State government CISOs: how North Dakota and Oklahoma frame the statewide security role

Two states, two kinds of source

The documents describe the state CISO role in two ways. North Dakota's account comes from an appointment announcement dated July 8, 2025, and an undated leadership page from North Dakota Information Technology (NDIT). Oklahoma's account comes from an Office of Management and Enterprise Services (OMES) release dated October 1, 2026, and an event release dated February 24, 2026.

The North Dakota material is mostly about one person and how he reached the seat. The Oklahoma material is mostly about the organization the CISO leads and the partnerships around it. Read together, they cover what a state CISO is responsible for, how one state appointed its CISO, and how the role extends past a single agency.

What the North Dakota CISO is responsible for

NDIT's leadership page gives the most direct description of the job. It says the CISO runs the state's security program, defends enterprise systems against threats from inside and outside, and advises on cyber matters.

The appointment announcement presents the role as leading strategy for the agency. It says Gergen would continue to direct NDIT's cybersecurity strategy with what it calls a people-centered focus.

The CISO sits within a wider executive team. The leadership page lists the CISO alongside a Chief Information Officer, a Deputy CIO and Chief Financial Officer, a Chief of Staff, a Chief Technology Officer, a Chief Business Applications Officer and a Chief Data Officer. It describes the CIO, Corey Mock, as having come to the executive branch after years as a state legislator.

How North Dakota filled the seat

The July 8, 2025, announcement names Chris Gergen as the state CISO.

Gergen was an internal candidate. The announcement says that before the appointment he held leadership roles in NDIT's cybersecurity division, including Interim CISO, and that in those roles he led efforts to strengthen the state's security posture.

The two NDIT documents describe his path at the agency in slightly different terms. The announcement gives his starting title in 2019 as Cyber Analysis and Response Lead. The leadership page gives a 2019 start as a Senior Security Analyst, after earlier state service at the Bank of North Dakota.

Both documents point to his work building the state's Cyber Operations Center and to a director-level step before the top job. The leadership page puts that promotion in 2022.

His background is not purely technical. Both documents say he holds a bachelor's degree in accountancy with a minor in information systems from the University of North Dakota. The leadership page adds a professional accounting credential and security certifications. The announcement puts his overall experience at close to twenty years across security, risk and IT.

The state CIO announced the appointment and described it as a promotion from within. The release also ties the choice to a stated policy of growing leaders internally.

How Oklahoma describes its state CISO and Cyber Command

In Oklahoma, the OMES release names Daniel Langley as State Chief Information Security Officer and says he leads the state's central security team.

The release describes that team as the state's central cybersecurity function. It says the team watches for, identifies and responds to threats around the clock.

Its stated mandate covers users and their devices as well as networks, data and applications. The release places Cyber Command inside the OMES structure and says the OMES Information Services division supports it.

The release also describes how incidents reach the team. State employees report through the OMES service desk, and the release sends non-state employees to the FBI's Internet Crime Complaint Center and the Federal Trade Commission.

Langley's quoted message in the release focuses on preparation and everyday habits. The State CIO, Dan Cronin, is quoted in the same release. That places the CISO and CIO side by side in the state's public messaging, as in North Dakota.

The Oklahoma documents do not describe how Langley was appointed or what career path led him to the role.

Engagement beyond the state agency

The Oklahoma material shows three channels through which a state CISO's work reaches beyond state agencies.

The first is an information-sharing body. The OMES release describes the Oklahoma Information Sharing and Analysis Center (OK-ISAC) as a forum that connects the state with public- and private-sector partners. It gives the center's origin as a multiagency effort. It also lists the services the center provides to its members.

The second is public awareness work. The release says the governor, working with OMES, declared an awareness month for October 2026, aligned with the federal CISA theme "Securing the Next 250". Businesses, agencies and other organizations can pledge to follow good security habits and be listed publicly.

The third is peer exchange across states and levels of government. The February 24, 2026, release lists Langley among the scheduled speakers at the Billington State and Local CyberSecurity Summit, along with CISOs and other officials from states including Kansas, New Jersey, Minnesota, Maryland and Virginia. It describes the event as drawing officials from several levels of government. The organizer's president gives the reasoning for that kind of gathering in the release.

Comparing the two accounts

On duties, the two states use similar language. North Dakota describes a statewide program protecting enterprise systems and advising on cyber issues. Oklahoma describes a central command protecting state users, devices, networks, data and applications. In both states, the CISO appears alongside the State CIO in official communications.

On appointment, only North Dakota's documents give detail. They describe an internal promotion from an interim role, after earlier work as an analyst and a director-level operations post.

On outside engagement, Oklahoma's documents give the detail. They describe an information-sharing center with public- and private-sector members, a governor-backed awareness month, and a national summit where state CISOs speak alongside federal officials.