Arkansas Centralized Agency Cybersecurity Following 2025 Act
The state consolidated security policies across 15 agencies to mitigate systemic risks after a 2022 vendor breach.
Updated on Oct. 9, 2026 in Cybersecurity
Live Poll
Should states mandate minimum cybersecurity standards for local government networks in your area?
The Arkansas Cybersecurity Act of 2025, which became law on April 8, 2025, established a unified State Cybersecurity Office. This initiative centralized security oversight for 15 state agencies under a single policy framework.
Why it matters
The consolidation aims to address rising threats like ransomware and identity theft that previously exposed vulnerabilities across disparate public-sector entities. It establishes a cohesive risk management architecture intended to replace fragmented defenses.
The state now manages security for 15 agencies through a unified policy, moving away from decentralized oversight. This shift follows a 2022 incident where a third-party vendor attack took 55 of Arkansas's 75 counties offline for three months.
The players
Gary Vance
The Arkansas Chief Information Security Officer who leads the state's centralized cybersecurity strategy.
Office of State Technology
The Arkansas governing body that now hosts the unified State Cybersecurity Office.
The details
The State Cybersecurity Office operates within the Office of State Technology to streamline digital defenses and incident response. By rolling agencies under one primary cybersecurity policy, the state can enforce consistent technical standards and threat monitoring. Officials noted that 10 to 12 ransomware events occurred across the state last year, reinforcing the necessity for this centralized authority.
Timeline
November 2022: A third-party vendor cyberattack downed 55 Arkansas counties.
April 8, 2025: The Arkansas Cybersecurity Act of 2025 became law.
October 2026: Arkansas CISO Gary Vance discussed the state's security trajectory at the Cyber Civil Defense Summit.
The Tech Race
The Arkansas Cybersecurity Act of 2025 represents a state-level pivot toward centralized risk management, marking a departure from the previously fragmented security protocols used by individual agencies. This effort follows a national trend toward whole-of-state security architectures designed to replace disconnected local defenses.
The state plans to extend minimum cybersecurity standards to local government entities through future legislation currently in development. Implementation of this whole-of-state strategy for local jurisdictions is expected to require one year of work.
The takeaway
Arkansas is transitioning from decentralized agency security to a unified statewide model to reduce the impact of third-party vendor risks. Stakeholders should monitor the upcoming legislative sessions for the release of specific mandatory standards for the state's 75 counties.
Further reading
For broader context on how states are modernizing their digital defenses, visit the Cybersecurity section.
Source note: This article includes information reported by Government Technology.
Live Poll
Should states mandate minimum cybersecurity standards for local government networks in your area?
