Compliance October 8, 2024

Public Sector Increasingly Relies on CISOs Amid Continued Digital Threats

According to a Deloitte-NASCIO survey, these executives are leading state and local governments’ responses to the constant threat of cyberattack.

Reported by
Art by James Yang
Public Sector Increasingly Relies on CISOs Amid Continued Digital Threats

As state and local governments increasingly maintain digital records instead of physical ones, and more servers than ever hold citizens’ health, financial and personal data, the public sector has become an attractive target for cyberattacks.

The digital threats confronting state and local governments are wide and varied, and the emergence of artificial intelligence has introduced more sophisticated mechanisms for exploiting vulnerabilities. As a result, according to the 2024 Deloitte-NASCIO Cybersecurity Study, nearly every state now employs a chief information security officer to execute a range of key services.

Get more!  Sign up for PLANSPONSOR newsletters.

A CISO is a senior executive who manages an organization’s information and technology security. Some of the services for which they are responsible include security management and operations; strategy, governance and risk management; and incident response.

With governments looking to CISOs to lead the effort to protect citizens and systems, the role is rising in prominence, and survey results show the CISO is now firmly established as a central part of most states’ information technology organizations.

The role of the CISO has also become more important in light of recent digital attacks on state governments. For example, in February 2023, the city of Oakland, California, faced a serious ransomware attack that impacted many of its IT systems.

According to Deloitte’s report, 98% of state agencies now depend on a CISO for security management and operations, as well as strategy, governance and risk management. State CISOs also reported a jump in how many are responsible for maintaining data privacy, up to 86% of CISOs offering this service to state agencies in 2024 from 60% in 2022.

As of 2024, 20 states have comprehensive data privacy laws in effect, and survey results revealed that more CISOs are taking on responsibility for privacy than did so in 2022. In some instances, CISOs serve dual roles as both CISO and chief privacy officer, while in other cases, the chief privacy officer reports to the CISO. However, Deloitte found that only 21 states have chief privacy officers.

In addition, CISOs are becoming more involved with generative AI-related developments in many states, as 88% of CISOs reported being involved in generative AI strategy development in 2024 and 96% reported involvement with generative AI security policy development. Despite all of the effort, only 10% of state CISOs said they are very confident their state’s information assets are protected from AI-enabled attacks.

State cybersecurity budgets also pose a challenge, as most cover security management and operations, as well as strategy, compliance and privacy. Fewer cover generative AI governance and security controls. According to the survey, nearly 40% of state CISOs find themselves short of funds to comply with regulatory or legal requirements.

Because demand for cybersecurity experts continues to rise, understaffing and difficulty recruiting and retaining skilled workers continues to be an issue. Nearly half of state CISOs in the survey cited a lack of cybersecurity staffing as a top-five challenge, with another 31% citing inadequate availability of digital professionals.

According to the survey summary, state CISOs have an opportunity to educate employers on the latest technologies and potential threats, especially as new threats are constantly emerging. It is also important that CISOs confirm that there is adequate training and oversight of contractors who are allowed access to the state network, attempting to ensure that the digital practices of any contractors are robust.

Deloitte and NASCIO surveyed enterprise-level CISOs from 50 states and the District of Columbia in spring 2024.

Investing October 8, 2024

Participants Show Interest in Alternative Investments, but Knowledge Gaps Remain

In a new Schroders survey, workers expressed interest in private market investments, but many do not understand the benefits of these assets and consider them ‘risky.’

Reported by

More than one-third of investors participating in 401(k), 403(b) and 457 workplace retirement plans expressed interest in investing in private market assets, according to the Schroders 2024 U.S. Retirement Survey.

However, half of the plan participants surveyed did not understand the benefits of adding alternatives to their retirement portfolio, which could limit adoption in defined contribution plans.

Never miss a story — sign up for PLANSPONSOR newsletters to keep up on the latest retirement plan benefits news.

Schroders, via research consultancy 8 Acre Perspective, surveyed 2,000 U.S. investors ages 28 through 79, including 780 Americans who currently participate in a workplace plan. The survey was conducted from March 15 through April 5.

Prior research conducted by Georgetown University’s Center for Retirement Initiatives found that a lack of diversification in DC plans has been a significant missed opportunity for plan participants. Incorporating illiquid assets, such as private equity, real estate and infrastructure, in target-date funds, for example, could result in a 0.15% increase in return per year over a decade, the research found.

Schroders found that 80% of participants said access to private investments would lead them to increase the amount they are contributing to the plan.

Among those who expressed interest in private market investments, 52% said they would allocate less than 10% of workplace retirement assets to private assets, and 34% would allocate between 10% and 15% of retirement assets to private assets. Only 6% said they were unsure how much they would allocate to private assets.

Meanwhile, many participants do not understand the benefits of alternative assets, and 64% of those surveyed said the investments sound risky.

“This highlights the need for enhanced education and communication on the benefits these products offer and the role they play in diversified portfolios,” says Deb Boyden, head of U.S. defined contribution at Schroders, via email. “For certain asset classes like private equity and private debt, liquidity is also a challenge. However, strides are being made by the industry to overcome these challenges.”

Because alternatives such as private equity and private debt are illiquid assets, it is difficult for investors in alternative assets to get daily pricing and regularly check their balances. The assets also tend to be harder to sell quickly because there is low trading activity or interest in the securities or because the secondary markets for private asset classes are less developed than they are for public market assets. Illiquid assets also tend to have greater price volatility.

The knowledge gap among participants also is not limited to alternatives, as 52% of participants reported not knowing how to manage risk in their retirement portfolio, and 59% said they wish they received more guidance from their employer on how to invest their workplace retirement plan assets.

Boyden added that employers have an opportunity to provide clearer guidance and tools that explain how alternative investments can serve as portfolio diversifiers and enhance potential long-term returns. She said offering workshops, interactive tools and personalized financial advice can empower participants to feel more confident in navigating alternative investment choices.

“Collaboration with plan providers to create targeted, easy-to-understand content around alternatives is crucial,” Boyden says. “In addition, product development can make it easier for plan participants to access alternatives through multi-asset solutions that include private assets. These solutions are professionally managed to provide diversification and could add the benefits of private assets while easing adoption.”

Boyden finds growing interest from plan sponsors in adding alternatives as an investment option in DC plans, particularly as they look for ways to provide participants with greater diversification options. While public equities have been driving returns in recent years, Boyden said plan sponsors with a long-term view are recognizing that private market assets will provide diversification in the long run.

“Many sponsors are familiar with the success of alternatives in defined benefit plans and are considering how to bring similar strategies into the defined contribution space,” Boyden says. “While adoption has been gradual due to the perceived complexities and education barriers, we believe the tide is turning. As the regulatory environment evolves and the benefits of these investments become clearer, more sponsors are exploring how they can responsibly include alternatives in their plan menus.”

«