Building Lasting Cybersecurity Resilience Across Florida

Cybersecurity risk assessments are most valuable when they do more than identify gaps. They should give organizations a clearer understanding of their risk, establish practical priorities, and create a foundation for continued security improvement.

For KITC, that approach has shaped our work with Florida state agencies for several years.

In 2023, KITC supported the Florida Digital Service (FL[DS]) in conducting triennial cybersecurity risk assessments across approximately 30 Florida state agencies. Since that statewide engagement, our work in Florida has continued to grow. More than 12 agencies that participated in the 2023 initiative have since returned to work with KITC again, reflecting relationships built through successful delivery and a shared commitment to strengthening cybersecurity across Florida.

A Statewide View of Cybersecurity Risk

The 2023 engagement gave KITC the opportunity to assess cybersecurity risk across a diverse range of Florida government environments.

As the prime contractor, KITC conducted NIST-aligned assessments, supported by subcontractor RSM US LLP (RSM), that evaluated 108 NIST Cybersecurity Framework controls through stakeholder interviews, documentation and evidence reviews, and sample-based control validation.

Each agency received an independent view of its cybersecurity posture, including identified risks, maturity observations, prioritized findings, and recommendations for remediation. KITC also provided agency-level closeout presentations to help stakeholders understand where gaps existed and where attention and resources could have the greatest impact.

At the statewide level, KITC consolidated findings to help FL[DS] identify broader cybersecurity trends, common risks, and areas of priority across Florida’s enterprise agencies.

Together, these efforts gave individual agencies actionable insight into their own environments while providing state leadership with a broader view of cybersecurity risk across the enterprise.

Turning Assessment Findings Into Action

Identifying a cybersecurity gap is only the beginning. Agencies must determine which risks require immediate attention, which improvements belong in longer-term plans, and how security priorities align with operational realities and available resources.

Effective cybersecurity assessments should provide a practical path forward. That means translating technical and compliance findings into clear priorities, developing realistic remediation recommendations, and communicating risk in a way that both technical teams and organizational leadership can act upon.

That approach continues to guide KITC’s cybersecurity work across Florida today.

Building Relationships Beyond a Single Engagement

KITC’s work with Florida agencies has continued well beyond the original statewide initiative.

Since 2023, more than 12 agencies involved in the original engagement have returned to KITC for subsequent cybersecurity support, with RSM continuing to support KITC on these engagements. These continued relationships have allowed our team to build on its knowledge of Florida’s cybersecurity landscape while helping agencies navigate evolving risks, requirements, and priorities.

Our work in Florida spans cybersecurity risk assessments and broader initiatives supporting areas such as system risk categorization, security policies and procedures, identity and access management, vulnerability and change management, enterprise risk management, and security planning.

This experience reinforces something we see repeatedly in cybersecurity: meaningful improvement happens over time. Technology changes, threats evolve, organizations modernize their environments, and previously identified risks must be revisited. Long-term resilience requires organizations to continually assess where they stand and determine what needs attention next.

For KITC, the opportunity to continue supporting organizations we’ve worked with before is especially meaningful. Trust is earned through delivery, and sustained relationships are one of the strongest measures of that trust.

Continuing to Strengthen Florida’s Cybersecurity Posture

Today, KITC continues to expand its support of Florida’s public-sector cybersecurity community through direct agency engagements and statewide contract vehicles.

Our experience across Florida has reinforced a simple principle: cybersecurity assessments should not be treated as compliance exercises that end when a report is delivered.

Done well, an assessment becomes a roadmap. It helps organizations understand where they are, determine where they need to go, and prioritize the actions that can meaningfully reduce risk.

From supporting approximately 30 agencies through a statewide initiative to continuing relationships with agencies years later, KITC is proud to remain part of Florida’s ongoing effort to strengthen cybersecurity resilience across state government.

Looking to strengthen your organization’s cybersecurity posture? Connect with KITC to discuss your cybersecurity, risk, and compliance priorities. Tell us what you’re working on, and our team will be in touch.