Alabama's state CISO beyond state IT: water utility cyber training and the office's statewide role

The question and the sources

A state CISO's title points to the state's own networks. This question asks about work that reaches past them: briefing lawmakers and preparing local bodies such as water utilities for a cyber incident.

This guide draws on two Alabama documents. One is a news post from the State of Alabama Office of Information Technology (OIT). The other is a press release from Central Alabama Water, a regional water utility. Together they describe one part of that outside work in some detail. They do not cover the other part at all.

The sections below cover four things in turn:

• who holds the job
• what his office is responsible for
• what happened at a two-day water utility exercise
• how the state CISO and his partners described the purpose of that work

A final section addresses legislative committees.

Who holds the job in Alabama

In a news post dated November 4, 2024, OIT named Chad Smith as Alabama's new State Chief Information Security Officer.

The announcement says Smith came to the role from outside government and had worked across a range of sectors before joining OIT.

The post also says Smith holds many certifications covering three areas: cybersecurity, data networking and international privacy.

On the scope of the role, the announcement says Smith will lead a team working on information security and on governance, risk and compliance.

That description frames the job in terms of the state's own security program. It does not mention utilities, counties, local governments or the legislature. A reader looking at the 2024 announcement alone would see a CISO focused inward on state systems and state governance.

What the state office is responsible for

A fuller account of OIT's remit appears in the "About" section of the 2026 water utility release. That section describes OIT as the body that sets statewide IT policy and direction and delivers technology services to state agencies.

The same section describes a security role that reaches beyond agencies. It says the office strengthens cybersecurity through governance, risk management, incident response and work with outside partners in both the public and private sectors.

The phrase about collaboration with public- and private-sector partners is the formal basis, in these documents, for a state security office to work with local entities. The water utility exercise is one example of that collaboration.

The water utility exercise, September 29, 2026

Central Alabama Water's release is dated Tuesday, September 29, 2026. It says that day opened a two-day training event in Birmingham for leaders from across the state.

The release names four partners in the event:

• the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University
• the Alabama Rural Water Association
• the State of Alabama Office of Information Technology
• Central Alabama Water

The rural water association's director thanked the other three partners by name in his quoted statement.

According to the release, more than 100 people from over 40 utilities in 26 counties would attend across the two days.

The release says attendees worked through real-world scenarios. They included water and wastewater staff, technology leaders and cybersecurity specialists.

The release sets out three subject areas for the exercise: resilience, incident response and recovery planning. It also notes the event was held ahead of Cybersecurity Awareness Month in October.

Central Alabama Water's chief technology officer, Cameron Holly, said the utility agreed to take part as soon as the idea came up early in 2026 and offered to host.

The release does not describe Smith's personal role in planning or running the sessions. It does, however, list his office as a partner and include a statement from him.

What the state CISO said the work is for

Smith's quoted statement links the event to attacks on water systems in other states that summer. He said those attacks showed that cyber threats can disrupt essential services.

He described readiness at water utilities and other critical infrastructure as necessary to keep public services running.

He also explained why the exercise format matters. He said such events bring partners together before a crisis to build working relationships, plans and resilience.

In Smith's own account, then, the outside work is relationship-building done ahead of an incident. The goal is that local operators and state defenders already know one another when an attack comes. Smith does not describe it as technical support delivered during an incident.

How the partners describe the need

The other quoted partners explain why a state security office would be in the room with local operators.

Rob White, executive director of the Alabama Rural Water Association, said most small and rural systems have no IT staff to support the people running them.

White said the training puts his members in direct contact with the people who defend the state's networks.

Nick Sellers of the McCrary Institute said attackers work in coordinated campaigns while defenders tend to act alone.

Sellers said the goal is for participants to know, if an incident occurs, whom to call, what to do and how to respond.

Holly said his team already monitors threats and works with partners at the state and federal levels.

Taken together, these statements describe the same gap from different angles:

• The utility association describes small systems with no in-house security help.
• The university institute describes defenders working alone against coordinated attackers.
• The host utility describes coordination it already does with government partners.

The state CISO's office appears in these documents as one of the parties that connects these groups.

Legislative committees: what these documents do not cover

The question also asks about briefing legislative committees. Neither document addresses that. The 2024 OIT announcement describes Smith's background and his team's focus. The 2026 release describes a training event and the partners behind it. Neither mentions a committee, a hearing, testimony, a bill or any report to lawmakers. Neither describes Smith or any other OIT official appearing before the Alabama Legislature.

On this part of the question, these two sources show only the following:

• the remit OIT claims for itself
• the outreach to local water systems it took part in during September 2026

Any account of how Alabama's state CISO works with the legislature would need other primary documents, such as committee records or OIT reports, before it could be written from sources.