The SOC is turning into a “centralized hub for instant notification and the associated coordination,” state Chief Information Security Officer John Godfrey told the Legislative Division of Post Audit, in testimony last week during its July meeting. The division is the Kansas Legislature’s nonpartisan audit unit, per its website, and aims to provide accurate, unbiased information to policymakers.
The CISO credited fiscal year 2025 appropriations with giving the center the ability to operate 24/7.
“We design, implement and manage technical cybersecurity tools,” Godfrey said. “We monitor those tools looking for alerts and anomalies, and then as we detect those alerts and anomalies, we investigate and respond. … We act as first responders.”
“To give you some sense of the logging and monitoring perspective,” he said, “we collect and monitor … somewhere between 8 and 14 billion — with a ‘B’ — logs a month.”
Kansas has had centralized cybersecurity on its agenda for years, and the SOC is an example of this. According to the 2024 Deloitte-National Association of State Chief Information Officers Cybersecurity Study, only 14 states listed “monitoring/security operations center” as a CISO priority. The study didn’t specify which states had one in place. California, for comparison, has had a 24/7 SOC since 2017. Many states rely on regional or hybrid models.
The Kansas SOC is part of the broader Cybersecurity Operations team at the Kansas Information Security Office (KISO), which reports to the Office of Information Technology Services. KISO’s fiscal year 2026 budget is about $11.4 million and is derived mostly from collected fees. KISO also provides enterprise and technical cybersecurity services, assisting agencies with policy, risk, compliance, recovery and incident response.
Godfrey outlined KISO’s broader role during his remarks, citing its programming, services and training efforts. The service model, he said, changed in 2024, allowing the office to provide cybersecurity tools to agencies at no cost, plus real-time security scanning, and protection for about 20,000 endpoints.
