Cyber Civil Defense Summit West: Key Learnings from Arizona

On May 28, the UC Berkeley Center for Long-Term Cybersecurity (CLTC) and Arizona Department of Homeland Security (AZDOHS) convened more than 130 participants — including representatives from state, local, and tribal governments, K-12 school districts, nonprofits, and industry — for the Cyber Civil Defense Summit: West, a one-day gathering focused on improving the cybersecurity of local communities through regional coordination.

Held in Scottsdale, Arizona, the one-day Summit was the first of three regional events being held across the country in 2026 (with additional gatherings planned in New Jersey in August and Louisiana in October) to build regional networks of cyber defenders, academics, and policymakers working to protect our most at-risk community infrastructure. Thirteen states and one U.S. territory were represented at the Arizona event, creating a rare opportunity for cybersecurity practitioners and leaders from across the West to share their experiences, build relationships, and coordinate future cross-state collaboration.

The regional Cyber Civil Defense Summits come at an important time, as states are shouldering increasing cybersecurity responsibilities in the face of reduced federal leadership and funding. Throughout the day’s events, attendees spoke candidly about the challenges they face, lessons they have learned, and the practical approaches they are taking to strengthen cyber resilience at the state, local, tribal, and community levels.

During the event, we learned that Western states are wrestling with common challenges:

Key Challenge #1: Western states are navigating the loss of federal cybersecurity support.

The loss of federal support for MS-ISAC — a membership-based organization run by the Center for Internet Security (CIS) that provides cybersecurity resources to U.S. state, local, tribal and territorial (SLTT) government entities — was discussed repeatedly during the event. Previously, MS-ISAC provided no-cost services to over 19,000 government members across nearly every U.S. state. The decline of federal funding has forced CIS to shift to a member-funded model and has required states and localities to cover the costs of participation themselves.

States are responding in different ways. Some have backfilled funding to maintain access for local governments that cannot afford fee-based membership, while others have secured short-term funding with the expectation that they will eventually cover costs themselves or build their own security operations center (SOC) capabilities. Other states have opted to forgo MS-ISAC services altogether due to budget constraints.

Several attendees noted that they are using this moment as an opportunity to lean further into “whole-of-state” cybersecurity — a coordinated, statewide defense model that pools talent, technologies, and capabilities across jurisdictions to protect regional ecosystems, including state agencies, local governments, education organizations, and public utilities — by building state-led programs capable of providing similar services to local governments. Participants also expressed concern that declining state participation in MS-ISAC may affect the quality and value of its threat intelligence and information-sharing offerings over time.

Key Challenge #2: Trust remains one of the biggest hurdles to whole-of-state cybersecurity.

Throughout the Summit, participants emphasized the need for stronger relationships across the community cybersecurity ecosystem.

Attendees described persistent trust gaps between state, local, and tribal governments, school districts, and other community infrastructure partners. Several noted that local organizations can be hesitant to engage with state cybersecurity and IT agencies due to concerns about liability, cyber insurance implications, or fear that state involvement could lead to the state overreaching into their job domains.

When those relationships are weak or nonexistent, communication suffers. Participants described how insufficient trust among SLTT government entities can limit the timely sharing of threat intelligence, indicators of compromise, techniques, tactics, and procedures (TTPs), and mutual aid during incidents. In some cases, it can slow the flow of information enough to allow threats to spread across jurisdictions and sectors before defenders realize they are facing the same adversary.

Attendees noted that building and maintaining trusted relationships is particularly challenging in large, geographically dispersed Western states, many of which have large rural communities. Relationships can be time- and resource-intensive, as they require travel, face-to-face engagement, and sustained effort. Several attendees also pointed out that many relationships are built around specific individuals, making partnerships vulnerable to dissolution when staff turnover occurs.

Participants also emphasized the importance of cultivating trusted relationships with their own governors, legislatures, and other state leaders to secure long-term funding and support for cybersecurity programs.

Key Challenge #3: States are worried about the next generation of cybersecurity leadership.

Cybersecurity workforce challenges surfaced repeatedly throughout the Summit.

Participants noted that it has become increasingly difficult to attract and retain cybersecurity talent in state government. Many described experienced staff being recruited away by private-sector companies offering higher salaries, with their institutional knowledge of legacy systems leaving with them. Others noted a looming wave of retirements among senior cybersecurity staff, with not enough mid-level staff to backfill positions.

At the same time, there are very few entry-level job opportunities available for new hires. State leaders identified the need for innovative strategies to develop the next generation of state cybersecurity leadership, notably by tapping into community talent and creating new workforce development pipelines that offer entry-level opportunities to acquire hands-on experience with tools and products used in security operations.

What solutions are emerging?

In discussions throughout the day, participants in the Summit settled on some constructive next steps to overcome their shared challenges.

State leaders must deepen their investment in local relationships.

One of the clearest messages from the Summit was that state governments need to show up for their local partners. Participants called for state cybersecurity leaders to regularly engage with counties, cities, tribal nations, school districts, and other community infrastructure partners — not just during incidents, but year-round.

In practice, that means visiting communities both virtually and in person, organizing regular convenings, attending local conferences, and creating opportunities for people to meet face-to-face and build trust.

Several participants also emphasized the importance of succession planning to ensure that established communication channels and partnerships survive staff turnover and leadership transitions.

States should continue to support and expand cyber volunteering.

Cyber volunteering programs emerged as one of the most promising models for cybersecurity workforce development and community cyber resilience.

These programs are gaining momentum across the region. States and universities are experimenting with a variety of approaches, including university-based cyber clinics, state cyber corps programs, and regional security operations centers (RSOCs). The Summit included presentations by instructors and students from Arizona’s newly launched RSOC, and representatives from four cybersecurity clinics participated in the event.

Whatever form they take, volunteering programs provide students, early- to mid-career professionals, and career changers with hands-on experience and mentorship. They create opportunities for practitioners to serve their communities while joining a professional network that helps combat isolation and burnout. And they expand access to cybersecurity support for resource-constrained organizations, which ultimately helps protect the wider community.

Looking Ahead

One thing was abundantly clear after the Arizona event: at a time when states are being asked to contribute and lead more than ever on cyber defense, states are more resilient when they work together.

The challenge to protect the infrastructure that underpins our local communities from cyberattacks is uniquely complex and wide-reaching. Strong bonds between states, local governments, tribal nations, nonprofits, schools, industry, and academia will be essential to defending community infrastructure in the years ahead.

A palpable sense of community filled the room, a hopeful harbinger of the transformative work to come. We are hopeful that the conversations begun in Arizona will continue as the Cyber Civil Defense Summit heads to the Eastern and Central regions, bringing together more community cybersecurity champions to brainstorm solutions to strengthen cyber resilience across the country.

View Photo Album

Photos: Grayson Rieth

Upcoming Events

​

Additional Resources