Arkansas Unified Cybersecurity Office Under New Act
The Arkansas Cybersecurity Act of 2025 created a central office to protect state agencies and public infrastructure.
Updated on Oct. 9, 2026 in Cybersecurity
Live Poll
Should states mandate minimum cybersecurity standards for local government networks in your area?
Signed into law on April 8, 2025, the Arkansas Cybersecurity Act of 2025 established a State Cybersecurity Office to centralize oversight for state agencies. The move follows significant security challenges across the state's public infrastructure.
Why it matters
The legislation aims to improve risk management and response capabilities against threats like ransomware and identity theft. By mandating unified standards, the state hopes to prevent long-term outages of critical government services.
The State Cybersecurity Office centralized security for 15 agencies under one primary policy. The initiative addresses recent trends, including 10 to 12 ransomware events reported across Arkansas last year.
The players
Gary Vance
He serves as the Arkansas Chief Information Security Officer and leads state efforts in cybersecurity.
Office of State Technology
This department houses the newly formed State Cybersecurity Office within the Arkansas state government.
The details
The State Cybersecurity Office, which sits within the Office of State Technology, streamlines oversight through a unified policy. This effort aims to prevent a repeat of the November 2022 incident where a third-party vendor attack left 55 counties offline for three months.
Timeline
November 2022: A vendor cyberattack downed 55 Arkansas counties for three months.
April 8, 2025: The Arkansas Cybersecurity Act of 2025 became law.
October 2026: Chief Information Security Officer Gary Vance spoke at the Cyber Civil Defense Summit.
The Tech Race
The Arkansas Cybersecurity Act of 2025 mirrors a broader national trend of states moving away from fragmented agency security toward centralized, whole-of-state defense frameworks. This move positions Arkansas to better compete with sophisticated cyber adversaries by standardizing defenses across disparate public entities.
Residents should experience fewer service outages as the state streamlines security protocols for government agencies. These changes are designed to protect public-sector data from identity theft and business email compromise, potentially leading to more reliable access to county services.
The takeaway
Centralizing security oversight provides a necessary buffer against the increasing frequency of cyberattacks targeting local government data. Implementing these standards is a critical step for modernizing state infrastructure and maintaining public trust.
What happens next
The state is currently preparing future legislation to mandate minimum cybersecurity standards for local government entities, a process expected to require one year of work.
Further reading
For more on state-level digital protection efforts, visit the Cybersecurity section.
Source note: This article includes information reported by Government Technology.
Live Poll
Should states mandate minimum cybersecurity standards for local government networks in your area?
