Public-sector CISOs before legislators and auditors: what two oversight records show

Two records, two kinds of oversight

This explainer draws on two primary documents. The first is the minutes of a North Dakota legislative committee meeting held in Bismarck on July 8, 2026. The second is an independent evaluation of the U.S. General Services Administration's (GSA) information security program for fiscal year 2020, released by GSA's inspector general.

The two records show two different ways a public-sector security program is held to account. In the first, a security leader answers questions from elected members in a public meeting. In the second, an outside evaluator samples and scores the agency's controls and publishes findings with management's reply attached.

The question also asks about public universities. The only university official named in these records is the North Dakota University System's chief information officer, and the minutes record him speaking about the enterprise resource planning system, not about security. Neither document records a university CISO reporting to a committee or an auditor.

A state CISO at the committee table

The North Dakota minutes list the state Information Technology Committee's members by name. They include representatives, senators and two citizen members. Cybersecurity was one item on an agenda that also covered major projects, the department's annual report, mainframe retirement and broadband.

The minutes say the state's chief information security officer, Chris Gergen, briefed the committee on cybersecurity services provided to state agencies and political subdivisions. According to the minutes, the department can sign agreements with other governments to provide consulting, strategy, prevention and response services.

The minutes also describe a financial incentive tied to those services. An entity qualifies for the discount if it uses the department's endpoint protection and vulnerability scanning and completes the maturity assessment every year.

In this setting the CISO reports in person to a body that can question him on the record. The minutes are the lasting record of what was said.

What the committee heard about measurement

The most pointed part of the cybersecurity item, as the minutes summarize it, was about how much of the state the department can actually see. The minutes report a steep drop in how many entities take part in the assessment.

The presentation kept scores and coverage apart. Reported scores went up, but fewer participants means a weaker statewide picture.

A committee member then asked a question. In reply, the department's chief information officer, Corey Mock, described a further limit on the data.

Taken together, the committee heard three things on the record:

• The share of entities measured has fallen.
• The scores that are reported have risen.
• Nobody is checking whether the self-reported scores are accurate.

This kind of accountability depends on disclosure. The security leader puts the indicator and its weaknesses before legislators, and the minutes preserve the exchange.

The federal model: an annual independent evaluation

The GSA document describes a different setup, created by the Federal Information Security Modernization Act of 2014 (FISMA). The report explains who carries out the required annual evaluation. For fiscal 2020, the report says the work went to an accounting firm.

The inspector general's cover memo, dated December 4, 2020, says the inspector general's office monitored the work but did not give its own opinion on GSA's controls. The memo places responsibility for the findings with the firm.

The report also links this process to the legislature. Under FISMA, agencies must report each year on the adequacy and effectiveness of their security policies and procedures.

The evaluation uses a maturity scale. Under the Department of Homeland Security method the report describes, a program needs Level 4, "Managed and Measurable," to count as effective. KPMG found GSA's overall program effective. It scored each function separately:

Function	Rating
Detect	Level 5 (Optimized)
Identify, Protect, Respond	Level 4 (Managed and Measurable)
Recover	Level 3 (Consistently Implemented)

What the evaluators found and how follow-up works

An overall "effective" rating did not mean a clean result. The report sets out a specific count of problems. All seven deficiencies fall under the Protect function, in configuration management and in identity and access management.

The findings are concrete and based on samples. On one system, every change the evaluators sampled went into production without prior approval. Another finding traces a missing record of a scan review to staff turnover.

Management's reply is part of the public record. According to the report, the reply came from the agency's chief information officer.

The process also reaches back to earlier years. Looking at findings from the fiscal 2016 through 2019 evaluations, KPMG reported partial closure. The inspector general's memo commits the next year's evaluators to check progress.

What the two records show about accountability

The two records differ in who does the checking.

In North Dakota:

• The CISO's own department reports on the state of security, and legislators question it in public.
• The evidence behind the reported maturity picture is self-reported by participating entities.
• The department's chief information officer told the committee the department lacks the resources to verify it.
• Accountability here means making those limits known, and the minutes record that this happened.

In the GSA case:

• An outside firm does the checking under an inspector general's supervision.
• The firm tests samples of controls and assigns ratings on a set scale.
• It lists numbered deficiencies and recommendations, and management must answer in writing.
• Accountability here means evidence a third party can test, an answer on file and a scheduled check on corrective actions.

Who answers for the program. In North Dakota, the CISO presented and the CIO answered the question about audit capacity. At GSA, the formal management response came from the CIO. In both records, the security function is reviewed within the wider IT organization, and the CIO is the official who answers on the record about limits or findings.

Continuity. Both records track change over time. North Dakota's committee saw participation measured from 2020 to the 2025-26 interim. GSA's evaluators reported on earlier findings and handed open items to the next year's team.

What the role answers for. Neither record measures the CISO by whether an incident happened. Both measure the program by what can be shown: how much of the environment was assessed, whether controls were followed in tested samples, whether evidence was kept, and whether past findings were closed. The findings tied to staff turnover and unapproved changes show the level of detail at which a public-sector security program can be examined once an outside party is checking.