New York City graduates first Cyber Academy class

The inaugural class of New York City’s Cyber Academy graduated Tuesday, with 21 city workers newly minted as liaisons between their agencies and the Office of Technology and Innovation’s Cyber Command.

The academy kicked off last fall as a byproduct of an executive order Mayor Eric Adams signed in February 2022, requiring each city agency to designate a Cyber Command Liaison who would work with Cyber Command — the city’s central information security office — to share intelligence, monitor threats and adopt best practices around cybersecurity.

Previously, under Mayor Bill De Blasio, New York City sponsored a “cyber bootcamp” for local students as part of the Cyber NYC agenda, but this is the first time the city has offered in-house training for its employees.

The 21 graduates in the first class each represented a different city agency, such the New York Public Library, New York City Fire Department and New York City Police Department, among others. Each participant was nominated by their respective agency’s chief information officer or chief information security officer.

Kelly Moan, the citywide CISO and head of Cyber Command, was involved throughout the process of designing the academy. She told StateScoop that the idea behind the program was to help city employees learn how to respond to cyber incidents, investigate attacks and build a community of cybersecurity professionals across city government, which she said contributed to the variety of agencies included in the inaugural class.

“That diversity really speaks to what we were what we were targeting in this first round — let’s bring these different sectors that wouldn’t maybe normally have been brought together within the city agency ecosystem together,” she said in an interview. “And then all of a sudden, we’ve built this, this small subset of community of security professionals that all went through this training and they can lean on one another to continue to grow and learn about what each other’s doing at their home office, which has been like a really delightful thing to see as an output of the training cohort.”

The Cyber Academy’s coursework was provided by Mandiant, Google Cloud’s cybersecurity subsidiary. Moan said the material included a mix of web-based, instructor-led and experiential training that focused on tasks including incident response, network security and threat intelligence.

This first cohort, though, placed an extra emphasis on incident response after tech officials across New York told Cyber Command they needed more training on that front.

“We want to give more city staff the tools to run these incidents and kind of understand how to handle things when an incident or investigation starts, but more broadly, some of the classes included ICS [industrial control systems], fundamentals, cyber threat, intelligence, leadership, right?” she said. “Because it’s not just about the hard skills — the technical skills — right, it’s about also the soft skills, being able to communicate effectively in times of emergency.”

Moan said another benefit to the Cyber Academy program is that it helps address an ongoing challenge in government to find and retain cybersecurity talent.

“I’m really proud of what we’ve built here,” she said. “Because in less than a year, we were able to build, build out an academy, launch it and start getting folks trained, which really was the sense of urgency and kind of pace at which we wanted to operate.”

Future Cyber Academy cohorts are planned for later this spring and fall, bringing in participants from agencies not included in the inaugural class. City officials said they aim to have at least one Cyber Academy graduate at every city agency by the end of 2024.