Security management in organizations is a complex task requiring defined organizational structures and processes. Established standards and recommendations provide methodological guidance for establishing and managing security. However, it has been observed that governmental or public bodies show different challenges in security management than industrial organizations due to their often densely regulated settings. In this context, in particular federal multi-layered structures have been pointed out as hard to manage. The main contributions of this paper are the results of an interview study among the chief information and security officers (CISOs) of the federal states of Germany. The results shed light on current challenges in cybersecurity management. The results are meant to establish the relevance of research work in this area and to be the starting point of developing artefacts or instruments supporting cybersecurity management at the interface of federal states and municipalities in particular.