State IT departments need to shift their cybersecurity approach toward monitoring and response, over prevention, and develop plans that align with NIST's Cybersecurity Framework, security experts warned.