Executive Summary
In August 2025, the State of Nevada faced a targeted ransomware event that disrupted statewide systems and tested the resilience of digital government. The Governor’s Technology Office (GTO), under the leadership of the State CIO, executed an established incident response plan, escalated immediately to executive leadership, coordinated across more than 60 agencies, engaged trusted forensic, legal, recovery, and law enforcement partners, and prioritized services that Nevadans depend on: payroll, public safety, benefits eligibility, courts, emergency management, transportation, and essential agency operations.
The State made the strategic decision not to pay ransom. Instead, GTO used prepared playbooks, executive prioritization, specialized recovery teams, disciplined communication, and rapid hardening to contain the incident, restore business-critical services within the first week, complete full-service recovery in 28 days, and recover approximately 90% of impacted data. The remaining data was retained under state control and reviewed through a risk-based process.
The project is award-worthy because it shows cybersecurity as a public service discipline, not merely a technical function. Nevada demonstrated that investments in governance, cyber insurance, incident simulations, identity controls, vendor readiness, communications, and staff training can materially reduce harm when an incident occurs. The response protected taxpayer funds, preserved public confidence, and produced a stronger future-state roadmap for SOC maturity, endpoint detection and response, identity protection, training, and continuity of operations.
