body would be interested, but what would be an interesting alternative to say the council membership at a minimum, right, includes these, and then other critical infrastructures as deemed appropriate by the council could be selected by the secretary of the agency digital services, state CIO, right? And then be some sort of like reviewed when you were back in session and make sure that you're comfortable with it, right? So that there's a minimum that we have those that are identified in statute as a minimum, but that there's the ability to incorporate others either based on temporal risk, right? If all of sudden we have a significant cyber threat on a lesser community defense industrial base, of which there are quite a few vendors within Vermont contractors, We could expand to include them if they were for some reason a high risk at the time and the resources of the council could help us. So that's a long way and I know I took what your question was and bent it to I have seen as need. So I'd be glad to answer any questions.

[Rep. Kathleen James (Chair)]: Well, don't want to knock you off your slides either, but yeah, Sibilia? No?

[Rep. Laura Sibilia (Ranking Member)]: So distinguish for me the difference between local government and state government. So, state government has three branches, and one of the branches is on this. We are talking about the vulnerabilities locally. I think that's a great suggestion to have someone from local government on there. So are you Is there something I'm missing?

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: I guess why I'm not advocating for someone from the legislature or judiciary? What one of those 17 secondtors does the legislature or the judiciary operate on behalf of citizens of Vermont? Electric, water, wastewater. So government services is a big thing, of which that includes education, that includes local government, it includes state government, but that's only one of 16. So we've got these other, we've got what? 13 secondtors that are not represented currently.

[Rep. Laura Sibilia (Ranking Member)]: I think it'd be great to add that.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Right, but government is already kind of covered, at least at the state level, that ADS sits there with both the CIO and CSO, but we're saying local government needs to be there to represent government services. But that's what I'm saying, as I keep coming back to, we need people with experience running critical infrastructure, of which, the legislature and the judiciary are not running water systems, electrical utilities, wastewater. They're not defense industrial based contractors. I mean when we look at all those sectors they are a sub sector within one of the sectors.

[Rep. Laura Sibilia (Ranking Member)]: So I I appreciate the suggestion to add in this critical infrastructure representatives. I think that makes a lot of sense. I think we'll just have to agree to disagree that the legislature and the judiciary are not hard of seeing government. So

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: I'm not saying that they're not. What I'm saying is is government services, well, government facilities is the second. That includes- Courts. Everything. Schools, all three branches, local government, all that falls into just one government facility sector. And what I'm saying is we've got 13 other sectors that aren't represented I would much rather make sure we have telecom and ISPs. I think somebody from like a cut, the last mile operators that could really benefit learning what experience there is in the cyber council also helping us drive work to help them ensure that they're gonna protect my house in Worcester because I'm on CV Fiber.

[Rep. Laura Sibilia (Ranking Member)]: I I don't know why we even wrote both. It was, guess, my point.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Well, there's so there and then there's a and the reality is is there's a finite amount of capacity, which is why we're not advocating for dams right now. Right? We're not advocating for the defense industrial base. We're not advocating for emergency services. We're not right? There's still a lot of sectors that are not gonna be included, but this feels like when you understand scale, do a risk assessment, right, what's the likelihood and impact? These two sector, these two representatives will make a big step forward.

[Rep. Kathleen James (Chair)]: I want to let you finish your slides and then we'll maybe come back to this. Sure.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: So we really covered this right here, right? So in the last two annual reports, we're statutory required to make recommendations to the legislature. We have recommended expanding membership. That hasn't happened in two sessions now, so you'll see it in next year's report. We will be advocating for growing that membership. We talked about there's 17 secondtors, one Vermont specific and 16 federally designated, and that we really only have representation from four sectors at this point. We're gonna shift gears a little bit and talk about the end of the annual report that's into our strategic I'm not gonna get in-depth of this, right? But to give it an overview, the strategic plan identified five distinct strategies, right? Based on the survey, based on the work of the council, we looked at it and said, these five strategies, in working in these spaces will help raise everyone, right? We'll figure out a way to raise everyone through this. So first is outreach and awareness, right? We talked about how there's a group out there, portion of critical infrastructure operators that maybe don't feel they're at risk from a cyber perspective, So we need to, how do we make them aware, right? And be the outreach. And that's part of what I was talking about earlier. That's all part of our outreach campaign, making sure that whenever anyone asks, we make the time to go speak to them about either the work of the council or cybersecurity in general. Building strong partnerships. You know, we meet routinely with the guard. We have representation of Vermont Emergency Management and work closely with Dara Torre and the director over there. We meet with Champlain College. We meet with Newari. We work with the Vermont League of cities and towns. We're building that connective tissue to have strong partnerships. We meet monthly with the FBI. It used to be CISA, but our local CISA rep is no longer there, so they're not part of that conversation. So that's the Cybersecurity and Infrastructure Security Agency, part of Homeland Security. So we're building those partnerships, we're building that kind of connected tissue, which in Vermont has been, it's kind of easy. You talk to a couple peers and odds are somebody knows someone that can get you connected. We identified this in this, you'll notice three tiers. This mimics the results of the survey, kind of three tiers of support related to the first level, right, planning and education. We have done the research and identified a no cost resource called the Cyber Readiness Institute. I would encourage anyone that has interest in it to go look at cyberreadinessinstitute.org. They are a nonprofit, no cost service for critical infrastructure that can get on and do training. It helps them build an incident response plan. It helps them figure out how to get good basic policies in place for their organization. How to secure media like USB drives and hard drives and stuff like that. And they have a lot of training resources. So often in most organizations the biggest risk are the peak. While I was sitting here account services called me right. That's all it says, account services. It's like the third time they called me. Know it's a crap, right? Because it's not, nobody's ever gonna call you as account services. They're gonna be like some organization, It's gonna be a Mastercard or whatever, not just generic account services. But there are, they are constantly evolving the complexity of how they are trying to take advantage of our good nature and maybe a little bit of trust, right? It's in the online in the especially in the tech cyber space you have to start from a position of distrust of everything. Sadly, it goes against my nature but that's kind of the way it is right now And so those resources are available through the Cyber Readiness Institute. So we have that to get people started like how do you get training? Here's a video to help you just to share with all your employees so that they have the fundamentals of how to identify just what does a quick phishing email look like. Wonderful organization. It is actually funded by it was started by General Motors right now it's funded primarily by MasterCard I believe and but the idea was that General Motors and a couple of other heavy manufacturing realized that their biggest cyber risks were no longer their organization. It was their supply chain, right? So the small little independent contractors they you know that provided starters and alternators and fuel injectors and everything else that was critical for them to have a functioning vehicle that wasn't made in their facilities was a risk. And so they started this organization and it's actually gone down through and they have a certification program and now they're requiring subcontractors to be certified. So now they have a sense of at least basic confidence that that organization has some cyber security awareness right that's really what it's about. Was one. The last one is risk management so this is for the people that are like they know they need to do something, you know, at times they stay up at night because they know that that old desktop PC that's underneath the town clerk's desk that hasn't been patched since before Y2K is a risk. That's that second tier right where we can come in provide resources to help them identify the risk prioritize it and then how do you out of how do you put that risk to right? And move up the ladder to deal with other things. And then the third tier is those that are more mature, which is an information sharing and collaboration. So we're working to take those that are more mature and connect them in ways that they can share information. Often now that doesn't cross sectors. So a hospital does not routinely share with a financial sector something it's seeing as a risk on, say, a firewall or some sort of nefarious activity. Well, we're working towards saying, look, we're all citizens of Vermont. How do we share risk information in a way that doesn't rely on information flowing up a vertical to some sort of federal agency, then flowing back down through the other vertical so it can get to your frenzy neighbors. So that's that third tier. Strategy four, universal incident response plan template. Vermont has in statute some things that are unique around like data breaches to Vermont and stuff like that. So what we're finding is that incident response planning is like the merry-go-round that's spinning really fast and nobody knows where to jump on. So to help them find a place to start developing a template and filling it in with this stuff localizing it make it reflect the things that we know our obligations in Vermont or reflects you know key resources who's the person that the FBI to call if you could need forensics right who's the who's the person that you can get a hold of a Vermont Emergency Management right because the Watch Commander can help you get plugged in with resources as appropriate. And then lastly is, and this is one that comes back to the outreach, to everyone. One of the things we're doing is just we want a strong cyber security community. We don't want people sitting in silos. All too often in my majority of my thirty five years in the state, I'll call it computer defense, because I had to go back to the early days, often was very much a castle mentality. You built your environment like castle. It's got walls and everything else. And then when things start to go sideways, you just pull up the one drawbridge and cut off everybody else in the world until you figure out and solve your problems, and then you open yourself back up. Right? It's it's very much a not willing to share, collaborate or look for help from your peers and what we're doing is really spending the time to build those connections so that people aren't afraid to ask someone that's in their peer group, hey I'm seeing this uptick on this IP address set in our firewall. Have you seen something like it? That kind of stuff. Those are the strategies. There's a lot that goes into more detail that goes into like flushing those out. And then I realize I'm almost out of time and I apologize for the allotted time given the opportunity. I wanted to share a couple of things that I would say are adjacent, related, and converging, also to both benefiting from the work of the council and also their work is benefiting the council. So the first is the state local cybersecurity grant program. This is a federally funded grant program for cybersecurity improvements. What's interesting is that in working with communities, we realized often they don't even know like, hey, tell me what's the first thing I should do? It's like often a question. They were like, I don't know. What are you doing now? And it ends up being, and so we ended up building this concept out. We're calling the cybersecurity pillars. It's like the 12 pillars of you want to have a strong cybersecurity posture in your organization, address these 12 things and we have them ranked by levels. You can get to level two across these 12 pillars, you're going to be on solid footing, right and you're going to have a pretty good chance of repelling the bad guys when they come for you. Well that now has come to you go to our April 15 cybersecurity advisory council meeting that concept got brought over and the working groups are now looking at understanding how can those pillars help inform the work they're doing to help their sectors out and stuff. So there's this kind of bi directional communication that is kind of happening that both are benefiting from the work of the others. The next one is the multi state information sharing and analysis center. Secretary Riley Hughes this year purchased gold platinum premium. Just the state membership. State, full state membership, but it gets every government? Any

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: municipal or state organization under the Superfund, and it ends up saving the state over a million dollars in taxpayer money if we were to have those organizations pay independently for their own membership. We were one of the worst states to do it, but we just recently promoted it out. For the record, Denise, Just get you to service there. Very sorry. Prior to MSI's not losing their federal funding currently legalized October. This was offered at at no cost to states and moguls. We had close to two twenty organizations that were registered with the Department of Education, the Secretary of State's office. I know local municipalities with a lot of tribute to school districts, schools, judiciary, legislature. And as of now, I think two weeks ago when we had our last meeting, there were only 32 organizations that were signed up. So we've been trying to run an awareness campaign for folks to sign up because right now, it's not cost effective for the state to hold a membership when folks don't wanna participate. But for us, this is a a foot in the door. This is a a service that is at no cost to them. We wanna keep it at no cost to them. We want the state to be able to look at taking on that ownership. Vermont Legal Cities and Towns should also be an advocacy group to promote that to local towns. We've talked to them about whether or not their underwriters would consider a lower cyber insurance rate for towns if we're registered, for this membership. So we're really trying to expand the outreach. As of right now, we only have a handful of school districts that are signed up for it. We have two of the three branches that are signed up as of now and far less organizations that to see. We'd like to see some greater participation because they're getting daily updates on vulnerabilities. They have access to resources. This is at no cost, laundry list of different things that they could be doing, which is a highly valuable Yeah. Opportunity for that.

[Rep. Richard Bailey (Member)]: Right. Your drawbridge analogy. So with our new upgrade upgrades to all our computer systems Mhmm. You were saying that when you have this thing starting to bump up against an attack against your system, and you're opening up the Strawbridge to stop and to figure out what it what what it is so you can stop it. It's it's just gonna be incorporated in all our our computer upgrades. So

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: that's an interesting one. I'm gonna be geeky for you on you for a second. Right? So here's an example where AI could be helpful. What we're seeing is, so we kind of call this area threat intelligence, right? Advanced, active, there's a lot of As, but it's ATI often. That threat intelligence is actually evolving where there are AI tools that can interpret those warnings and that threat intelligence feed and then turn around and update your network infrastructure to repel it without human intervention. If, say you subscribe to MSI SOC, and MSI SOC at 2AM releases this, hey, there's this high threat vulnerability in this, or these IP addresses are doing this, right, It's actually evolving to the point that your network infrastructure can be upgraded without anybody there, so when you come to work, it's already dotted block. So instead of having to rely on the traditional raise the bridge, get your act together and then open back up for service, it's more like we're adding just more and more gatekeepers out front. And the gatekeepers are being like, nope, you're a bad actor, shut you off this way. Nope, you're a bad actor. Nope, you're legitimate. You're from the center for Medicare and Medicaid services, we'll let you traffic in. Right, so that's where we're kind of getting now so that, and that's where you wanna be working, right? Just, you know, I use that analogy because that's like, that was the old mindset. Now we're trying to get farther out there. We don't wanna, we don't ever wanna get to the drawbridge. We're trying to like figure out if it's friend or foe and divert the foes before they even get to them. Does that make sense? Yep. So that's the long way to say the overall network will have that kind of protections built in not just at individual systems. Okay. And apologize.

[Rep. Kathleen James (Chair)]: Sorry. For tomorrow?

[Rep. Richard Bailey (Member)]: Yeah. How has the, cybersecurity posture shifted with the recent AI developments in terms of speed and and complexity of threats.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Both sides have embraced it. Right? So the bad actors are figuring out ways to leverage AI to do stuff quicker and the white hats are figuring out ways to use it to repel the latest thing that the bad people can right? I mean one of the ways I use it I use it a lot. AI tools, language models, things like Gemini. And I use it in the context of, it is like the world's fastest research assistant. If I get the whiff of something, I'm like, all right, Gemini, everything you can find on X. And then I'm like, tell me why I need to worry about it or not. Who should worry about it? Who should ignore it? Right? Because often in our world, we're just getting inundated. I don't know how many you get a day. Right? But I mean, it's just like your email inbox is just a constant stream. What this does is it gives you tools to kinda separate the noise from the second. So on an individual worker level in the cybersecurity space, I think it helps get to an understanding quicker, which means then you can respond quicker or address it or not quicker. On the automation side, it is just accelerating the development of things like the pattern files that good cybersecurity tools rely upon to identify bad traffic and discard it and stuff like that. It's getting baked into a lot of it.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: It's accelerating the threat timeline. But we are using AI to fight bad AI, and we're using AI to fight AI generated security threats. So as long as we stay advanced, it's it's a little bit of a, you know, who's ahead now. But if if we don't go here, ignoring it puts us at a great risk. So we do have to move forward along with the speed of this transformation. I guess

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Oh, I'm sorry. Well, another way

[Rep. Richard Bailey (Member)]: to ask the question is is the cybersecurity council way it was structured three years ago with potential modifications that are infesting that have looked appropriate to the threat level speed of the change that we're seeing now and will supposedly be speeding up even quicker in the coming years. Right?

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Yeah, I think that's a wonderful question. One that's reflected in that, at least one of the working groups now has invited the state's AI director in to talk about the implications of AI and how it will impact their cybersecurity planning and stuff. But we're not at the council we're not working to help someone turn setting A on and B off on their firewall. Right? That's we're working to be, like, ahead of that to try to give them the tools to be like, hey, subscribe to MS ISAC. Right? Find a vendor that's gonna give you take that threat intelligence feed and automatically update your right? We're we're trying to get into that side of it. So the pace of AI on that work I don't see us losing ground the way we're structured right now. Think that's what you're asking. It's conscious and cognizant it's part of it but I don't see it resulting in the council being no longer relevant in the immediate future.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: Superintendent Brown, you Yeah. I would just say the structure of the council is set up for success. I think how it was modular designed is working. It took us a little while to get there. We had to build the trust because first thought is if state government is running this, it's about regulation and oversight. And this is a different side of oversight. This community is building oversight. This is making sure everybody has the resources that they need. So from that standpoint, over the last twelve months, I've seen a lot of growth the household. Getting the right people to the table has been the But biggest as of now, the trust that we've been able to build is been recognizable in the output of the case. I

[Rep. Bram Kleppner (Member)]: think one of the things that's concerning is, if you read the stuff about swabbed mice, that they're restricting because it immediately found vulnerabilities out of every major system in the world. And it's great. It's restricted, and, like, we can now fix some vulnerabilities. But it seems likely that at some point, the bad guys will get ahold of something like that or the good people do. And That's strange. I guess, I mean, you're sort of leveling up, but a little advantage a little time advantage can lead to a big disaster. I gotta get ahead of this. Yeah.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: And I and I

[Rep. Bram Kleppner (Member)]: yeah. No. I was thinking

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: I don't know how to put your mind at ease on that because that is a legitimate risk. And I would say that often what you're seeing is the leveling up is by the good guys catch up to the bad.

[Rep. Bram Kleppner (Member)]: They're

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: always raising the bar, right? And that's forcing the organizations. But where we're getting Where it's really helping is, talking about what the secretary said, one of the great examples of where AI is helping is in the past, products out there would filter your email based on patterns they looked for because no one phishing attempts and everything else. There are now products that are using that are applying AI to look at all the emails of the organizations and individually tune based on behavior. So if all of a sudden an email originates in your email to someone else and it's not written how you've ever written an email in the past, it can quarantine, it can fire you, right? So while I think the bad guys are always getting ahead, we're finding ways to at least, they're getting ahead to still try and fish us, but if we're finding ways that we can apply AI to understand our behavioral habits and then anticipate that without having to know exactly what the next threat is, that's how we start to get a little bit of lead up. Yeah. It's fun. But you're also

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: describing, unfortunately, the nature of the threat landscape. There's always going to be another vulnerability. Time opens the door for more vulnerabilities, and good guys don't always think like bad guys. They usually don't. So the vulnerability is age, time, and use. You'll always find a way that COVID gets manipulated. You'll always find a way that exposures happen and that exposure wasn't because it was designed for the hole, it's because it exposes the hole because we've been using it for so long and never using it in ways that wasn't designed for you. That's where you start getting your So this this council very much focuses on shoring up the technical debt a little bit, but also putting good practices in place. So when the events happen because any good cyber security organization assumes breach, is that you mitigate the the expanse of that of that breach itself. And how quickly you can respond and how quick you can mitigate the the threat, the better our people are. So as long as we assume breach, we know it's gonna happen. We've gotta have our eyes on the environment at all for best in season. Does

[Rep. Bram Kleppner (Member)]: the council have its eyes far enough out towards the horizon to be keeping an eye on quantum computing these days?

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: I'm laughing because I feel like we're working at the fundamentals, and that is not in the fundamentals at this point. So the short answer is no. While it's on many of our mind, right, and know that that's probably an eventuality, the reality is that we're working to help people figure out how to put a firewall at a site to just protect that site. So while we need to get there, we don't want to sacrifice, we want to raise everybody to a certain threshold before we do those things. All right. But it is structured to be able to handle that dialogue. As an example, I think it's in annual report, we talk about the three Rs, right? We're stealing something from our past where it's really, we're focusing on resilience, response, recovery, Right? And so when you look at those three R's, things like AI and stuff fit in different areas. It's not just about the resilience side, right? The bad actors do stuff, you gotta have something to thwart it. It can also help you in your response and your recovery, right? Especially in recovery because you can use automated tools to test all your backup and Doctor solutions and make sure that when that day comes, you can get back to providing services to your constituents much quicker. Right? That's that. Always assume, right, that's gonna happen with kind of mindset to be prepared for it. Don't put on your eggs and just trying to keep, be in a defensive mode. And last one just on the digital services website if you go to cyber security. Council all the information is there our meeting schedule we will post the teams information to join the meetings, all the videos. If you're really entertained, there are 13 or 14 YouTube videos ranging anywhere from ninety minutes to two hours in length that you can watch when you're suffering from insomnia.

[Rep. Kathleen James (Chair)]: Great. Well, not to beat a dead horse, but I I wanted to tell you why. I I have been interested in the idea of adding, a couple legislators to the council. So, just sort of philosophically, I guess there are three things that we do, or three things that we can do, which is that we appropriate the money. We passed the state laws that could be beneficial. And then just in terms of oversight, we have a really important role to play in just It's our job, really, to just make sure that we're staying on top of things that are happening in the executive branch and across state government. Not only just so that we're informed, but if something goes wrong, we're responsible too. Right? And so, I think about two ways in which I thought this could be a good idea. One was just building awareness, building information, building connections, building community. So, we've got people who are formally sitting on the council and to be totally honest, required to be there. Like everybody else, we're overworked and underpaid. And so the thought that any one of us in a really consistent way would show up to just sort of watch the meetings. We all do our best, but it's better to have somebody who's a member and has responsibilities, and they've got a stake in the work. So, it's just that connection building thing, but I also have thought too about the times since I've been in the legislature when Vermont has experienced an emergency. And at that point, the executive branch and the legislative branch have to work together really quickly and really collaboratively. And we sometimes don't have time for our usual leisurely get us up to speed process. Right? Like, we're not always that nimble, honestly, when we're starting from scratch on a topic, especially if it's something more technical or complicated like cybersecurity that you guys have been immersed in. And so, you know, I think about the floods or I think about especially the pandemic where all of a sudden we were in emergency mode and state government had a really important role to play, but we were supposed to be allocating the ARPA money and the CRF money and, you know, it all of a sudden, that deep integration is required. And so I I think about this as an area where there could be an emergency, and you could need us or wish you had us, and and then we're suddenly trying to get up to speed. So that's that's my that's for how I thought it could be useful. And that's so it's a different Yep. It's a different point of view. It's, you know, it's not our when it comes time to allocate really important money, you don't always wanna be reading us in from scratch. So and I know the meetings are open, but, again, it's it's different being a member of a council versus show up if you're interested. You know, it's on YouTube. So those are just my my thoughts.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: I know in the original iteration, there was membership on the proposed bill that included representatives from legislature. I'm not sure how that was taken off, and I'm sure that R. Sibilia can speak to going through that experience. She was one of the biggest advocates and sponsors of that bill that became law that I created. It's important for everything that you just said and why, but also going through this session with all of the things that this committee has to tackle with with utilities and energy and did water as well. There's a lot of interconnectivity there. So it's less of a work around state operations. It's more about understanding the user community that is represented in those critical infrastructure spaces of where your stakeholder interest is as a legislator who is making decisions and representing of those spaces. So if we only have four that are currently active participants of it, that makeup representation is really important too because then, like you had said, the voice is already at the table and you're not playing catch up. There will be

[Rep. Kathleen James (Chair)]: an emergency. Yeah. That's what I'm trying to understand. It's like the intersection between what we do and the intersection before what you do, and would it be important to build some kind of formal bridge there through membership? Yeah.

[Rep. Laura Sibilia (Ranking Member)]: I would just note, act 71 when we passed that bill, that language was brought to us by the agency, and it did include representation from the House and Senate, which passed the House just for information and was taken out in the Senate. But I think it was really helpful that that language was brought to us by the agency in terms of how we should structure this and who should be sitting on the errands. I take seriously the recommendation that we should have representatives from these other critical centers. Yeah. That's important. As well as the legislature and the judiciary added to move.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: Yeah. Perhaps Southworth. Thank you.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Earlier in your testimony, open meeting law, you're covered by that. So I assume, correct me if I'm wrong, you'd probably have executive sessions, which would revolve around sensitive topics. The members of the council, are they vetted? And then if so, how deep are they vetted and in what way? So we have had executive sessions just once. We're the council is working proactively so we're not inviting people ready to share their deepest ductus secrets or anything else. So we're not doing it that way. So the vetting we did not do any kind of a background check. Relied upon those identified in statute to do that as they put forth who's representing it, right. So it was in statute that folks at the Vermont Hospital Association had to name someone to it. The Vermont Business Roundtable had to name someone for essential supply chain. Public service department had to do energy and natural resources had to do water and wastewater. Then Vital came in and advocated for their participation during the during the development. So we're not vetting them anything farther than what the organization that's charged with labeling, but we are also not we're not sharing any technical secrets in this organization. We're working proactively to understand where organizations are at and what they need to do next to get better. This is not a response and recovery organization nor is it a punitive like you got to come in and defend yourself as to why you got hacked type thing. It's purely as I'm looking at that. Whenever I hear the word security, I am very hyper conscious about what it is that we're looking at and how it can affect us. The only time we used executive session was reviewing the survey because there's 16, you know, I give you the statistics for a number of responses, some of those sectors only had one respondent. So unlike, what is it, data suppression, right, is the process of being able to like hide the ability to identify an individual even though they may be like a member of a small group, right? So we went executive session because some savvy people could probably by the answers figure out who in that sector was the respondent. That's the only time, right? And even then that was that would be purely speculative but just to kind of prevent that from happening. As things progress do you see tightening down how you do things and who's on the council? I think, I don't know about tightening down. What I would envision long term is that we may invoke executive session more when we can identify individuals, organizations that would come in and talk about an experience they had in the past tense, right? Once they've kind of like, if Nate Kucher, who's the CISO for the UVM Health, wanted to kind of come in and give us a nitty gritty about how they were exposed, compromised and what had to happen to recover, that would probably be more of an executive session. But we're not there yet. We're still like trying to get people to be like, change the default password on your Wi Fi, please. Thank you.

[Rep. Kathleen James (Chair)]: Rectory. Oh I had a question about the grant program that you mentioned. How has the update been?

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Not good, but that's changing. So we originally, the grant program originally offered three projects, migration of websites and emails from local municipalities that don't use .gov to a .gov because that's kind of like managed and so if a town was using .com or something like that, right, getting away from that. A training program which was fairly technical heavy, CompTIA Security Plus, which there's a lot of employees that just really that would resonate with them. And then the last one was the implementation of multifactor authentication, right? It built as much of a pain as it is. That is like one of your best defenses in today's world is right that challenge in response, whether it's just a simple SMS message, an authenticator app or a physical device, an EBV Keypad. In typical Montpelier fashion, we sent out a bunch of emails and said, Hey, here it is. Sign up. A lot of organizations had either found the wrong inbox or it just wasn't explained well enough to know why it mattered to them. So we've now started to go out and meet with our individual. I've met with Parkland Village and Swanton Village myself, right? Talking them through, doing an assessment, because that's one of the things we have to do for them to qualify for the grant. And now it's a whole different conversation with him. We're And we're gonna start a webinar series. We're hoping to have this first one by the May where we operate to not only municipal leaders, but select board members. So gentleman by the name of Andy Hooper, who is, I think, a select board member in Biddlebury, also is a tech professional, and I met him in other channels, we've met, and there's just like this interest. It doesn't always follow maybe the town clerk or the town manager, maybe it's somebody on the select board that has that kind of like, oh yeah, know there's a risk. So we're gonna start this webinar series where we're gonna be advocating for 12 pillars, right, the basics, And also what projects, I wish we had more time, but I could show you that we've taken these pillars and we've actually mapped them to all the different standards. So National Institute of Standards and then whatever NIST stands for. Okay, standards of testing. Yes, but NIST, Center for Internet Security, SIS, and CISA offers standards in their cross sector performance goals. So we've taken all these pillars and we've mapped it to them. That's one of the things in statute is we were supposed to assess are there gaps in standards which there are not there's there's plenty of standards and stuff it's just a matter of making sure you understand the right ones that are aligned to you and so we've done that kind of stuff and so that's that webinar series right we're hoping to help people understand and also map them to what the grant offerings are. We have at least one project for every one of them. So now we can say, hey, if you don't have multi factor authentication, we've a project, let's get you signed up. Or you may not have policies well let's start with an acceptable use policy. We have vendors that we're using our retainer pool information technology retainer pool in the executive branch to deliver those projects and services.

[Rep. Kathleen James (Chair)]: Great.

[Denise Reilly-Hughes (Secretary, Vermont Agency of Digital Services)]: Yeah. That sounds good.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Is there anything obviously you've thought about this? Is there anything legislatively that you think that we could do to get your membership up to where you want it? And then at the same time, after it's up to there, look at adding from the other two branches like R. Sibilia is one thing. Yeah. I am I was in senate gov ops last Thursday, and currently so. But anyway, we had a good conversation, and I I was advocating that we do a way of the annual report to that because cyber technology, but specifically cybersecurity, changes so fast and is so dynamic. I would much rather have cases like this where we come in and have conversations. So while I have and I if you can get, right, the language updated and we can expand the membership and stuff like that, I think the next important thing is like just having a frequent touchpoint to both share what we're doing, what our eye is on, what we think is coming next, and address your questions and then collectively look at where's the next addition to the council, right? What do we need to go next to make sure we have representation for that audience that real sense. Does that answer your question? It does, thank you. Yeah, this has been very, I appreciate your time. We've obviously run over. I think these more often wouldn't be beneficial because there's a lot we can, that just, you can communicate that just, it's not gonna go anywhere in the report. Yeah. It's just like going.

[Rep. Kathleen James (Chair)]: I think that the, mean, just my immediate response to that, I obviously wasn't in Senate Gov ops, but here in the legislative branch, have sometimes I feel like they just we sometimes have a fundamentally different context for working in where it's really important to build public record and post public testimony and have reports we can look back at because we have high turnover here as well. And so, you know, a committee conversation that this committee conversation will be lost in the mists of time after the November election, but your annual report won't be because it will be posted as part of the public record. So I think a lot about building a public record in terms of written testimony that members of the public and future legislators can always refer back to.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Yeah, we'll make some.

[Rep. Kathleen James (Chair)]: Alright, great. Well, thank you so much for your time. Appreciate you being here.

[Sean Naylor (Special Programs Director, Vermont Agency of Digital Services)]: Thank you. Yes, I hear you. I'm sorry for over my half hour.

[Rep. Kathleen James (Chair)]: No. It was great. Yeah. Thank you very much. Appreciate it. Alright. Yes. We will be back at 09:00 tomorrow, and we can go off live.

[Rep. Bram Kleppner (Member)]: I figured that.