The Enterprise Security and Risk Management Office provides cyber resources and services to state agencies and local and tribal government entities in North Carolina. SecureNC is a cybersecurity initiative led by the State Chief Information Security Office to help NC government entities (agencies and local governments) strengthen their security posture to protect NC systems and data. The program provides tools, resources, and expert guidance to improve visibility, control, and resilience across your environment.
Our customers
We serve as a centralized cybersecurity authority for the state safeguarding its digital infrastructure, ensuring the continuity of essential services and the protection of state data.
- State Agencies: ESRMO provides cybersecurity leadership, incident response, vulnerability management, and compliance oversight for state agencies (i.e., DHHS, DEQ, DES, DNCR, DOI, DPI, DPS, DWS, etc.)
- Local Governments and Municipalities: ESRMO extends services to local government entities (i.e., counties, cities, commissions, etc.).
Educational Institutions: ESRMO assists in assessments and technical evaluations for projects supporting North Carolina Independent Colleges and Universities (NCICU). - Third-Party Vendors: ESRMO conducts security reviews and works with vendors ensuring compliance with state cybersecurity standards.
- Internal Customers: ESRMO provides cybersecurity governance, consultation and guidance to DIT.
See below for a list of resources currently available.
County & City Governments
- External Vulnerability Scans
- Converged Endpoint Management
- Web Application Firewall
State Government Agencies
- External Vulnerability Scans
- Anti-Phishing / Security Awareness Training (SAT)
- Advanced Endpoint Protection (AEP)
- Converged Endpoint Management (XEM)
- Multi-Factor Authentication (MFA)
- Web Application Firewall (WAF)
Tanium Converged Endpoint Program - Frequently Asked Questions (FAQs)
The first step is completing the SecureNC Intake Form on the NC DIT website. By completing this brief questionnaire, you’ll help us better understand your IT environment and security needs.
Submitting this form allows you to sign up for an upcoming SecureNC demo, where you’ll see how the program works and the benefits it offers for improving cybersecurity across the great state of North Carolina.
Once submitted:
- Your information is reviewed by the implementation team.
- You’ll be scheduled for a SecureNC demo (held every Wednesday at 1:00 PM ET, excluding holidays).
- Following the demo, you can join Office Hours on Thursday at 9:00 AM ET for Q&A and deeper discussion.
- Please note: The demo team requires at least two business days’ notice for demo scheduling.
- Please note: The demo team requires at least two business days’ notice for demo scheduling.
The MOU is a formal agreement between your organization and NC DIT that outlines participation in SecureNC. It confirms your intent to move forward and defines roles, responsibilities, and expectations for deployment. NC DIT will send the MOU following your intake form submission, if not received previously.
Yes. The MOU must be signed before deployment can begin. If you have any questions about language in the MOU, please reach out to Jennifer Fix, Deputy State CISO (Jennifer.fix@nc.gov) to discuss and we can address any concerns.
The demo provides an overview of Tanium’s capabilities and incorporates insights from your intake form. It lasts about one hour and may include other interested locals to foster collaborative learning.
For general inquiries, email esrmo@nc.gov. We will also host weekly Office Hours on Thursdays from 9-10 AM ET for Q&A and deeper discussions.
Nothing. The State of North Carolina has funded this program. There is no cost to the participating local organizations. Participating organizations onboarding before July 2026 will not be asked to pay for future use of the products.
Licenses are provided based on the amount requested through the Intake form. While there is no maximum or cap on licenses, this amount must be a realistic amount based on your organization size.
Local organizations are required to have support from local executives and provide an executive and technical point of contact. Local organizations are required to make consistent progress with onboarding and use of the product(s) at their organizations. Licenses assigned to non-responsive organizations may be re-allocated to another organization.
How much time does it take to set these products up in my environment?
Time to set up will vary with each product. The program’s vendor partners, and the State’s internal product owners will work with your technical team on the setup(s). The intent of this program is to provide support to your organization to make the onboarding process as minimal as possible. Professional assistance will be provided by the vendors to assist you throughout the onboarding process.
Here is the full suite of modules that will be made available during implementation and deployment:
- Asset
- Benchmark
- Comply
- Core (Interact, Connect, Reporting)
- Deploy
- Discover
- Patch
- Threat Response
Currently, we are prioritizing Tanium onboarding for T1 & T2 local government entities to provide a no-cost, unified platform to help counties, cities and other government entities secure their IT infrastructure by providing real-time visibility, control, and automated endpoint management thus improving cybersecurity, efficiency, and constituent service delivery. If you are interested in Tanium but do not fall into the T1/T2 designation, please provide your information in an email to esrmo@nc.gov and we will provide additional guidance and/or add you to the list for future phases of the program.
For More Information
Visit the Enterprise Security and Risk Management Office website or contact the ESRMO at esrmo@nc.gov with questions or for more information.