"State governments face persistent challenges in cybersecurity risk reduction because of four key issues: inadequate strategic direction and organizational structure, constrained security budgets, increasing the sophistication of the threats, and lack of cybersecurity professionals."