Article
State government IT security audits: Benefits, challenges and considerations of consolidated IT security organizations
Nov. 14, 2025 · Authored by Christopher Kalafatis, Randy Sherrod and Peter Tsengas
In today’s digital landscape, public sector organizations face increasing pressure to secure their information systems, protect sensitive data and ensure continuity of services. As cyber threats grow in complexity and frequency, many states have turned to consolidated information technology (IT) security models to streamline operations and enhance cybersecurity. One such example is the Virginia Information Technologies Agency (VITA), a centralized IT organization that provides infrastructure, cybersecurity, governance and procurement services to Virginia’s executive branch agencies.
Whether your organization works with state-mandated agencies like VITA or is considering implementing an IT security audit framework for the first time, this article explores the benefits and challenges of consolidated IT security organizations, the importance of aligning with recognized frameworks, and key questions and steps agencies should consider when evaluating their cybersecurity strategy.
The case for consolidation: VITA as a model
VITA exemplifies a consolidated IT security organization. It operates as a broker in a multisupplier model, supporting 65 executive branch agencies across Virginia. By centralizing IT infrastructure and cybersecurity services, VITA delivers cost savings, consistent standards and improved service delivery. Its role spans governance, procurement and infrastructure, helping agencies achieve their missions while maintaining robust cybersecurity.
This model offers several advantages:
1. Reduced costs and increased efficiency
Consolidation minimizes redundant hardware, software licenses and support contracts. Agencies benefit from economies of scale and simplified vendor management, reducing administrative overhead and operational costs.
2. Enhanced security and compliance
Centralized organizations like VITA can enforce consistent security protocols, access controls and data protection policies. This uniformity helps agencies meet regulatory requirements and simplifies audits and certifications.
3. Standardized technology
A cohesive technology stack improves system compatibility, simplifies integration and streamlines training. Employees across agencies use standardized applications, reducing confusion and improving productivity.
4. Simplified support and management
A centralized IT service desk provides a single point of contact for issue resolution. This reduces delays and ensures faster, more effective support.
5. Strategic focus
With routine IT tasks handled centrally, individual departments can focus on their core missions. IT resources are freed to pursue strategic initiatives that drive innovation and growth.
Challenges of consolidation
Although there are benefits, consolidation also faces challenges. Agencies must navigate potential drawbacks to ensure successful implementation.
1. Slower decision-making
Centralized approval processes can create bottlenecks. Agencies may experience delays in deploying new technologies or responding to urgent needs.
2. Loss of local context and flexibility
Standardized decisions may not align with the unique needs of specific departments or regions. This can stifle innovation and reduce responsiveness to local priorities.
3. Magnified impact of poor decisions
A flawed decision at the central level can have widespread consequences. In decentralized models, the impact of poor choices is often limited to individual departments.
4. Internal resistance
Employees accustomed to managing their own technology may resist change. Effective communication and change management are essential to maintain morale and productivity.
Aligning with security frameworks: NIST and beyond
Whether centralized or decentralized, alignment with recognized cybersecurity frameworks is critical. Frameworks such as the National Institute of Standards and Technology (NIST) 800-53 and NIST Cybersecurity Framework (CSF) 2.0 provide structured approaches to risk management, compliance and continuous improvement.
Benefits of framework alignment
- Systematic risk reduction: Frameworks help organizations assess and mitigate cybersecurity risks methodically.
- Regulatory compliance: Alignment simplifies audits and ensures adherence to legal and contractual obligations.
- Stakeholder confidence: Demonstrating commitment to cybersecurity builds trust with the public, partners and regulators.
- Improved communication: Frameworks provide a common language for IT and business stakeholders, enhancing collaboration and decision-making.
Agencies should develop and maintain cybersecurity policies and procedures that reflect their chosen framework. These documents should be reviewed annually to ensure alignment with current infrastructure, systems and best practices.
Third-party risk management
In today’s interconnected environment, many public sector agencies rely on third-party vendors and cloud-hosted services. Managing these relationships is essential to maintaining cybersecurity.
Key considerations
- Vendor oversight: Agencies should monitor vendor performance and compliance with cybersecurity standards regularly (daily, weekly, or monthly, depending on data sensitivity).
- Annual assessments: Formal evaluations of third-party compliance with cybersecurity policies, standards and requirements should be conducted at least annually.
- Policy alignment: Vendors must adhere to the agency’s cybersecurity policies and frameworks, ensuring consistent protection across all systems.
Auditing sensitive systems
VITA requires agencies to classify their IT systems based on confidentiality, integrity and availability. Systems deemed high-risk in any of these areas are considered sensitive and must be audited on a three-year cycle.
Audit process
- Agencies submit annual audit plans to VITA, which are tracked in RSA Archer
- Audits may be conducted by internal audit departments or information security teams
- Agencies lacking internal resources can outsource audits to qualified third-party firms
Sensitive systems include both internally managed and third-party/cloud-hosted platforms. This comprehensive approach ensures that all critical systems are regularly evaluated for compliance and security.
Questions agencies should ask
When evaluating their IT security strategy, agencies should consider the following:
- Is our current model centralized or decentralized?
- Do we have consistent cybersecurity policies across departments?
- Are we aligned with a recognized framework like NIST?
- How do we manage third-party vendor risks?
- Are sensitive systems audited regularly?
- Do we have the internal capacity to perform audits, or should we consider outsourcing?
- How do we ensure flexibility while maintaining centralized standards?
Final thoughts
Consolidated IT security organizations offer significant benefits, including cost savings, standardized technology and enhanced cybersecurity. However, they also present challenges that must be carefully managed. By aligning with recognized frameworks, auditing sensitive systems and managing third-party risks, public sector agencies can strengthen their cybersecurity posture and better serve their constituents.
As threats evolve, so must your strategies. Baker Tilly stands ready to support public sector organizations in navigating this complex landscape, ensuring that their IT systems are secure, compliant and aligned with their mission.
How Baker Tilly can help
At Baker Tilly, we understand the unique challenges faced by public sector organizations. Our dedicated public sector practice includes over 350 professionals serving more than 4,000 clients across 48 states. We’ve worked with state entities, municipalities, school districts, Tribal governments, universities and more.
Our services include:
- Cybersecurity audits: Perform IT general controls (ITGC), application audits and sensitive system assessments.
- Framework development: Help agencies select and implement cybersecurity frameworks tailored to their needs.
- Policy and procedure enhancement: Assist in creating or refining documentation to ensure alignment with best practices.
- Third-party risk management: Support agencies in evaluating and monitoring vendor compliance.
- Training and advisory: Provide strategic guidance and training to build internal capacity and resilience.
Whether your agency is centralized like VITA or operates in a decentralized model, Baker Tilly can help you build a secure, compliant and efficient IT environment.
Article
State government internal control frameworks: Lessons from ARMICS
Discover how internal control frameworks like ARMICS boost public sector accountability, reduce fraud and drive strategic performance.
