Arkansas makes longtime interim CISO permanent

Arkansas officials on Thursday announced that Nolan Leatherwood, who’s served as the state’s chief information security officer on an interim basis since 2018, will take the role on permanently.

Leatherwood joined the Arkansas Division of Information Services as an intern in 2001 and has spent his entire career with the agency, officials said. Over the years, his portfolio has included serving as a subject matter expert on cybersecurity legislation and developing the state’ information-security strategic plan. He became interim CISO in 2018, following the retirement of Frank Andrews.

In a telephone interview, Leatherwood said he’s excited to drop the “interim” from his title and get to work.

“Knowing I’m going to be doing this for years to come is going to allow me to pursue everything,” he said.

Leatherwood said he plans to focus in particular on building out the state government’s incident-response capabilities and continuing to develop a multi-agency “strike team” that helps government entities — such as school districts — recover from cyberattacks. He also wants to work on continuing education to fill in skills gaps throughout government.

“Nolan’s background and experience at DIS will provide leadership to this critical state leadership position, as his team continues to protect and secure the state’s IT infrastructure,” Amy Fecher, secretary of the Arkansas Department of Transformation, DIS’s parent agency, said in a press release.

Most recently, Leatherwood was responsible for maintaining the state government’s network security as tens of thousands of state employees were sent home during the COVID-19 pandemic. He said there were “a lot of efforts” to expand virtual private network capacity and remote-desktop capabilities for several months.

Arkansas, which never implemented a statewide stay-at-home order, experienced a resurgence of coronavirus infections last month, though on Wednesday Gov. Asa Hutchinson said the state had its lowest number of new cases in a week, while neighboring Texas and Oklahoma continue to smash through record infection rates.

While Leatherwood and his colleagues are back in their office, he said the recent stretch of mass telework was informative.

“If there’s another event like this where we are forced to go remote, there’s a lot of lessons learned,” he said.

Leatherwood has also been advising state leaders on the development of a contact tracing platform, as part of a COVID-19 Technical Advisory Board that Hutchinson created in late May. He told StateScoop the board has reviewed several digital apps and platforms, including the Exposure Notifications API developed jointly by Apple and Google, and recently submitted a draft report.

“We laid out a few options,” Leatherwood said.