{"resourceId":"ohio-digital-states-2026-flory-agentic-soc-recoveryrachel-20260923","versions":[{"version":"external-e821120bf8b3a219d3d42dd9d53095721cd09719df70388763e4bc6ab7bc6362","resource":{"id":"ohio-digital-states-2026-flory-agentic-soc-recoveryrachel-20260923","title":"Ohio Digital States interview cites RecoveryRachel behavioral-health finder and agentic SOC across 26 agencies","organization":"Ohio Department of Administrative Services / CIO Katrina Flory; RecoveryOhio; Ohio cybersecurity operations","sector":"State enterprise IT / behavioral health access / statewide cybersecurity operations / data management","geography":"Ohio, United States","publishedAt":"2026-09-23","publicationDate":"2026-09-23","eventDate":"2026-09-23","sourceName":"Government Technology — Digital States 2026 ‘A’ State Interview: Katrina Flory, Ohio","sourceLabel":"Independent trade Q&A with A-grade state CIO in Digital States 2026 series","sourceUrl":"https://www.govtech.com/cdg/digital-states-2026-a-state-interview-katrina-flory-ohio","evidenceClass":"independent-reporting","outcomeClass":"emerging","topics":["infrastructure","data-security","knowledge-work","operating-model","accessibility-workforce"],"finding":"Why now: 2026-09-23 Digital States A-state interview adds Ohio’s operational GenAI stack still unarchived after prior A-state pieces. CIO Katrina Flory highlights RecoveryRachel (RecoveryOhio) as a conversational voice/chat tool helping residents find licensed mental health and substance-use providers; describes an Agentic Security Operations Center powered by Google SecOps and Gemini AI enabling coordinated defense across 26 cabinet agencies and numerous boards/commissions with automated triage/correlation; and details Snowflake Cortex / Copilot uses for FinOps, synthetic-data guidelines, and data-catalog curation automation. Also mentions Safeguard Ohio tip-reporting AI—public-safety adjacent and out of primary stream scope.","sledRelevance":"State shared-services cyber AI at multi-agency scale plus resident behavioral-health navigation—relevant to operating-model, infrastructure, and accessibility-workforce topics; public-safety tip app noted only as boundary.","evidence":"GovTech Digital States Q&A; qualitative/architectural claims (26 agencies, agentic SOC, RecoveryRachel capabilities) without published MTTD/MTTR, deflection, or outcome KPIs in the opened page.","architectureImplications":"Agentic SOC on Google SecOps + Gemini; RecoveryRachel conversational provider-finder; Snowflake Cortex + Copilot for data quality/metadata/catalog search agents; federated enterprise data catalog.","governanceImplications":"Human oversight retained for security/privacy/policy decisions in data-management AI; digital accessibility policy aligned to 28 CFR Part 35 Subpart H; strategic governance of agents listed as next step.","securityPrivacyImplications":"Agentic SOC automates triage/enrichment while analysts decide; privacy suppression/aggregation and data classification called out as priorities; RecoveryRachel handles sensitive health-seeking context—controls not detailed here.","caveats":"No quantitative cyber or RecoveryRachel outcome metrics in this interview. Safeguard Ohio is public-safety/criminal-justice tip reporting—exclude from primary state-government evidence per stream scope.","streamIds":["state-government"],"roles":{"sales":"Sales framing: Ohio is broadcasting an agentic SOC across 26 agencies and a behavioral-health finder (RecoveryRachel) in Digital States. Open discovery on MTTD/MTTR and provider-match quality before proposing similar stacks. Bound cyber offers to analyst-in-the-loop agentic SOC design; do not sell Safeguard Ohio-style tip apps into this stream’s primary scope.","engineering":"Engineering framing: agentic SOC means automated triage and correlation with analyst authority retained on high-impact actions; RecoveryRachel is constrained provider search over licensed directories; data-catalog agents need human sign-off on classifications. Proof-of-value needs SOC time-to-decision and RecoveryRachel resolution quality—not architecture slides alone.","delivery":"Delivery framing: sequence SOC playbook automation, RecoveryRachel content operations, and catalog-agent governance with accessibility policy alignment. Acceptance should include published analyst decision SLAs and provider-directory freshness checks. Risks include autonomous SOC action without change control, health-navigation hallucinations, and scope bleed into public-safety tip tooling."},"roleDetails":{"sales":{"customerProblem":"States need multi-agency cyber AI and resident navigation tools with measurable analyst and user outcomes, not only platform names.","stakeholders":["State CIO","CISO / SOC leadership","RecoveryOhio / behavioral health","Enterprise data office","Cabinet agency CIOs"],"discoveryQuestions":["What MTTD/MTTR changed after agentic SOC?","Which SOC actions remain human-mandatory?","How is RecoveryRachel provider directory kept current?","What governance gates apply to catalog/data agents?"],"valueHypothesis":"A bounded agentic-SOC measurement or RecoveryRachel quality engagement can turn Ohio’s architecture claims into decision-grade KPIs.","potentialEngagement":"6–8 week agentic SOC playbook/KPI design or behavioral-health navigator QA pilot.","unsupportedClaims":["Proven statewide breach reduction","Guaranteed resident treatment outcomes","Fully autonomous SOC response"]},"engineering":{"fit":"Fit for analyst-supervised agentic SOC and constrained provider-finder RAG; data-catalog agents with human classification sign-off.","architectureIntegration":"Google SecOps + Gemini SOC agents; RecoveryRachel voice/chat over licensed provider data; Snowflake Cortex/Copilot catalog agents.","prerequisites":["SOC playbooks and authority matrix","Licensed provider directory","Data classification standards","Identity baselines"],"constraints":["No outcome KPIs in source","Public-safety tip app out of stream scope","Vendor-specific Google/Snowflake stack"],"security":"Keep destructive SOC actions human-gated; protect health-seeking queries; enforce privacy suppression in catalog agents.","proofOfValue":["Analyst time-to-decision sampling","False-positive/negative SOC review","RecoveryRachel match accuracy audit","Catalog metadata acceptance rate"]},"delivery":{"work":"SOC agent playbooks, navigator content ops, catalog-agent governance, accessibility alignment support.","dependencies":["Cyber ops","RecoveryOhio","Enterprise data catalog owners","Cabinet agencies"],"ownership":"CIO/DAS enterprise with SOC and RecoveryOhio operational owners.","skillsAdoption":"Analysts need AI-triage literacy; navigator content owners need QA skills; data stewards approve AI-suggested metadata.","governanceCheckpoints":["Agent action authority review","Monthly SOC efficacy review","Provider-directory freshness check","Catalog agent policy review"],"acceptanceCriteria":["Human gate on high-impact SOC actions","Published navigator quality sample","Documented agent governance"],"risks":["Autonomous SOC mis-response","Health navigation hallucination","Scope bleed into public-safety tip tooling"]}},"retrievedAt":"2026-09-26T22:17:51-05:00","enrichedAt":"2026-09-26T22:23:11-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Digital accessibility policy revision to 28 CFR Part 35 Subpart H with training/resources; RecoveryRachel voice/chat framed as meeting residents where they are. Workforce: SOC analyst leverage via automation.","procurementImplications":"Google SecOps/Gemini and Snowflake/Microsoft Copilot named—confirm enterprise agreements, agentic SOC addenda, and data-processing terms across 26 agencies.","operatingModelImplications":"Enterprise SOC shared across cabinet agencies; RecoveryOhio program ownership of navigator; federated data catalog with strategic agent governance as next step.","sourceVerification":{"openedUrl":"https://www.govtech.com/cdg/digital-states-2026-a-state-interview-katrina-flory-ohio","referenceExcerpt":"Agentic Security Operations Center powered by Google SecOps and Gemini AI","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}