Vermont Agency of Digital Services

The council discussed updates to employee guidelines regarding the use of artificial intelligence. Key topics included the differentiation between public and internal AI systems, security considerations for AI-integrated applications and transcription tools, and modifications to the AI citation matrix to improve readability and user navigation. Additionally, the council addressed concerns regarding the use of AI-generated images in public-facing materials, specifically noting the potential for embedded metadata in prompts, and received information regarding the establishment of a new AI Economic Task Force.

The council discussed updates to employee guidelines regarding the use of generative artificial intelligence, specifically focusing on expanding the scope to include additional AI modalities such as meeting assistants and embedded AI features in third-party applications. Key concerns addressed include data privacy, security, data residency, and the necessity of prohibiting or removing third-party transcription tools during discussions involving sensitive or non-public information. Additionally, the council explored the feasibility of automated policy notifications during video conferences and clarified responsibilities concerning data handling and retention when utilizing AI tools.

The Council discussed legislative updates, including the status of Senate Bill 213 and its implications for water system operators. Sector-specific reports were provided for the energy, healthcare, and water/wastewater sectors. Challenges regarding membership recruitment in certain sectors were highlighted. The Council also considered moving their next meeting to coincide with the state's upcoming digital summit in order to foster greater engagement with stakeholders.

This report details the establishment and initial work of the Cybersecurity Advisory Council, mandated by Act 71, to assess and enhance the cybersecurity posture of critical infrastructure entities in Vermont. It outlines the council's legislative background, membership, and activities through January 25, 2024, including the development of a cybersecurity preparedness survey. The council's planned activities for Fiscal Year 2024 focus on reviewing legislative definitions, administering the survey, compiling results, and developing future plans to safeguard the State's public and private sector against cyberattacks.

The council discussed legislative updates regarding Senate Bill 213, noting a shift toward non-binding guidance for water systems. Membership updates confirmed no changes for the current year. Sector-specific working groups provided updates on energy, healthcare, water/wastewater, and essential supply chain activities. The council reviewed the Cybersecurity Pillars strategic framework, which utilizes a maturity model for municipal cybersecurity. Additionally, the group addressed federal funding status for municipal cybersecurity and examined the economic and operational implications of the Cybersecurity Maturity Model Certification (CMMC) for the state's defense industrial base.