(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology.

This bill would require the Department of Technology, in consultation with the Office of Emergency Services and compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. The bill would require each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorize the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. The bill would define terms for its purposes and make legislative findings in support of its provisions. The bill would prohibit public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology.

This bill would require the Department of Technology, in consultation with the Office of Emergency Services and compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. The bill would require each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorize the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. The bill would define terms for its purposes and make legislative findings in support of its provisions. The bill would prohibit public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology.

This bill would require the Office of Emergency Services, in conjunction with the Department of Technology, to transmit to the Legislature, on or before July 1, 2017, a cybersecurity incident response plan, known as the Cyber Security Annex to the State Emergency Plan, Emergency Function 18, or EF 18. The bill would further require the office, in conjunction with the Department of Technology and on or before January 1, 2018, to develop cybersecurity incident response standards for state agencies, as defined, to, among other things, prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure and would require state agencies to report their compliance with these standards to the office. Department of Technology, in consultation with the Office of Emergency Services and compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. The bill would require the office, in conjunction with the Department of Technology, each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorize the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. The bill would define terms for its purposes and make legislative findings in support of its provisions. The bill would prohibit public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.

This bill would require the Office of Emergency Services, in conjunction with the Department of Technology, to transmit to the Legislature, on or before July 1, 2017, a cybersecurity incident response plan, known as the Cyber Security Annex to the State Emergency Plan, Emergency Function 18, or EF 18. The bill would further require the office, in conjunction with the Department of Technology and on or before January 1, 2018, to develop cybersecurity incident response standards for state agencies, as defined, to, among other things, prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure and would require state agencies to report their compliance with these standards to the office. The bill would require the office, in conjunction with the Department of Technology, to provide suggestions for a state agency to improve compliance with these standards. The bill would prohibit public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.

This bill would require the Office of Emergency Services Services, in conjunction with the Department of Technology, to transmit to the Legislature, on or before July 1, 2017, a cybersecurity incident response plan, known as the Cyber Security Annex to the State Emergency Plan, also known as Emergency Function 18 18, or EF 18. The bill would further require the office office, in conjunction with the Department of Technology and on or before January 1, 2018, to develop a comprehensive cybersecurity strategy setting incident response standards for state agencies, as defined, to, among other things, prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure and would require state agencies to report its their compliance with these standards to the office. The bill would require the office office, in conjunction with the Department of Technology, to provide suggestions for a state agency to improve compliance with these standards. The bill would prohibit public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state.

This bill would require the Office of Emergency Services to develop and transmit to the Legislature a state-wide emergency services response plan for cybersecurity attacks on critical infrastructure systems, as defined. Legislature, on or before July 1, 2017, the Cyber Security Annex to the State Emergency Plan, also known as Emergency Function 18 or EF 18. The bill would further require the office to develop a comprehensive cybersecurity strategy setting standards for state agencies, as defined, and private entities to to, among other things, prepare for cybersecurity attacks on interference with, or the compromise or incapacitation of, critical infrastructure systems. The bill and would require state agencies, and authorize private entities, agencies to report its cybersecurity strategy compliance with these standards to the office. The bill would require the office to provide suggestions for improvement to the cybersecurity strategy of a state agency, and authorize the office to do the same for a private entity, but only for purposes of protecting public health and safety. a state agency to improve compliance with these standards. The bill would prohibit public disclosure of the offices state-wide emergency services response plan and public records relating to the individual cybersecurity strategies of state agencies and private entities. agencies, as specified.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

(1)The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state.

This bill would require the Office of Emergency Services to develop and transmit to the Legislature a state-wide emergency services response plan for cybersecurity attacks on critical infrastructure systems, as defined. The bill would further require the office to develop a comprehensive cybersecurity strategy setting standards for state agencies, as defined, and private entities to prepare for cybersecurity attacks on critical infrastructure systems. The bill would require state agencies, and authorize private entities, to report its cybersecurity strategy to the office. The bill would require the office to provide suggestions for improvement to the cybersecurity strategy of a state agency, and authorize the office to do the same for a private entity, but only for purposes of protecting public health and safety. The bill would prohibit public disclosure of the offices state-wide emergency services response plan and the individual cybersecurity strategies of state agencies and private entities.

(2)Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1841

Author:(Irwin)

As Amended Ver:August 15, 2016

Majority vote

Original Committee Reference: P. & C.P.

SUMMARY: Requires the Department of Technology (CDT), in conjunction with the Office of Emergency Services (OES), by July 1, 2018, to update the Technology Recovery Plan (TRP) element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

The Senate amendments:

1. Delete the requirement that OES transmit to the Legislature a cybersecurity incident response plan by July 1, 2017.
2. Delete the requirement that OES develop cybersecurity incident response standards for state agencies and that state agencies transmit critical infrastructure information to OES.
3. Require CDT, in conjunction with OES, to update the TRP element of the State Administrative Manual by July 1, 2018, to ensure the inclusion of cybersecurity strategy incident response standards for each state agency for the purpose of securing its critical infrastructure controls and critical infrastructure information.
4. Expand the required updated cybersecurity strategy incident response standards to address continuity of operations and protection of personal information.
5. Require each state agency to provide CDT with an updated copy of its TRP.
6. Require each state agency to report on its compliance with the updated standards by July 1, 2019, and authorizes CDT, in conjunction with OES, to provide suggestions for state agencies to improve compliance with the standards.
7. Declare that each state agency's updated TRP provided to CDT is confidential and shall not be disclosed pursuant to any state law, including the California Public Records Act.
8. Define the term "critical infrastructure controls", delete the previously defined term "critical infrastructure," and expand the definition of "critical infrastructure information" to incorporate the new term "critical infrastructure controls."
9. Define the terms "department" and "office."
10. Revise the legislative findings and declarations to better clarify the respective roles of CDT and OES.

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. Minor and absorbable costs to CDT and OES for updating the Technology Recovery Plan. (GF and Special Fund)
2. Unknown, but likely absorbable costs to each state agency to update and report on its Technology Recovery Plan. (GF)

COMMENTS: This bill is intended to speed the creation of cybersecurity response plans for state agencies by imposing a July 2018 deadline for updating the state's Technology Recovery Plan (TRP), and requiring state agencies to update their own plans accordingly and report on their compliance to CDT by July 2019. This bill is author-sponsored.

The TRP is a subset of the state entity's Business Continuity Plan. The TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Each state entity is required to develop a TRP in support of the state entity's Continuity Plan and the business need to protect critical information assets to ensure their availability following an interruption or disaster. The TRP was last updated in August 2013.

According to the California Military Department, California's size and importance makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0004305

 THIRD READING  

Bill No: AB 1841

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 12-0, 6/14/16

AYES: Hall, Bates, Block, Gaines, Galgiani, Glazer, Hernandez, Hill, Hueso, Lara, McGuire, Vidak

NO VOTE RECORDED: Berryhill

SENATE JUDICIARY COMMITTEE: 7-0, 6/28/16

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/11/16

AYES: Lara, Bates, Beall, Hill, McGuire, Mendoza, Nielsen

ASSEMBLY FLOOR: 79-0, 5/31/16 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill requires the California Department of Technology (CDT) to on or before July 1, 2018, in conjunction with the Office of Emergency Services (OES), to update the Technology Recovery Plan (TRP) of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information.

ANALYSIS:

Existing law:

1. Establishes OES and requires OES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
2. Specifies that the State Emergency Plan (SEP) shall be in effect in each political subdivision of the state, and the governing body of each political subdivision shall take such action as may be necessary to carry out the provisions thereof.
3. Establishes CDT under the supervision of the Director of CDT and generally requires CDT to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.

This bill:

1. Requires CDT, on or before July 1, 2018, in conjunction with OES, to update the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. In updating the standards, CDT shall consider but not be limited to considering, all of the following:
   1. Cost to implement the standards.
   2. Security of critical infrastructure information.
   3. Centralized management of risk.
   4. Industry best practices.
   5. Continuity of operations.
   6. Protection of personal information
2. Requires each state agency to provide CDT with a copy of its updated TRP.
3. Requires each state agency to report its compliance with the standards updated by this bill to CDT in the manner and at the time directed by CDT, but no later than July 1, 2019.
4. Provides that CDT, in conjunction with OES, may provide suggestions for a state agency to improve compliance with the standards developed by this bill, to the head of the state agency and the secretary responsible for the state agency. For a state agency that is not under the responsibility of a secretary, CDT shall provide any suggestions to the head of the state agency and the Governor.
5. Specifies that the report and any public records relating to any communication are confidential and shall not be disclosed pursuant to state law, including the California Public Records Act.
6. Defines “Critical infrastructure controls” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
7. Defines “Critical infrastructure information” to mean information not customarily in the public domain pertaining to any of the following:
   1. Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof.
   2. The ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure.
   3. Any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.

1. Makes legislative findings pertaining to the importance of adding to the ongoing work of the state’s comprehensive cybersecurity strategy.

Background

Technology Recovery Plan. The TRP is a sub-set of the state entity’s Business Continuity Plan. The TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Each state entity is required to develop a TRP in support of the state entity’s Continuity Plan and the business need to protect critical information assets to ensure their availability following an interruption or disaster.

The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP was last updated in August 2013.

Cyber threats in California. According to the California Military Department (CMD), California's size and importance makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security.

CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy. 30% of all cyber-attacks and other malicious activity are targeted at the government, making these networks and systems the most vulnerable target of cybercrime.

According to CMD, the threat to government networks has never been higher. “Hacktivists”, nation states, cyber criminals and other threat groups are attacking government networks to steal sensitive information and make a political/economic statement. It is not known how many attacks, whether successful or unsuccessful, have been made against state agency computers over the past year.

Snapshot of California’s critical infrastructure. According to OES, the following represents a snapshot of California’s critical infrastructure:

• Water: 1468 dams, of which 140 have capacities greater than 10,000 acre-feet; 701 miles of canals and pipelines; and 1.595 miles of levees.
• Electrical Power: 1,008 in state power plants, nearly 70,000 megawatts install generation capacity, and substations and transmission lines deliver over 200 billion kilowatt hours to customers annually.
• Oil and Natural Gas: over 115,000 miles of oil and natural gas pipelines, 20 refineries and over 100 oil and natural gas terminal facilities, and more than a dozen of the U.S.’s largest oil fields.
• Transportation: over 170,000 miles of public roads; over 50,000 lane miles of highways; over 12,000 bridges; 246 public use airports, 30 of which provide scheduled passenger service. Los Angeles Airport is the seventh busiest worldwide.
• California has 11 seaports handling more than half of all the US shipping freight. Three of the country’s largest container ports are in California: Los Angeles, Long Beach and Oakland. Nationally, Los Angeles is the busiest container volume, internationally the eighth busiest, and when combined with Long Beach is the fifth busiest.
• Public Health: 450 acute care hospitals.
• Emergency Services: 1,974 fire stations.
• Chemical: Approximately 95 “high risk” facilities
• Agriculture: 81,500 farms; more than 400 commodities; in 2012 total agriculture-related sales for output was $44.7 billion, representing 11.3% of the national total.
• Finance: 7,374 commercial banks with deposits totaling $753 billion; 410 credit unions with assets totaling $115 billion.

Prior/Related Legislation

SB 949 (Jackson, 2016) authorizes the Governor to require owners and operators of critical infrastructure, as defined, to submit critical infrastructure information to OES. (Never heard in Senate Governmental Organization Committee)

AB 2595 (Linder, 2016) establishes in statute the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. (Held in Assembly Appropriations Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually.

AB 739 (Irwin, 2015) provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in the Assembly Judiciary Committee)

AB 1172 (Chau, 2015) continues in existence the California Cybersecurity Task Force, created in 2013 by OES and CDT. (Senate Inactive File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, minor and absorbable costs to CDT and OES for updating the TRP. In addition, unknown, but likely absorbable costs to each state agency to update and report on its TRP.

SUPPORT: (Verified 8/11/16)

Deloitte Consulting, LLP

Los Angeles Area Chamber of Commerce

Los Angeles County Professional Peace Officers Association

Los Angeles Deputy Sheriffs

Los Angeles Police Protective League

Riverside Sheriff’s Association

OPPOSITION: (Verified 8/11/16)

None received

ARGUMENTS IN SUPPORT: Supporters of the bill argue that, “in the past few years, retailers, financial institutions, and government agencies have increasingly fallen victim to cyberattacks. Most recently, in June 2015 the federal office of Personnel Management announced that a cybersecurity intrusion had exposed the personal information of approximately 20 million current and former federal employees and other individuals. Given the size of California’s economy and the value of its information, the State presents a prime target for similar information security breaches.”

ASSEMBLY FLOOR: 79-0, 5/31/16

AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Rendon

NO VOTE RECORDED: Beth Gaines

Prepared by:

8/15/16 20:10:10

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

AB 1841 (Irwin) - Cybersecurity incident response plan and standards

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on August 11, 2016

Bill Summary:

AB 1841 would require the Department of Technology (CDT), in conjunction with the Office of Emergency Services (OES), by July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

Fiscal Impact:

• Minor and absorbable costs to CDT and OES for updating the Technology Recovery Plan. (GF and Special Fund)
• Unknown, but likely absorbable costs to each state agency to update and report on its Technology Recovery Plan. (GF)

Author Amendments:

• Strikes language requiring OES to transmit to the Legislature a cybersecurity incident response plan.
• Strikes language requiring OES to develop cybersecurity incident response standards for state agencies and language requiring state agencies to transmit critical infrastructure information to OES.
• Requires CDT, in conjunction with OES, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information.
• Requires each state agency to report on its compliance with the updated standards by July 1, 2019, and authorizes CDT, in conjunction with OES, to provide suggestions for state agencies to improve compliance with the standards.

-- END --

SENATE COMMITTEE ON APPROPRIATIONS

Senator Ricardo Lara, Chair

2015 - 2016 Regular Session

AB 1841 (Irwin) - Cybersecurity incident response plan and standards

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 1841 would require the Office of Emergency Services (OES), in conjunction with the Department of Technology (CDT) to transmit a cybersecurity incident response plan to the Legislature by July 1, 2017. This bill would also require development of cybersecurity incident response standards for state agencies by January 1, 2018.

Fiscal Impact:

• Estimated costs to OES of $2.9 million in fiscal year 2016-17, $1.5 million in 2017-18, and ongoing costs of $1.3 million per year. (GF) These costs include:
  • One-time costs to OES for hardware, software, and personnel costs for development of a secure database.
  • Properly retaining Protected Critical Infrastructure Information transmitted to Cal OES by state agencies.
  • On-going database maintenance.
  • Developing standards for state agencies that maintain critical infrastructure.
  • Oversight to ensure that state agencies are meeting the standards.
  • Six PY of staff in the Information Technology Services Division and the Critical Infrastructure Protection Unit to maintain, monitor, and manage system infrastructure.
• Ongoing, potentially significant cost pressure for state entities to adopt cybersecurity incident response standards developed by OES and to make necessary changes to address any issues identified by OES concerning compliance with the standards. (GF and/or Special Funds).

Background:

In 2013, the Governor administratively directed OES and CDT to create a Cyber Security Task Force composed of specified stakeholders, subject matter experts, and cyber security professionals from public, private, academic, and law enforcement sectors. The mission of the Task Force is to enhance the security of California’s digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness.

The State Emergency Plan (SEP) addresses the state’s response to extraordinary emergency situations associated with natural disasters or human-caused emergencies. The most recent SEP, prepared by OES in 2009 outlined a state-level strategy to support local government efforts during large scale emergencies. The 2009 SEP established 18 Emergency Functions (EF 18) that are primary activities essential for state entities to work together to address emergency management needs. According to OES’s website, EF 18 is the only incomplete component of the SEP. One of the 18 incomplete EF 18 functions is cybersecurity.

According to the California Military Department, California’s size and importance makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security. The owners and operators of California’s infrastructure such as power plants, water distribution systems, refineries, and communications equipment have largely replaced analog control systems with digital controls, often connected through computer networks. These updated systems make management of critical infrastructure more efficient but also more vulnerable to cyber-attack.

According to the author, the State Emergency Plan does not currently have an established cybersecurity strategy or an incident response plan to account for cybersecurity risks imposed on the state and general public.

Proposed Law:

This bill would:

• Require OES, in conjunction with CDT, on or before July 1, 2017, to transmit to the Legislature, a cybersecurity plan that includes, but is not limited to:
  • Methods for providing emergency services;
  • Command structure for statewide coordinated emergency services;
  • Emergency service roles of appropriate state agencies;
  • Identification of resources to be mobilized;
  • Public information plans;
  • Continuity of government services.
• Require OES, on or before January 1, 2018, in conjunction with CDT, to develop cybersecurity incident response standards for state agencies to prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure and for the development and transmission of critical infrastructure information to OES. In development of the standards, OES shall consider the following:
  • Costs to implement the standards;
  • Security of critical infrastructure information;
  • Centralized management of risk;
  • Industry best practices;
  • Continuity of operations;
  • Protection of personal information.
• Require each state agency to report on its compliance with the standards by January 1, 2019, and directs OES, in conjunction with CDT, to provide suggestions for state agencies to improve compliance with the standards.
• Specify that the report and communications required under this provision are confidential and shall not be disclosed pursuant to any state law including the California Public Records Act.

Related Legislation:

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure, as defined to submit critical infrastructure information to OES. This bill was referred to the Senate Governmental Organization Committee but never heard.

AB 1346 (Gray, 2016) would require OES to update the SEP on or before January 1, 2018 and every 5 years thereafter and would require the plan to be consistent with specified state climate adaptation strategies. This bill is pending in the Senate Appropriations Committee.

AB 2595 (Linder, 2016) would have established the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. This bill was held in the Assembly Appropriations Committee.

AB 670 (Irwin, Chapter 518, Statutes of 2015) requires CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually.

AB 1172 (Chau, 2015) would have continued in existence the California Cybersecurity Task Force, created in 2013, by OES and CDT. This bill was ordered to the Senate Inactive File.

Staff Comments:

This bill would require OES to collect protected critical infrastructure information from all state agencies, which OES does not currently do. In order to do this, OES would have to create and maintain a secure “virtual infrastructure” system that is appropriate for retaining this critical information. The main source of costs in fiscal year 2016-17 would be development of such a system. An initial $1.5 million would be needed for licensing and two limited term positions for building the database and launching the system.

The virtual infrastructure system would require an ongoing $300,000 per year for licensing and maintaining the system. OES estimates they would also need an additional 6 PY of staffing for ongoing IT demands, critical infrastructure analysis, and data entry and resolution.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015-2016 Regular Session

Bill No: AB 1841 (Author:Irwin)

Version: April 14, 2016

Hearing Date: June 28, 2016

Fiscal: Yes

Urgency: No

Consultant: TH

SUBJECT

Cybersecurity Incident Response Plan and Standards

DESCRIPTION

This bill requires the Governor’s Office of Emergency Services (OES) and the California Department of Technology (CalTech) to transmit to the Legislature a statewide cybersecurity incident response plan by July 1, 2017. This bill also requires OES and CalTech to develop cybersecurity incident response standards for state agencies to prepare for possible interference, compromise, or incapacitation, of critical infrastructure.

BACKGROUND

The State of California Emergency Plan (SEP) establishes California’s planned response to a variety of extraordinary emergency situations associated with natural disasters or human-caused emergencies. Pursuant to the California Emergency Services Act (Gov. Code Sec. 8550), the SEP describes the methods for carrying out emergency operations, the process for rendering mutual aid, the emergency services of governmental agencies, how resources are mobilized, how the public will be informed of emergencies, and the process to ensure continuity of government during an emergency or disaster.

The SEP is composed of three principal elements. The Basic Plan describes the fundamental systems, strategies, policies, assumptions, responsibilities, and operational priorities that California will utilize to guide and support emergency management efforts. The Functional Annexes to the SEP describe discipline-specific goals, objectives, operational concepts, capabilities, organizational structures, and related policies and procedures. Finally, the Appendices to the SEP constitute additional plans and procedures that are developed in support of the SEP, such as mutual aid plans, hazard-specific plans, catastrophic plans and related procedures. Together, these elements provide a consistent, statewide framework to enable state, local, tribal governments, the federal government, and the private sector to work together to mitigate, prepare for, respond to, and recover from the effects of emergencies regardless of cause, size, location, or complexity.

This bill directs OES and CalTech to develop a new functional annex on cybersecurity to the SEP called Emergency Function 18 (EF 18) by July 1, 2017. This bill also directs OES and CalTech to formulate cybersecurity incident response standards for state agencies by January 1, 2018, to prepare agencies for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure, and for the development and transmittal of critical infrastructure information.

CHANGES TO EXISTING LAW

Existing law, the data breach notification law, requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)

Existing law, the Information Practices Act of 1977, requires each agency to establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with the provisions of the Act, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to their security or integrity which could result in any injury. (Civ. Code Sec. 1798.21.)

Existing law, the California Emergency Services Act, directs the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state, and to coordinate the preparation of plans and programs for the mitigation of the effects of an emergency by the political subdivisions of this state. (Gov. Code Sec. 8569.)

Existing law states that the State Emergency Plan shall be in effect in each political subdivision of the state, and the governing body of each political subdivision shall take such action as may be necessary to carry out the provisions thereof. (Gov. Code Sec. 8568.)

This bill requires OES, on or before July 1, 2017, in conjunction with CalTech, to transmit to the Legislature a cybersecurity incident response plan, known as the Cyber Security Annex to the State Emergency Plan Emergency Function 18 that includes, but is not limited to, all of the following:

• methods for providing emergency services;
• command structure for statewide coordinated emergency services;
• emergency service roles of appropriate state agencies;
• identification of resources to be mobilized;
• public information plans; and
• continuity of government services.

This bill requires OES, on or before January 1, 2018, in conjunction with CalTech, to develop cybersecurity incident response standards for state agencies to prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure, and for the development and transmission of critical infrastructure information to OES. In developing the standards, OES shall consider all of the following:

• costs to implement the standards;
• security of critical infrastructure information;
• centralized management of risk; and
• national private industry best practices.

This bill requires each state agency to report on its compliance with the above standards no later than January 1, 2019, and directs OES, in conjunction with CalTech, to provide suggestions for state agencies to improve compliance with the standards. This bill specifies that the report and communications required under this provision are confidential and shall not be disclosed pursuant to any state law, including the California Public Records Act.

This bill makes related findings and declarations.

COMMENT

1. Stated need for the bill

The author writes:

The State Emergency Plan currently does not account for cybersecurity risks imposed on the state and general public. Despite years of effort to develop such planning, we have failed to do so. As cybersecurity attacks become more frequent and sophisticated, we must integrate those considerations into our relative emergency planning and resource allocations.

This bill requires the California Office of Emergency Services in conjunction with the Department of Technology to transmit to the Legislature, by July 1, 2017, a statewide emergency services response plan for cybersecurity, and further requires OES and [CalTech] to develop a comprehensive cybersecurity strategy against critical infrastructure by January 1, 2018.

1. Cyber threat to critical infrastructure

With the development of digital technology, the owners and operators of California’s critical infrastructure – things like power plants, water distribution systems, refineries, and communications equipment – have largely replaced outdated analog control systems with digital controls, often interconnected with other systems through computer networks. These updated control systems simplify the management of critical infrastructure and make it more productive. Unfortunately, this same technology also makes our infrastructure vulnerable to cyber attack.

In recent years, critical infrastructure in the United States has been subject to a number of attacks by cybercriminals, including a 2014 incident where an overseas hacker gained access to systems regulating the flow of natural gas. These incidents have prompted state and federal leaders to warn operators of critical infrastructure of the need to bolster cyber defenses to protect against debilitating attacks that threaten our public safety and economic well-being. Indeed, just last year the Governor declared that “cyber attacks aimed at breaching and damaging computer networks and infrastructure in California represent a major security risk and increase the state’s vulnerability to economic disruption, critical infrastructure damage, privacy violations, and identity theft.” (See Executive Order B-34-15 [August 31, 2015].)

This bill would bolster California’s critical infrastructure cyber defenses by requiring OES and CalTech to create a cyber security annex to the State Emergency Plan. This annex, once completed, would help the State plan for, and respond to, cyber attacks against infrastructure – both publicly and privately owned – that Californians rely on in their daily lives. This bill also directs state agencies to implement cybersecurity incident response standards developed by OES and CalTech, which will help agencies plan their responses to cyber attacks carried out against their infrastructure and resources. While the bill lists several factors for OES and CalTech to consider in developing these standards, the Committee may wish to add “continuity of operations” to that list in light of the reliance Californians place on information technology systems to transact business with state agencies.

1. Right to privacy and agency breaches

California recognizes the right to privacy as a fundamental right and has enshrined that right along with other fundamental rights in article I, section 1 of the California Constitution. The harm that can result from the theft of personal information via a data breach threatens to undermine that fundamental right. Unfortunately, because of the size of its economy and the sheer number of its consumers, data held by California businesses and government agencies is frequently targeted by cyber criminals. The Attorney General’s 2014 California Data Breach Report found that in 2012, “17 percent of the data breaches recorded in the United States took place in California – more than any other state” and that “the number of reported breaches in California increased by 28 percent in 2013.” (California Department of Justice, California Data Breach Report (Oct. 2014) <https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ 2014data_breach_rpt.pdf> [as of June 26, 2016].) The frequency of data breaches in California and the threat that such breaches pose to California residents makes timely and effective response to a breach, and the ability to mitigate potential damages resulting from the breach, matters of critical importance.

Recent data breaches show that government agencies are just as vulnerable as businesses to breaches that expose the personal information of California residents. In March of 2014, for example, the California Department of Motor Vehicles reported that its system for processing online credit card transactions may have been breached, potentially compromising millions of credit card numbers, expiration dates, and credit card security codes. (See Kate Mather and Carla Rivera, California DMV Probing Possible Breach of Customer Credit Cards, Los Angeles Times (Mar. 22, 2014) <http://articles.latimes.com/2014/mar/22/local/la-me-0323-dmv-breach-20140323> [as of June 26, 2016].) More recently, the federal Office of Personnel Management suffered a massive data breach that revealed the personal information -- and in some cases the fingerprints -- of approximately 21.5 million individuals, including many with secret-level security clearances. (See James Eng, OPM Hack: Government Finally Starts Notifying 21.5 Million Victims, NBC News (Oct. 1, 2015) <http://www.nbcnews.com/ tech/security/opm-hack-government-finally-starts-notifying-21-5-million-victims-n437126> [as of June 26, 2016].)

When breaches do occur, a rapid and effective response is crucial toward mitigating the impact to affected individuals. This bill would assist state agencies in executing a rapid and effective response in the wake of a breach or other cyber incident by requiring these agencies to implement cybersecurity incident response standards developed by OES and CalTech. Having an effective response standard in place that, for example, identifies needed resources and establishes protocols for carrying out communications between participants, will speed up an agency’s ability to respond to an event. However, given the sensitive nature of some of the personal information held by state agencies, and California’s recognition of a constitutional right to privacy, it is important that an agency’s cybersecurity response standard recognizes the need to protect sensitive information from disclosure or compromise. The Committee may, therefore, wish to add “protection of personal information” to the list of considerations guiding OES and CalTech in the development of this standard.

Support: None Known

Opposition: None Known

HISTORY

Source: Author

Related Pending Legislation:

SB 949 (Jackson, 2016) would authorize the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to the Office of Emergency Services, or any other designee, for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. This bill is pending in the Senate Governmental Organization Committee.

SB 1444 (Hertzberg, 2016) would require state agencies that own or license computerized data that includes personal information to prepare a security plan that details the agency’s strategy to respond to a security breach of that information and its associated consequences. This bill is pending in the Assembly Privacy and Consumer Protection Committee.

AB 1346 (Gray, 2016) would, among other things require the Office of Emergency Services to update the State Emergency Plan on or before January 1, 2018, and every five years thereafter. This bill is pending in the Senate Appropriations Committee.

AB 739 (Irwin, 2015) would, until January 1, 2020, provide legal immunity from civil or criminal liability for private entities that communicate anonymized cyber security-threat information, as specified. This bill is pending in the Assembly Judiciary Committee.

Prior Legislation:

AB 670 (Irwin, Ch. 518, Stats. 2015) requires the Office of Information Security, in consultation with the Office of Emergency Services, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

Prior Vote:

Senate Governmental Organization Committee (Ayes 12, Noes 0)

Assembly Floor (Ayes 79, Noes 0)

Assembly Appropriations Committee (Ayes 20, Noes 0)

Assembly Governmental Organization Committee (Ayes 21, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

**************

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Isadore Hall, III

Chair

2015 - 2016 Regular

Bill No: 1841 Hearing Date:

SUBJECT: Cybersecurity incident response plan and standards

DIGEST: This bill requires the California Office of Emergency Services (OES) in conjunction with the Department of Technology (CDT) to transmit to the Legislature, by July 1, 2017, a statewide emergency services response plan for cybersecurity, and further requires OES and CDT to develop a comprehensive cybersecurity strategy against critical infrastructure by January 1, 2018.

ANALYSIS:

Existing law:

1. Establishes OES and requires OES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
2. Specifies that the State Emergency Plan (SEP) shall be in effect in each political subdivision of the state, and the governing body of each political subdivision shall take such action as may be necessary to carry out the provisions thereof.
3. Establishes CDT under the supervision of the Director of Technology and generally requires CDT to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.

This bill:

1. Requires OES, on or before July 1, 2017, in conjunction with CDT, to transmit to the Legislature a cybersecurity incident response plan, known as the Cyber Security Annex to the State Emergency Plan Emergency Function 18, or EF18, that includes, but is not limited to, all of the following:
   1. Methods for providing emergency services.
   2. Command structure for statewide coordinated emergency services.
   3. Emergency service roles of appropriate state agencies.
   4. Identification of resources to be mobilized.
   5. Public information plans.
   6. Continuity of government services.
2. Requires OES, on or before January 1, 2018, in conjunction with CDT, to develop cybersecurity incident response standards for state agencies to prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure and the development of critical infrastructure information, and to transmit critical infrastructure information to OES. In developing the standards, OES shall consider all of the following:
   1. Cost to implement the standards.
   2. Security of critical infrastructure information.
   3. Centralized management of risk.
   4. National private industry best practices.
3. Requires each state agency to report its compliance with the standards developed by this bill to OES in the manner and at the time directed by OES, but no later than January 1, 2019.
4. Requires OES, in conjunction with CDT, to provide suggestions for a state agency to improve compliance with the standards developed by this bill, to the head of the state agency and the secretary responsible for the state agency. For a state agency that is not under the responsibility of a secretary, OES shall provide any suggestions to the head of the state agency and the Governor.
5. Specifies that the report and any public records relating to any communication are confidential and shall not be disclosed pursuant to state law, including the California Public Records Act.
6. Defines “Critical infrastructure” to mean systems and assets so vital to the state that the incapacity or destruction of those systems or assets would have a debilitating impact on security, economic security, public health and safety, or any combination of those matters.
7. Defines “Critical infrastructure information” to mean information not customarily in the public domain pertaining to any of the following:
   1. Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law, harms economic security, or threatens public health or safety.
   2. The ability of critical infrastructure to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure, including, but not limited to, security testing, risk evaluation, risk management planning, or risk audits.
   3. Any planned or past operational problem or solution regarding critical infrastructure, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure.

1. Makes legislative findings pertaining to the importance of developing a comprehensive cybersecurity incident response plan.

Background

Purpose of the bill. According to the author, “OES, in its role as the state’s lead agency on emergency preparedness, response, and damage mitigation, has responsibility to develop, implement, and manage a comprehensive strategy to protect the critical infrastructure systems of federal and state governments. California currently does not have an established cybersecurity strategy or an incident response plan. Several other states have taken this important step. Having an incident response plan that is well understood by all relevant stakeholders is imperative to protecting critical infrastructure and mitigating potential consequences of a disruption or an attack.”

Cyber Threats in California. According to the California Military Department (CMD), California's size and importance makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security.

CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy. Thirty percent of all cyber-attacks and other malicious activity are targeted at the government, making these networks and systems the most vulnerable target of cybercrime.

According to CMD, the threat to government networks has never been higher. “Hacktivists”, nation states, cyber criminals and other threat groups are attacking government networks to steal sensitive information and make a political/economic statement. It is not known how many attacks, whether successful or unsuccessful, have been made against state agency computers over the past year.

OES and the incomplete EF 18. Current law authorizes the Governor to take actions to prepare for, respond to, and prevent natural or man-made disasters that endanger life, property, and the state's resources.

The most recent SEP was prepared by OES in 2009 and outlines a state-level strategy to support local government efforts during a large-scale emergency. The plan describes methods for carrying out emergency operations; the process for rendering mutual aid; emergency services of governmental agencies; how resources are mobilized; emergency public information; and continuity of government. The 2009 SEP also established the SEP’s Emergency Functions (EF), which consist of 18 disciplines deemed essential to the emergency management community in California.

According to the OES website, only EF 18 remains incomplete, and is noted as being "in development."

Snapshot of California’s Critical Infrastructure. According to OES, the following represents a snapshot of California’s critical infrastructure:

• Water: 1468 dams, of which 140 have capacities greater than 10,000 acre-feet; 701 miles of canals and pipelines; and 1.595 miles of levees.
• Electrical Power: 1,008 in state power plants, nearly 70,000 megawatts install generation capacity, and substations and transmission lines deliver over 200 billion kilowatt hours to customers annually.
• Oil and Natural Gas: over 115,000 miles of oil and natural gas pipelines, 20 refineries and over 100 oil and natural gas terminal facilities, and more than a dozen of the U.S.’s largest oil fields.
• Transportation: over 170,000 miles of public roads; over 50,000 lane miles of highways; over 12,000 bridges; 246 public use airports, 30 of which provide scheduled passenger service. Los Angeles Airport is the seventh busiest worldwide.
• California has 11 seaports handling more than half of all the US shipping freight. Three of the country’s largest container ports are in California: Los Angeles, Long Beach and Oakland. Nationally, Los Angeles is the busiest container volume, internationally the eighth busiest, and when combined with Long Beach is the fifth busiest.
• Public Health: 450 acute care hospitals.
• Emergency Services: 1,974 fire stations.
• Chemical: Approximately 95 “high risk” facilities
• Agriculture: 81,500 farms; more than 400 commodities; in 2012 total agriculture-related sales for output was $44.7 billion, representing 11.3% of the national total.
• Finance: 7,374 commercial banks with deposits totaling $753 billion; 410 credit unions with assets totaling $115 billion.

State Emergency Plan. The SEP addresses the state's response to extraordinary emergency situations associated with natural disasters or human-caused emergencies. In accordance with the California Emergency Services Act (CESA), the plan describes the methods for carrying out emergency operations, the process for rendering mutual aid, the emergency services of governmental agencies, how resources are mobilized, how the public will be informed and the process to ensure continuity of government during an emergency or disaster.

The SEP is a management document intended to be read and understood before an emergency occurs. It is designed to outline the activities of all California jurisdictions within a statewide emergency management system and it embraces the capabilities and resources in the broader emergency management community that includes individuals, businesses, non-governmental organizations, tribal governments, other states, federal government and international assistance.

The most recent SEP provided by OES is from 2009 and outlines a state-level strategy to support local government efforts during a large-scale emergency. As required by CESA, the plan describes methods for carrying out emergency operations; the process for rendering mutual aid; emergency services of governmental agencies; how resources are mobilized; emergency public information; and continuity of government.

Prior/Related Legislation

SB 949 (Jackson, 2016) authorizes the Governor to require owners and operators of critical infrastructure, as defined, to submit critical infrastructure information to OES. (Never heard in Senate Governmental Organization Committee)

AB 1346 (Gray, 2016) requires OES to update the SEP on or before January 1, 2018, and every 5 years thereafter, and would require the plan to be consistent with specified state climate adaptation strategies. (Pending in Senate Governmental Organization Committee).

AB 2595 (Linder, 2016) establishes in statute the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. (Held in Assembly Appropriations Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually.

AB 739 (Irwin, 2015) provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)

AB 1172 (Chau, 2015) continues in existence the California Cybersecurity Task Force, created in 2013 by OES and CDT. (Senate Inactive File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

Los Angeles Deputy Sheriffs

Los Angeles County Professional Peace Officers Association

Los Angeles Police Protective League

Riverside Sheriffs’ Association

OPPOSITION:

None received

ARGUMENTS IN SUPPORT: Supporters of the bill argue that, “in the past few years, retailers, financial institutions, and government agencies have increasingly fallen victim to cyberattacks. Most recently, in June 2015 the federal office of Personnel Management announced that a cybersecurity intrusion had exposed the personal information of approximately 20 million current and former federal employees and other individuals. Given the size of California’s economy and the value of its information, the State presents a prime target for similar information security breaches. The State must integrate cyber incident response policies and procedures with existing recovery and business continuity plans.”

DUAL REFERRAL: Senate Judiciary Committee

ASSEMBLY THIRD READING

ATR Bill Id:

Author:(Irwin)

As Amended Ver:April 14, 2016

Majority vote

SUMMARY: Requires the state Office of Emergency Services (OES), in conjunction with the California Department of Technology (CDT), to develop a cybersecurity incident response plan for cybersecurity attacks against critical infrastructure, and further requires OES to jointly develop cybersecurity incident response standards by January 1, 2018, with which all state agencies must report compliance by January 1, 2019. Specifically, this bill:

1. Requires, on or before July 1, 2017, OES, in conjunction with CDT, to transmit to the Legislature the Cyber Security Annex to the State Emergency Plan (SEP), a cybersecurity incident response plan also known as Emergency Function 18 (or EF 18) that includes, but is not limited to, all of the following:
   1. Methods for providing emergency services;
   2. Command structure for statewide coordinated emergency services;
   3. Emergency service roles of appropriate state agencies;
   4. Identification of resources to be mobilized;
   5. Public information plans; and,
   6. Continuity of government services.
2. Requires, on or before January 1, 2018, OES, in conjunction with CDT, to develop cybersecurity incident response standards for state agencies to prepare for cybersecurity interference with, or compromise or incapacitation of, critical infrastructure and the development of critical infrastructure information, and to transmit critical infrastructure information to OES.
3. Requires the standards developed by OES to consider all of the following factors:
   1. Costs to implement the standards;
   2. Security of critical infrastructure information;
   3. Centralized management of risk; and,
   4. National private industry best practices.
4. Requires each state agency to report to OES on its compliance with the OES cybersecurity standards, no later than January 1, 2019.
5. Requires OES, in conjunction with CDT, to provide suggestions for a state agency to improve its compliance with the OES cybersecurity standards, if any, to specified public officials.
6. Declares that a cybersecurity compliance report, and any related communication records, are confidential and may not be disclosed pursuant to the California Public Records Act.
7. Defines the terms "critical infrastructure," "critical infrastructure information," "secretary," and "state agency."
8. Makes findings and declarations relative to the importance of cybersecurity of state networks.

FISCAL EFFECT: According to the Assembly Appropriations Committee:

1. Unknown costs to OES to complete EF 18. This final piece of the emergency services response plan has been pending completion since 2011, and efforts are underway to complete it. Some additional resources may be required to support necessary hardware, software, and development of a secure database.
2. Ongoing costs to OES of approximately $1 million General Fund (GF) for data base management and Information Technology (IT) Services Division and Critical Infrastructure Protection Unit functions, once the project is complete.

COMMENTS: This bill is intended to speed the creation of a statewide cybersecurity incident response plan, also known as EF 18, and related incident response standards for state agencies, by imposing statutory deadlines for the plan, standards, and compliance reporting. This bill is author-sponsored.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0003233

Date of Hearing: May 18, 2016

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez, Chair

ABPCA Bill Id:AB 1841

Author:(Irwin) – As Amended Ver:April 14, 2016

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires the state Office of Emergency Services (OES), in conjunction with the Department of Technology (CDT), to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure (EF 18), and further requires OES and CDT to develop a comprehensive cybersecurity strategy by January 1, 2018, with which all state agencies must report compliance by January 1, 2019.

FISCAL EFFECT:

1. Unknown costs to OES to complete EF 18. This final piece of the emergency services response plan has been pending completion since 2011, and efforts are underway to complete it. Some additional resources may be required to support necessary hardware, software, and development of a secure database.
2. Ongoing costs to OES of approximately $1 million (GF) for data base management and IT Services Division and Critical Infrastructure Protection Unit functions, once the project is complete.

COMMENTS:

1. Purpose. This bill is intended to speed the creation of a statewide cybersecurity response plan, otherwise known as EF 18, and a related strategy with standards for state agencies, by imposing various statutory deadlines. According to the author, "Cybersecurity threats are on the rise and California is a priority target because of the size of our economy and the value of our networks and other assets. The state bears a responsibility in actively defending the critical networks that Californians rely on for services."
2. Background. In 2009, the California Legislature merged the powers, purposes, and responsibilities of the former OES with those of the Office of Homeland Security (OHS) into the newly- created California Emergency Management Agency (CalEMA). On July 1, 2013, Governor Edmund G. Brown Jr.’s Reorganization Plan #2 eliminated CalEMA and restored it to the Governor’s Office, renaming it the California Governor’s Office of Emergency Services (OES), and merging it with the Office of Public Safety Communications. Today, OES is responsible for overseeing and coordinating emergency preparedness, response, recovery and homeland security activities within the state.
3. State Emergency Plan (SEP). The SEP addresses the state's response to extraordinary emergency situations associated with natural disasters or human-caused emergencies. In accordance with the California Emergency Services Act, the plan describes the methods for carrying out emergency operations, the process for rendering mutual aid, the emergency services of governmental agencies, how resources are mobilized, how the public will be informed, and the process to ensure continuity of government during emergency or disaster.

The SEP, amongst other things, establishes the California Emergency Functions (CA-EFs), which consist of 18 primary activities deemed essential to addressing the emergency management needs of communities in all phases of emergency management.

1. OES and EF 18. OES, in its role as the state’s lead agency on emergency preparedness, response, and damage mitigation, has responsibility to develop, implement, and manage a comprehensive strategy to protect the critical infrastructure systems of federal and state governments, and private entities. OES meets that responsibility in part by preparing SEP.

According to OES, only EF 18 remains incomplete, and is noted as being "in development." According to a briefing document from CDT provided by the author, CDT has completed two of five steps in the development of EF 18: identifying and engaging stakeholders, and forming a working group. The three remaining steps: clarify authorities, roles and responsibilities; develop functional annex; and develop concept of operations; are listed as "work in progress." EF 18 has been pending completion since 2011.

This bill requires OES to finish EF 18 and provides deadlines for doing so.

1. Related legislation. This is one of five cybersecurity-related bills before this Committee today:
2. AB 1881 (Chang) requires the Director of CDT to develop and update mandatory baseline security controls for state networks based industry and national standards, and annually measure the state's progress towards compliance.
3. AB 2623 (Gordon) requires state agencies and entities to report their information security expenditures on an annual basis to the CDT, including the expenditure of federal grant funds for information security purposes.
4. AB 2595 (Linder) establishes the California Cybersecurity Integration Center within the Office of Emergency Services to develop a cybersecurity strategy for California, and authorizes the administration of federal homeland security grant funding by OES.
5. AB 2720 (Chau) authorizes the creation of a Cybersecurity Vulnerability Reporting Reward Program that would provide a monetary reward to eligible individuals who identify and report previously unknown vulnerabilities in state computer networks.

Analysis Prepared by: Jennifer Swenson / APPR. / (916) 319-2081

Date of Hearing: April 20, 2016

ASSEMBLY COMMITTEE ON GOVERNMENTAL ORGANIZATION

Adam Gray, Chair

ABPCA Bill Id:AB 1841 (

Author:Irwin) – As Amended Ver:April 14, 2016

SUBJECT: Cybersecurity incident response plan and standards

SUMMARY: Requires the state Office of Emergency Services (CalOES) in conjunction with the Department of Technology (CDT) to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further requires CalOES and CDT to develop a comprehensive cybersecurity strategy by January 1, 2018, with which all state agencies must report compliance by January 1, 2019. Specifically, this bill:

1. Requires, on or before July 1, 2017, CalOES and CDT to transmit to the Legislature the Cyber Security Annex to the State Emergency Plan (SEP), also known as Emergency Function 18 (or EF 18) that includes, but is not limited to, all of the following:
   1. Methods for providing emergency services;
   2. Command structure for state-wide coordinated emergency services;
   3. Emergency service roles of appropriate state agencies;
   4. Identification of resources to be mobilized;
   5. Public information plans; and,
   6. Continuity of government services.
2. Requires, on or before January 1, 2018, CalOES and CDT to develop a comprehensive state cybersecurity incident standards for state agencies to prepare for cybersecurity interference with, or compromise or incapacitation of, critical infrastructure and the development of critical infrastructure information, and to transmit critical infrastructure information to CalOES.
3. Requires the standards developed by CalOES to consider all of the following factors:
   
   1. Costs to implement the standards;
      
   2. Security of critical infrastructure information;
   3. Centralized management of risk; and,
      
   4. National private industry best practices.
      
4. Requires each state agency to report to CalOES on its compliance with the CalOES cybersecurity standards, no later than January 1, 2019.
5. Requires CalOES and CDT to provide suggestions for a state agency to improve its compliance with the CalOES cybersecurity standards, if any, to specified public officials.
6. Declares that a cybersecurity compliance report, and any related communication records, are confidential and may not be disclosed pursuant to the California Public Records Act.
7. Defines the terms "critical infrastructure," "critical infrastructure information," "secretary" and "state agency."
8. Makes findings relative to the importance of cybersecurity of state networks, and declares the intent of the Legislature to develop a comprehensive cybersecurity strategy under the coordination of CalOES.
9. Makes findings and declarations relative to the need to limit the public's right to access to the documents referenced by this bill because of the need to promote public safety by prohibiting access to those who would use that information to thwart the cybersecurity of critical infrastructure systems within the state.

EXISTING LAW:

1) Establishes CalOES by the Governor's Reorganization Plan No.2, operative July 1, 2013.

2) Requires CalOES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.

3) Specifies that the State Emergency Plan (SEP) shall be in effect in each political subdivision of the state, and the governing body of each political subdivision shall take such action as may be necessary to carry out the provisions thereof.

4) Requires the Governor to coordinate SEP and those programs necessary to mitigate the effects of an emergency.

5) Requires the Governor to coordinate the preparation of plans and programs for the mitigation of the effects of an emergency by the political subdivisions of the State of California, such plans and programs to be integrated into and coordinated with the SEP and the plans and programs of the federal government and of other states to the fullest possible extent.

6) Establishes, within the California Department of Technology (CDT), the Office of Information Security (OIS) to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.

FISCAL EFFECT: Unknown

COMMENTS:

Purpose of the bill: According to the author, "Cybersecurity threats are on the rise and California is a priority target because of the size of our economy and the value of our networks and other assets. The state bears a responsibility in actively defending the critical networks that Californians rely on for services.

"A denial of service, theft or manipulation of data, disruption or damage to critical infrastructure through a cyber-based attack could have significant impacts on national security, the economy, and the livelihood and safety of individual citizens. In the first half of 2015 alone, the Department of Homeland Security responded to 108 cyber incidents impacting US critical infrastructure: electricity, water, health care, communications, financial, and manufacturing systems, among others…

"This issue has prompted state and federal leaders to warn operators of critical infrastructure of the need to bolster cyber defenses to protect against debilitating attacks. In 2015, Governor Brown declared in an executive order on cybersecurity that 'cyber- attacks aimed at breaching and damaging computer networks and infrastructure in California represent a major security risk and increase the state’s vulnerability to economic disruption, critical infrastructure damage, privacy violations, and identity theft.

"AB 1841 will ensure sufficient preparations are taken to protect these critical infrastructure systems [, which] is a role of state government. A comprehensive cybersecurity strategy, undertaken in a coordinated effort between federal and state governments and private entities, will help prepare for cyberattacks on these critical infrastructure systems, and reduce the potential consequences from those attacks."

Background: In 2009, the California Legislature merged the powers, purposes, and responsibilities of the former OES with those of the Office of Homeland Security (OHS) into the newly- created California Emergency Management Agency (CalEMA).On July 1, 2013, Governor Edmund G. Brown Jr.’s Reorganization Plan #2 eliminated CalEMA and restored it to the Governor’s Office, renaming it the California Governor’s Office of Emergency Services (CalOES), and merging it with the Office of Public Safety Communications. Today, CalOES is responsible for overseeing and coordinating emergency preparedness, response, recovery and homeland security activities within the state.

State Emergency Plan (SEP): The SEP addresses the state's response to extraordinary emergency situations associated with natural disasters or human-caused emergencies. In accordance with the California Emergency Services Act, the plan describes the methods for carrying out emergency operations, the process for rendering mutual aid, the emergency services of governmental agencies, how resources are mobilized, how the public will be informed and the process to ensure continuity of government during and emergency or disaster.

The plan is a management document intended to be read and understood before an emergency occurs. It is designed to outline the activities of all California jurisdictions within a statewide emergency management system and it embraces the capabilities and resources in the broader emergency management community that includes individuals, businesses, non-governmental organizations, tribal governments, other states, federal government and international assistance.

The SEP, amongst other things, establishes the California Emergency Functions (CA-EFs), which consist of 18 primary activities deemed essential to addressing the emergency management needs of communities in all phases of emergency management.

Standardized Emergency Management System (SEMS): SEMS is the system used for coordinating state and local emergency response in California.  SEMS provides a multiple level emergency response organization that facilitates the flow of emergency information and resources.  SEMS consists of the Incident Command System (ICS), mutual aid, the operational area concept and multi-interagency coordination.  SEMS is designed to be flexible and adaptable to the varied emergencies that can occur in California, and to meet the emergency management needs of all responders.  Government Code 8607(a), requires CalOES, in coordination with other state agencies and interested local emergency management agencies, to establish SEMS by regulation.

Operational Area (OA): Encompasses the county and all political subdivisions within the county.  The OA serves as a focal point for all local emergency management information and the provision of mutual aid.  It manages information, resources, and priorities among local governments within the OA. The OA also serves as the coordination and communication link between the local government level and the regional level.  SEMS regulations authorize each County Board of Supervisors to designate an OA lead agency.

California Emergency Functions (CA-EFs): The CA-EFs were designed to bring together discipline-specific stakeholders at all levels of government to collaborate and function within the four phases of emergency management. At the state level, the CA-EFs consist of an alliance of state agencies, departments and other stakeholders with similar functional responsibilities. This grouping will allow each CA-EF to collaboratively mitigate, prepare for, cohesively respond to and effectively recover from an emergency.

A single state agency is assigned to lead each CA-EF based on its authorities, resources and capabilities. Each CA-EF member agency is responsible to assist in coordinating the state’s response to emergencies, including provision of mutual aid and the allocation of essential supplies and resources.

Local governments and OAs are not required to implement the CA-EF concept unless they choose to do so. Instead, CalOES recommends they organize consistent with local resources and established SEMS regulations and guidelines.

The last CA-EF in the SEP is the Cyber Security Annex, also known as Emergency Function 18 (or EF 18).

CalOES and the incomplete EF 18. Current law authorizes the Governor to take actions to prepare for, respond to, and prevent natural or human-caused emergencies that endanger life, property, and the state's resources. It further authorizes CalOES and its Director to take actions to coordinate emergency planning, preparedness, and response activities.

CalOES, in its role as the state’s lead agency on emergency preparedness, response, and damage mitigation, has responsibility to develop, implement, and manage a comprehensive strategy to protect the critical infrastructure systems of federal and state governments, and private entities. CalOES meets that responsibility in part by preparing SEP.

The most recent SEP provided by CalOES is from 2009 and outlines a state-level strategy to support local government efforts during a large-scale emergency. As required by CESA, the plan describes methods for carrying out emergency operations; the process for rendering mutual aid; emergency services of governmental agencies; how resources are mobilized; emergency public information; and continuity of government. As stated above, the 2009 SEP also establishes the CA-EFs, which consist of 18 disciplines deemed essential to the emergency management community in California.

According to the CalOES website, only EF 18 remains incomplete, and is noted as being "in development." CDT, under the Government Operations Agency, is listed as the responsible entity, with the point of contact being the State Chief Information Security Officer.

According to a briefing document from CDT provided by the author, CDT has completed two of five steps in the development of EF 18: identifying and engaging stakeholders, and forming a working group. The three remaining steps: clarify authorities, roles and responsibilities; develop functional annex; and develop concept of operations; are listed as "work in progress." EF 18 has been pending completion since 2011.

Double Referral: This bill was first heard in Assembly Committee on Privacy and Consumer Protection and passed on an 11-0 vote.

Related/Prior legislation: SB 949 (Jackson) of 2015/2016 Session. Would authorize the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Pending hearing in Senate Governmental Organizations Committee).

AB 2595 (Linder) of 2015/2016 Session. Would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. (Pending hearing in Assembly Privacy and Consumer Protection Committee)

AB 1346 (Gray) of 2015/2016 Session. Would require CalOES to update the State Emergency Plan on or before January 1, 2018, and every 5 years thereafter, and would require the plan to be consistent with specified state climate adaptation strategies. (Pending hearing in Senate Governmental Organizations Committee)

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Kenton Stanhope / G.O. / (916) 319-2531

Date of Hearing: April 5, 2016

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 1841 (

Author:Irwin) – As Amended Ver:March 28, 2016

SUBJECT: Office of Emergency Services: duties: cybersecurity

SUMMARY: Requires the state Office of Emergency Services (OES) to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further requires OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019. Specifically, this bill:

1. Requires, on or before July 1, 2017, OES to transmit to the Legislature the Cyber Security Annex to the State Emergency Plan (SEP), also known as Emergency Function 18 (or EF 18) that includes, but is not limited to, all of the following:
   1. Methods for providing emergency services;
   2. Command structure for state-wide coordinated emergency services;
   3. Emergency service roles of appropriate state agencies;
   4. Identification of resources to be mobilized;
   5. Public information plans; and,
   6. Continuity of government services.
2. Requires, on or before July 1, 2018, OES to develop a comprehensive state cybersecurity strategy setting standards for state agencies to prepare for cybersecurity interference with, or compromise or incapacitation of, critical infrastructure and the development of critical infrastructure information, and to transmit critical infrastructure information to OES.
3. Requires the standards developed by OES to consider all of the following factors:
   
   1. Costs to implement the standards;
      
   2. Security of critical infrastructure information;
   3. Centralized management of risk; and,
      
   4. National private industry best practices.
      
4. Requires OES to post the completed state cybersecurity strategy on its website.
5. Requires each state agency to report to OES on its compliance with the OES cybersecurity standards, no later than January 1, 2019.
6. Requires OES to provide suggestions for a state agency to improve its compliance with the OES cybersecurity standards, if any, to specified public officials.
7. Declares that a cybersecurity compliance report, and any related communication records, are confidential and may not be disclosed pursuant to the California Public Records Act.
8. Defines the terms "critical infrastructure," "critical infrastructure information," "secretary" and "state agency."
9. Makes findings relative to the importance of cybersecurity of state networks, and declares the intent of the Legislature to develop a comprehensive cybersecurity strategy under the coordination of OES.
10. Makes findings and declarations relative to the need to limit the public's right to access to the documents referenced by this bill because of the need to promote public safety by prohibiting access to those who would use that information to thwart the cybersecurity of critical infrastructure systems within the state.

EXISTING LAW:

1. Requires the Governor and OES, pursuant to the California Emergency Services Act (CESA), to prepare for and mitigate the effects of emergencies in the state. (Government Code (GC) 8550, et seq.
2. Requires OES, and its appointed Director, to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services. (GC 8585, 8585.1)
3. Specifies that the SEP shall be in effect in each political subdivision of the state, and the governing body of each political subdivision shall take necessary actions to carry out the provisions of the SEP. (GC 8568)
4. Requires the Governor to coordinate the SEP and those programs necessary to mitigate the effects of an emergency. (GC 8569)
5. Establishes, within the California Department of Technology (CDT), the Office of Information Security to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. (GC 11549)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill. This bill is intended to speed the creation of a statewide cybersecurity response plan, otherwise known as EF 18, and a related strategy with standards for state agencies, by imposing various statutory deadlines. This bill is author-sponsored.
2. Author's statement. According to the author, "Cybersecurity threats are on the rise and California is a priority target because of the size of our economy and the value of our networks and other assets. The state bears a responsibility in actively defending the critical networks that Californians rely on for services.
   
   "A denial of service, theft or manipulation of data, disruption or damage to critical infrastructure through a cyber-based attack could have significant impacts on national security, the economy, and the livelihood and safety of individual citizens. In the first half of 2015 alone, the Department of Homeland Security responded to 108 cyber incidents impacting US critical infrastructure: electricity, water, health care, communications, financial, and manufacturing systems, among others…
   
   "This issue has prompted state and federal leaders to warn operators of critical infrastructure of the need to bolster cyber defenses to protect against debilitating attacks. In 2015, Governor Brown declared in an executive order on cybersecurity that 'cyber- attacks aimed at breaching and damaging computer networks and infrastructure in California represent a major security risk and increase the state’s vulnerability to economic disruption, critical infrastructure damage, privacy violations, and identity theft.

"AB 1841 will ensure sufficient preparations are taken to protect these critical infrastructure systems [, which] is a role of state government. A comprehensive cybersecurity strategy, undertaken in a coordinated effort between federal and state governments and private entities, will help prepare for cyberattacks on these critical infrastructure systems, and reduce the potential consequences from those attacks."

1. OES and the incomplete EF 18. CESA authorizes the Governor to take actions to prepare for, respond to, and prevent natural or human-caused emergencies that endanger life, property, and the state's resources. It further authorizes OES and its Director to take actions to coordinate emergency planning, preparedness, and response activities.
   
   OES, in its role as the state’s lead agency on emergency preparedness, response, and damage mitigation, has responsibility to develop, implement, and manage a comprehensive strategy to protect the critical infrastructure systems of federal and state governments, and private entities. OES meets that responsibility in part by preparing SEP.
   
   The most recent SEP provided by OES is from 2009 and outlines a state-level strategy to support local government efforts during a large-scale emergency. As required by CESA, the plan describes methods for carrying out emergency operations; the process for rendering mutual aid; emergency services of governmental agencies; how resources are mobilized; emergency public information; and continuity of government.

The 2009 SEP also establishes the California Emergency Functions which consist of 18 disciplines deemed essential to the emergency management community in California. Led by a State agency, each Emergency Function is designed to bring together discipline-specific stakeholders to collaborate and function within the four phases of emergency management: mitigation, preparedness, response, and recovery.
At the state level, the Emergency Functions consist of an alliance of state agencies, departments, and other stakeholders with similar discipline-specific responsibilities.

According to the OES website, only EF 18 remains incomplete, and is noted as being "in development." CDT, under the Government Operations Agency, is listed as the responsible entity, with the point of contact being the State Chief Information Security Officer.

According to a briefing document from CDT provided by the author, CDT has completed two of five steps in the development of EF 18: identifying and engaging stakeholders, and forming a working group. The three remaining steps: clarify authorities, roles and responsibilities; develop functional annex; and develop concept of operations; are listed as "work in progress."

1. This bill in practice. As noted above, AB 1841 is primarily intended to speed the adoption of EF 18 by placing a July 1, 2017, deadline on its development and transmittal to the Legislature.
   
   However, the bill has a number of other elements. It would also require OES to develop a broad cybersecurity strategy for critical infrastructure by July 1, 2018, and state agencies would be required to report their compliance with the standards set forth in that strategy document by January 1, 2019. The completed EF 18 and the related OES strategy documents would all be posted publicly online once complete, although the compliance reports from the individual state agencies would be kept confidential for security reasons.
2. Related legislation. SB 949 (Jackson) would authorize the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. SB 949 is pending hearing in the Senate Governmental Organizations Committee.
3. Double referral. This bill is double-referred to the Assembly Governmental Organization Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200