AB 670: Information technology security.
- Session Year: 2015-2016
- House: Assembly
- Latest Version Date: 2015-10-06
(1)Existing law establishes, within the Government Operations Agency, the Department of Technology under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. The department is generally responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes, within the department, the Office of Information Security under the supervision of the Chief of the Office of Information Security. Existing law sets forth the authority of the office, including, but not limited to, the authority to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.
This bill would additionally require the office, in consultation with the Office of Emergency Services, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of an independent security assessment. The bill would require the state agency, department, or office being assessed to fund the costs of its independent security assessment. The bill would require the office and the Office of Emergency Services to receive the complete results of an independent security assessment. The bill would prohibit, during the process of conducting an independent security assessment, the disclosure of information and records concerning the independent security assessment, except that the information and records would be authorized to be transmitted to state employees and state contractors with specific duties relating to the independent security assessment. The bill would require the disclosure of the results of a completed independent security assessment under state law.
This bill would require the office, in consultation with the Office of Emergency Services, to rank state entities on an information security risk index, as specified. The bill would require the office to report to the Department of Technology and the Office of Emergency Services any state entity found noncompliant with information security requirements. The bill would further require the office to notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice of any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. The bill would authorize the office to conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which to be funded by the state agency, department, or office being audited.
This bill would authorize the Military Department to perform an independent security assessment as described above.
This bill would require state entities, as defined, rather than certain information security officers, to comply with policies and procedures issued by the office. The bill would also make technical, nonsubstantive changes.
(2)Existing law requires that a statute that limits the publics right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
This bill would limit access to information and records of an ongoing independent security assessment and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
(1)Existing law establishes, within the Government Operations Agency, the Department of Technology under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. The department is generally responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes, within the department, the Office of Information Security under the supervision of the Chief of the Office of Information Security. Existing law sets forth the authority of the office, including, but not limited to, the authority to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.
This bill would additionally require the office, in consultation with the Office of Emergency Services, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of an independent security assessment. The bill would require the state agency, department, or office being assessed to fund the costs of its independent security assessment. The bill would require the office and the Office of Emergency Services to receive the complete results of an independent security assessment. The bill would prohibit, during the process of conducting an independent security assessment, the disclosure of information and records concerning the independent security assessment, except that the information and records would be authorized to be transmitted to state employees and state contractors with specific duties relating to the independent security assessment. The bill would require the disclosure of the results of a completed independent security assessment under state law.
This bill would require the office, in consultation with the Office of Emergency Services, to rank state entities on an information security risk index, as specified. The bill would require the office to report to the Department of Technology and the Office of Emergency Services any state entity found noncompliant with information security requirements. The bill would further require the office to notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice of any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. The bill would authorize the office to conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which to be funded by the state agency, department, or office being audited.
This bill would authorize the Military Department to perform an independent security assessment as described above.
This bill would require state entities, as defined, rather than certain information security officers, to comply with policies and procedures issued by the office. The bill would also make technical, nonsubstantive changes.
(2)Existing law requires that a statute that limits the publics right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
This bill would limit access to information and records of an ongoing independent security assessment and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
(1)Existing law establishes, within the Government Operations Agency, the Department of Technology under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. The department is generally responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes, within the department, the Office of Information Security under the supervision of the Chief of the Office of Information Security. Existing law sets forth the authority of the office, including, but not limited to, the authority to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office office, the cost of which is to be funded by the state agency, department, or office being assessed.
This bill would, instead, impose a duty on the office to require it to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every 2 years and would maintain the requirement that the state agency, department, or office being assessed fund the costs of the independent security assessment. This bill would require an independent security assessment to include specific components, to the extent practicable, and authorize the department to require a state agency, department, or office not in compliance with any recommendation made in the independent security assessment to redirect its available and authorized funds to pay the costs of complying with the recommendation.
This bill would require the results of an independent security assessment to be available only to the state agency, department, or office that was assessed. This bill would restrict the transmission or communication of the results of an independent security assessment and any related information to state government employees and state contractors who have been approved as necessary to receive this information in order to perform the assessment. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the aggregate of the results of an independent security assessment to be transmitted to the department.
This bill would require the results of an independent security assessment, the aggregate of the results of an independent security assessment transmitted to the department, and any related information to be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act, including provisions of the act that exclude from the disclosure requirements, certain security records that reveal the vulnerabilities of an information technology system. This bill would require data produced during the creation of an independent security assessment to be destroyed within 1 year of its date of creation, unless the Office of Emergency Services determines that retention for a longer period of time is necessary for state security.
This bill would additionally require the office, in consultation with the Office of Emergency Services, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of an independent security assessment. The bill would require the state agency, department, or office being assessed to fund the costs of its independent security assessment. The bill would require the office and the Office of Emergency Services to receive the complete results of an independent security assessment. This bill would prohibit, during the process of conducting an independent security assessment, the disclosure of information and records concerning the independent security assessment, except that the information and records would be authorized to be transmitted to state employees and state contractors with specific duties relating to the independent security assessment. The bill would require the disclosure of the results of a completed independent security assessment under state law.
This bill would require the office, in consultation with the Office of Emergency Services, to rank state entities on an information security risk index, as specified. The bill would require the office to report to the Department of Technology and the Office of Emergency Services any state entity found noncompliant with information security requirements. The bill would further require the office to notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice of any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. The bill would authorize the office to conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which to be funded by the state agency, department, or office being audited.
This bill would also authorize the Military Department to perform an independent security assessment as described above. This bill would authorize the Military Department to mitigate the impact of a cyber attack or assist a law enforcement investigation into cyber security upon the request of the Office of Emergency Services, a state law enforcement agency, or a state agency, department, or office. This bill would further authorize the Military Department to perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of the Office of Emergency Services.
This bill would require state entities, as defined, rather than certain information security officers, to comply with policies and procedures issued by the office. The bill would also make technical, nonsubstantive changes.
(2)Existing law requires that a statute that limits the publics right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
This bill would limit access to the results information and records of an ongoing independent security assessment and related records and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
(1)Existing law establishes, within the Government Operations Agency, the Department of Technology under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. The department is generally responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes, within the department, the Office of Information Security under the supervision of the Chief of the Office of Information Security. Existing law sets forth the authority of the office, including, but not limited to, the authority to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office the cost of which is to be funded by the state agency, department, or office being assessed.
This bill would, instead, impose a duty on the office to require it to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every 2 years and would maintain the requirement that the state agency, department, or office being assessed fund the costs of the independent security assessment. This bill would require an independent security assessment to include specific components, to the extent possible, practicable, and authorize the department to require a state agency, department, or office not in compliance with any recommendation made in the independent security assessment to redirect its available and authorized funds to pay the costs of complying with the recommendation.
This bill would require the results of an independent security assessment to be available only to the state agency, department, or office that was assessed. This bill would restrict the transmission or communication of the results of an independent security assessment and any related information to state government employees and state contractors who have been approved as necessary to receive this information in order to perform the assessment. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the aggregate of the results of an independent security assessment to be transmitted to the department.
This bill would deem require the results of an independent security assessment, the aggregate of the results of an independent security assessment transmitted to the department, and any related information as confidential and prohibit their disclosure to be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act. Act, including provisions of the act that exclude from the disclosure requirements, certain security records that reveal the vulnerabilities of an information technology system. This bill would require data produced during the creation of an independent security assessment to be destroyed within 1 year of its date of creation, unless the Office of Emergency Services determines that retention for a longer period of time is necessary for state security.
This bill would also authorize the Military Department to perform an independent security assessment as described above. This bill would authorize the Military Department to mitigate the impact of a cyber attack or assist a law enforcement investigation into cyber security upon the request of the Office of Emergency Services, a state law enforcement agency, or a state agency, department, or office. This bill would further authorize the Military Department to perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of the Office of Emergency Services.
(2)Existing law requires that a statute that limits the publics right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
This bill would limit access to the results of an independent security assessment and related records and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
Existing
(1)Existing law establishes establishes, within the Government Operations Agency, the Department of Technology within the Government Operations Agency, headed by under the supervision of the Director of Technology Technology, who is also known as the State Chief Information Officer. The department is generally responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes establishes, within the department, the Office of Technology Services within the department, Information Security under the supervision of the Chief of the Office of Technology Services, and Information Security. Existing law sets forth its duties, the authority of the office, including, but not limited to, the authority to conduct conduct, or require a to be conducted, an independent security assessment of any state agency, as prescribed. department, or office the cost of which is to be funded by the state agency, department, or office being assessed.
This bill would, instead, impose a duty on the office to require the office it to conduct, or require, an require to be conducted, an independent security assessment of every state agency agency, department, or office at least once every 2 years and would require maintain the requirement that the state agency agency, department, or office being audited to pay assessed fund the costs of the independent security assessment. The This bill would require an independent security assessment to include specific components, to the extent possible, and authorize the department to require agencies that are a state agency, department, or office not in compliance with any recommendation made in the independent security assessment to redirect its available funding and authorized funds to pay the costs of the assessments. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department. complying with the recommendation.
This bill would authorize the Governors Office of Emergency Services to conduct the strategic direction of security assessments performed by the Military Departments Computer Network Defense Team, and would require those assessments to contain certain elements.
This bill would require the results of an independent security assessment to be available only to the state agency, department, or office that was assessed. This bill would restrict the transmission or communication of the results of an independent security assessment and any related information to state government employees and state contractors who have been approved as necessary to receive this information in order to perform the assessment. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the aggregate of the results of an independent security assessment to be transmitted to the department.
This bill would deem the results of an independent security assessment, the aggregate of the results of an independent security assessment transmitted to the department, and any related information as confidential and prohibit their disclosure pursuant to any state law, including, but not limited to, the California Public Records Act. This bill would require data produced during the creation of an independent security assessment to be destroyed within 1 year of its date of creation, unless the Office of Emergency Services determines that retention for a longer period of time is necessary for state security.
This bill would also authorize the Military Department to perform an independent security assessment as described above. This bill would authorize the Military Department to mitigate the impact of a cyber attack or assist a law enforcement investigation into cyber security upon the request of the Office of Emergency Services, a state law enforcement agency, or a state agency, department, or office. This bill would further authorize the Military Department to perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of the Office of Emergency Services.
Existing
(2)Existing law requires that a statute that limits the publics right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
This bill would limit access to the results of an independent security assessment results, and related records and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
Existing law establishes the Department of Technology within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. The department is responsible for the approval and oversight of information technology projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes the Office of Technology Services within the department, under the supervision of the Chief of the Office of Technology Services, and sets forth its duties, including, but not limited to, the authority to conduct or require a security assessments assessment of any state agency, as prescribed.
This bill would, instead, require the office to conduct, or require, an assessment of every state agency at least once every 2 years and would require the state agency being audited to pay the costs of the security assessment. The bill would authorize the department to require agencies that are not in compliance to redirect available funding to pay the costs of the assessments. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department.
This bill would authorize the department and the Governors Office of Emergency Services to jointly conduct the strategic direction of risk security assessments performed by the Military Departments Computer Network Defense Team, and would require those assessments to contain certain elements.
Existing law requires that a statute that limits the publics right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
This bill would limit access to security assessment results, and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
Existing law establishes the Department of Technology within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. The department is responsible for the approval and oversight of information technology projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Existing law establishes the Office of Technology Services within the department, under the supervision of the Chief of the Office of Technology Services, and sets forth its duties, including, but not limited to, the authority to conduct or require a security assessments of any state agency, as prescribed.
This bill would, instead, require the office to conduct, or require, an assessment of every state agency at least once every 2 years and would require the state agency being audited to pay the costs of the security assessment. The bill would authorize the department to require agencies that are not in compliance to redirect available funding to pay the costs of the assessments. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department.
This bill would authorize the department and the Governors Office of Emergency Services to jointly conduct the strategic direction of risk assessments performed by the Military Departments Computer Network Defense Team.
(a)The chief shall establish an information security program. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the office.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each state agencys disaster recovery plan.
(5)Coordination of the activities of state agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)All state entities defined in Section 11546.1 shall implement the policies and procedures issued by the office, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the office.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by the office.
(c)(1)The office may conduct, or require to be conducted, an independent security assessment of every state agency, department, or office. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed.
(2)In addition to the independent security assessments authorized by paragraph (1), the office, in consultation with the Office of Emergency Services, shall perform all the following duties:
(A)Annually require no fewer than thirty-five (35) state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.
(B)Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, analysis of the relative amount of the following factors within state agencies:
(i)Personally identifiable information protected by law.
(ii)Health information protected by law.
(iii)Confidential financial data.
(iv)Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:
(I)Information asset management.
(II)Risk management.
(III)Information security program management.
(IV)Information security incident management.
(V)Technology recovery planning.
(C)Determine the basic standards of services to be performed as part of independent security assessments required by this subdivision.
(3)The Military Department may perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.
(d)State agencies and entities required to conduct or receive an independent security assessment pursuant to subdivision (c) shall transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the office and the Office of Emergency Services.
(e)The office shall report to the Department of Technology and the Office of Emergency Services any state entity found to be noncompliant with information security program requirements.
(f) (1)Notwithstanding any other law, during the process of conducting an independent security assessment pursuant to subdivision (c), information and records concerning the independent security assessment are confidential and shall not be disclosed, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity.
(2)The results of a completed independent security assessment performed pursuant to subdivision (c), and any related information shall be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1), including, but not limited to, Section 6254.19.
(g)The office may conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited.
(h)The office shall notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The state has a very strong interest in protecting its information technology systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government. Thus, information regarding the specific vulnerabilities of those systems must be protected to preclude use of that information to facilitate attacks on those systems.
(a)The chief shall establish an information security program. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the office.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each state agencys disaster recovery plan.
(5)Coordination of the activities of state agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)All state entities defined in Section 11546.1 shall implement the policies and procedures issued by the office, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the office.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by the office.
(c)(1)The office may conduct, or require to be conducted, an independent security assessment of every state agency, department, or office. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed.
(2)In addition to the independent security assessments authorized by paragraph (1), the office, in consultation with the Office of Emergency Services, shall perform all the following duties:
(A)Annually require no fewer than thirty-five (35) state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.
(B)Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, analysis of the relative amount of the following factors within state agencies:
(i)Personally identifiable information protected by law.
(ii)Health information protected by law.
(iii)Confidential financial data.
(iv)Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:
(I)Information asset management.
(II)Risk management.
(III)Information security program management.
(IV)Information security incident management.
(V)Technology recovery planning.
(C)Determine the basic standards of services to be performed as part of independent security assessments required by this subdivision.
(3)The Military Department may perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.
(d)State agencies and entities required to conduct or receive an independent security assessment pursuant to subdivision (c) shall transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the office and the Office of Emergency Services.
(e)The office shall report to the Department of Technology and the Office of Emergency Services any state entity found to be noncompliant with information security program requirements.
(f) (1)Notwithstanding any other law, during the process of conducting an independent security assessment pursuant to subdivision (c), information and records concerning the independent security assessment are confidential and shall not be disclosed, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity.
(2)The results of a completed independent security assessment performed pursuant to subdivision (c), and any related information shall be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1), including, but not limited to, Section 6254.19.
(g)The office may conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited.
(h)The office shall notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The state has a very strong interest in protecting its information technology systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government. Thus, information regarding the specific vulnerabilities of those systems must be protected to preclude use of that information to facilitate attacks on those systems.
(a)The director chief shall establish an information security program. The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the Office of Information Security. office.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each state agencys disaster recovery plan.
(5)Coordination of the activities of state agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)An information security officer appointed pursuant to All state entities defined in Section 11546.1 shall implement the policies and procedures issued by the Office of Information Security, office, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the Office of Information Security. office.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by policy or directives of the office.
(c)(1)The office shall may conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every two years.. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed. The independent security assessment shall include, to the extent practicable, all of the following components and shall be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls:
(A)Vulnerability scanning, that includes, but is not limited to, all of the following:
(i)Validation that IT systems have currently supported software, with all necessary security patches and updates applied.
(ii)Validation that system security configurations are in compliance with NIST standards.
(iii)Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
(B)Penetration testing, when determined appropriate by the Office of Emergency Services.
(C)A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
(2)(A)The Military Department may perform an independent security assessment required by paragraph (1).
(B)The Military Department may mitigate the impact of a cyber attack or assist a law enforcement investigation into cyber security upon the request of the Office of Emergency Services, a state law enforcement agency, or a state agency, department, or office.
(C)The Military Department may perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of the Office of Emergency Services.
(d)The Department of Technology may require a state agency, department, or office to redirect any funds within its budget that may be legally expended for these purposes, to pay the costs of becoming compliant with any recommendation made in an independent security assessment.
(e)
(2)In addition to the independent security assessments authorized by paragraph (1), the office, in consultation with the Office of Emergency Services, shall perform all the following duties:
(A)Annually require no fewer than thirty-five (35) state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.
(B)Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, analysis of the relative amount of the following factors within state agencies:
(i)Personally identifiable information protected by law.
(ii)Health information protected by law.
(iii)Confidential financial data.
(iv)Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:
(I)Information asset management.
(II)Risk management.
(III)Information security program management.
(IV)Information security incident management.
(V)Technology recovery planning.
(C)Determine the basic standards of services to be performed as part of independent security assessments required by this subdivision.
(3)The Military Department may perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.
(d)(1)The office, Military Department, or entity State agencies and entities required to conduct or receive an independent security assessment pursuant to subdivision (c) shall transmit the complete results of that assessment only to the state agency, department, or office that was the subject of that assessment. and recommendations for mitigating system vulnerabilities, if any, to the office and the Office of Emergency Services.
(e)The office shall report to the Department of Technology and the Office of Emergency Services any state entity found to be noncompliant with information security program requirements.
(2)The office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) shall transmit an aggregate of the results of that assessment to the Department of Technology.
(3)The Department of Technology shall adopt standards, to be included within the State Administrative Manual, setting forth the requirements for the office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) to transmit, pursuant to paragraph (2), the aggregate of the results of that assessment to the Department of Technology, including, but not limited to, all of the following:
(A)Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.
(B)Prioritization of vulnerabilities.
(C)Identification of relevant internal resources.
(D)Strategy for addressing and mitigating those vulnerabilities.
(f) (1)Transmission or communication of the results of an independent security assessment performed pursuant to subdivision (c) and any related information shall be restricted toNotwithstanding any other law, during the process of conducting an independent security assessment pursuant to subdivision (c), information and records concerning the independent security assessment are confidential and shall not be disclosed, except that the information and records may be transmitted to state government employees and state contractors who have been approved as necessary to receive this the information in order and records to perform that independent security assessment by the office, Military Department, or entity required to conduct the independent security assessment., subsequent remediation activity, or monitoring of remediation activity.
(2)The results of an a completed independent security assessment performed pursuant to subdivision (c), the aggregate of the results of an independent security assessment transmitted to the Department of Technology pursuant to subdivision (e), and any related information shall be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1), including, but not limited to, Section 6254.19.
(3)Data produced during the creation of an independent security assessment performed pursuant to subdivision (c) shall be destroyed within one year of its date of creation, unless the Office of Emergency Services determines that retention for a longer period of time is necessary for state security.
(g)The office may conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited.
(h)The office shall notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The state has a very strong interest in protecting its information technology systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government. Thus, information regarding the specific vulnerabilities of those systems must be protected to preclude use of that information to facilitate attacks on those systems.
(a)The director shall establish an information security program. The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the Office of Information Security.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each agencys disaster recovery plan.
(5)Coordination of the activities of agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)An information security officer appointed pursuant to Section 11546.1 shall implement the policies and procedures issued by the Office of Information Security, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the Office of Information Security.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by policy or directives of the office.
(c)(1)The office shall conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every two years. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed. The independent security assessment shall include, to the extent practicable, all of the following components and shall be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls:
(A)Vulnerability scanning, that includes, but is not limited to, all of the following:
(i)Validation that IT systems have currently supported software, with all necessary security patches and updates applied.
(ii)Validation that system security configurations are in compliance with NIST standards.
(iii)Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
(B)Penetration testing, when determined appropriate by the Offices Office of Emergency Services.
(C)A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
(2)(A)The Military Department may perform an independent security assessment required by paragraph (1).
(B)The Military Department may mitigate the impact of a cyber attack or assist a law enforcement investigation into cyber security upon the request of the Office of Emergency Services, a state law enforcement agency, or a state agency, department, or office.
(C)The Miliary Military Department may perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of the Office of Emergency Services.
(d)The Department of Technology may require a state agency, department, or office to redirect any funds within its budget that may be legally expended for these purposes, to pay the costs of becoming compliant with any recommendation made in an independent security assessment.
(e)(1)The office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) shall transmit the results of that assessment only to the state agency, department, or office that was the subject of that assessment.
(2)The office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) shall transmit an aggregate of the results of that assessment to the Department of Technology.
(3)The Department of Technology shall adopt standards, to be included within the State Administrative Manual, setting forth the requirements for the office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) to transmit, pursuant to paragraph (2), the aggregate of the results of that assessment to the Department of Technology, including, but not limited to, all of the following:
(A)Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.
(B)Prioritization of vulnerabilities.
(C)Identification of relevant internal resources.
(D)Strategy for addressing and mitigating those vulnerabilities.
(f)(1)Transmission or communication of the results of an independent security assessment performed pursuant to subdivision (c) and any related information shall be restricted to state government employees and state contractors who have been approved as necessary to receive this information in order to perform that assessment by the office, Military Department, or entity required to conduct the independent security assessment.
(2)The results of an independent security assessment performed pursuant to subdivision (c), the aggregate of the results of an independent security assessment transmitted to the Department of Technology pursuant to subdivision (e), and any related information are confidential and shall not be disclosed shall be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1). 1), including, but not limited to, Section 6254.19.
(3)Data produced during the creation of an independent security assessment performed pursuant to subdivision (c) shall be destroyed within one year of its date of creation, unless the Office of Emergency Services determines that retention for a longer period of time is necessary for state security.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The state has a very strong interest in protecting its information technology systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government. Thus, information regarding the specific vulnerabilities of those systems must be protected to preclude use of that information to facilitate attacks on those systems.
(a)The director shall establish an information security program. The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the Office of Information Security.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each agencys disaster recovery plan.
(5)Coordination of the activities of agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)An information security officer appointed pursuant to Section 11546.1 shall implement the policies and procedures issued by the Office of Information Security, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the Office of Information Security.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by policy or directives of the office.
(c)(1)The office shall conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every two years. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed. The assessment results shall be made available only to the assessed entity. The independent security assessment shall include, to the extent practicable, all of the following components, which components and shall be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls:
(1)
(A)Vulnerability scanning, that includes, but is not limited to, all of the following:
(A)
(i)Validation that IT systems have currently supported software, with all necessary security patches and updates applied.
(B)
(ii)Validation that system security configurations are in compliance with NIST standards.
(C)
(iii)Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
(2)
(B)Penetration testing, when determined appropriate by the Governors Offices of Emergency Services.
(3)
(C)A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
(2)(A)The Military Department may perform an independent security assessment required by paragraph (1).
(B)The Military Department may mitigate the impact of a cyber attack or assist a law enforcement investigation into cyber security upon the request of the Office of Emergency Services, a state law enforcement agency, or a state agency, department, or office.
(C)The Miliary Department may perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of the Office of Emergency Services.
(d)The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements.
(e)
(d)The Department of Technology may require that any agency in noncompliance with subdivision (c) a state agency, department, or office to redirect any funds within the agencys budget, its budget that may be legally expended for these purposes, for the purposes of paying to pay the costs of compliance becoming compliant with subdivision (c). any recommendation made in an independent security assessment.
(f)The Governors Office of Emergency Services may conduct the strategic direction of security assessments performed by the Military Departments Computer Network Defense Team, as budgeted in Item 8940-001-0001 of the Budget Act of 2014. Each assessment shall include all of the following:
(1)Contracting and negotiations with state agencies, departments, and offices, or private entities to be assessed.
(2)Setting an assessment calendar to be followed by the CNDT.
(3)Prioritizing of incident response.
(e)(1)The office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) shall transmit the results of that assessment only to the state agency, department, or office that was the subject of that assessment.
(2)The office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) shall transmit an aggregate of the results of that assessment to the Department of Technology.
(g)
(3)The Department of Technology shall adopt standards, to be included within the State Administrative Manual, setting forth the manner requirements for the assessed agency to communicate the office, Military Department, or entity required to conduct an independent security assessment pursuant to subdivision (c) to transmit, pursuant to paragraph (2), the aggregate of the results of that assessment results to the department, Department of Technology, including, but not limited to, all of the following:
(1)
(A)Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.
(2)
(B)Prioritization of vulnerabilities.
(3)
(C)Identification of relevant internal resources.
(4)
(D)Strategy for addressing and mitigating those vulnerabilities.
(h)Communication of assessment results shall be restricted to only approved government employees and validated contractors. Assessment results and related aggregated reports shall be confidential and, pursuant to Section 6254.19, shall be exempt from disclosure under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1).
(i)Data produced by assessments shall be retained by all parties for no longer than one year, unless the Governors Office of Emergency Services determines that retention for a longer period is necessary.
(f)(1)Transmission or communication of the results of an independent security assessment performed pursuant to subdivision (c) and any related information shall be restricted to state government employees and state contractors who have been approved as necessary to receive this information in order to perform that assessment by the office, Military Department, or entity required to conduct the independent security assessment.
(2)The results of an independent security assessment performed pursuant to subdivision (c), the aggregate of the results of an independent security assessment transmitted to the Department of Technology pursuant to subdivision (e), and any related information are confidential and shall not be disclosed pursuant to any state law, including, but not limited to, the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1).
(3)Data produced during the creation of an independent security assessment performed pursuant to subdivision (c) shall be destroyed within one year of its date of creation, unless the Office of Emergency Services determines that retention for a longer period of time is necessary for state security.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The state has a very strong interest in protecting its information technology systems from intrusion, because those systems contain confidential information and play a critical role in assisting the entities the performance of the duties of state government in carrying out their duties. government. Thus, information regarding the specific vulnerabilities of those systems should be must be protected at least until those vulnerabilities have been remediated so as to preclude use of that information to facilitate attacks on those systems.
(a)The director shall establish an information security program. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the Office of Information Security.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each agencys disaster recovery plan.
(5)Coordination of the activities of agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)An information security officer appointed pursuant to Section 11546.1 shall implement the policies and procedures issued by the Office of Information Security, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the Office of Information Security.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by policy or directives of the office.
(c) The office shall conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every two years. The cost of the security assessment shall be funded by the state agency, department, or office being assessed. The assessment results shall be made available only to the assessed entity. The assessment shall include, at a minimum, to the extent practicable, all of the following components, which shall be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls:
(1)A legal, policy, standards, and procedure compliance review.
(2)
(1)Vulnerability scanning. scanning, that includes, but is not limited to, all of the following:
(A)Validation that IT systems have currently supported software, with all necessary security patches and updates applied.
(B)Validation that system security configurations are in compliance with NIST standards.
(C)Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
(3)
(2)Penetration testing. testing, when determined appropriate by the Governors Offices of Emergency Services.
(3)A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
(d)The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements.
(e)The Department of Technology may require that any agency in noncompliance with subdivision (c) redirect any funds within the agencys budget, that may be legally expended for these purposes, for the purposes of paying the costs of compliance with subdivision (c).
(f)The Department of Technology and the Governors Office of Emergency Services may jointly conduct the strategic direction of risk security assessments performed by the Military Departments Computer Network Defense Team, as budgeted in Item 8940-001-0001 of the Budget Act of 2014. Each assessment shall include all of the following:
(1)Contracting and negotiations with state agencies, departments, and offices, or private entities to be assessed.
(2)Setting an assessment calendar to be followed by the CNDT.
(3)Prioritizing of incident response.
(g)The Department of Technology shall adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department, including, but not limited to, all of the following:
(1)Identification of vulnerabilities.
(1)Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.
(2)Prioritization of vulnerabilities.
(3)Identification of relevant internal resources.
(4)Strategy for addressing and mitigating those vulnerabilities.
(h)Communication of assessment results shall be restricted to only approved government employees and validated contractors. Assessment results and related aggregated reports shall be confidential and, pursuant to Section 6254.19, shall be exempt from disclosure under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1).
(i)Data produced by assessments shall be retained by all parties for no longer than one year, unless the Governors Office of Emergency Services determines that retention for a longer period is necessary.
SEC. 2.The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the publics right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
The state has a very strong interest in protecting its information technology systems from intrusion, because those systems play a critical role in assisting the entities of state government in carrying out their duties. Thus, information regarding the specific vulnerabilities of those systems should be protected at least until those vulnerabilities have been remediated so as to preclude use of that information to facilitate attacks on those systems.
(a)The director shall establish an information security program. The program responsibilities include, but are not limited to, all of the following:
(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.
(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:
(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.
(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the Office of Information Security.
(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.
(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each agencys disaster recovery plan.
(5)Coordination of the activities of agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.
(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.
(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.
(b)An information security officer appointed pursuant to Section 11546.1 shall implement the policies and procedures issued by the Office of Information Security, including, but not limited to, performing both of the following duties:
(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the Office of Information Security.
(2)Comply with filing requirements and incident notification by providing timely information and reports as required by policy or directives of the office.
(c)(1)Except as provided in paragraph (2), the office may The office shall conduct, or require to be conducted, an independent security assessments assessment of any every state agency, department, or office, the office at least once every two years. The cost of which the security assessment shall be funded by the state agency, department, or office being assessed. The assessment shall include, at a minimum, all of the following components, which shall be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls:
(1)A legal, policy, standards, and procedure compliance review.
(2)Vulnerability scanning.
(3)Penetration testing.
(2)The office shall not conduct, or require to be conducted, independent security assessments of the Department of Forestry and Fire Prevention.
(d)The office may require an audit of information security to ensure program compliance, the cost of which shall be funded by the state agency, department, or office being audited.
(e)
(d)The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements.
(e)The Department of Technology may require that any agency in noncompliance with subdivision (c) redirect any funds within the agencys budget, that may be legally expended for these purposes, for the purposes of paying the costs of compliance with subdivision (c).
(f)The Department of Technology and the Governors Office of Emergency Services may jointly conduct the strategic direction of risk assessments performed by the Military Departments Computer Network Defense Team, as budgeted in Item 8940-001-0001 of the Budget Act of 2014.
(g)The Department of Technology shall adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department, including, but not limited to, all of the following:
(1)Identification of vulnerabilities.
(2)Prioritization of vulnerabilities.
(3)Identification of relevant internal resources.
(4)Strategy for addressing and mitigating those vulnerabilities.
|
Date
|
Status
|
|---|---|
| Sep 8, 2015 | Read third time. Passed. Ordered to the Assembly. (Ayes 39. Noes 0. Page 2594.). |
| Jul 13, 2015 | In committee: Hearing postponed by committee. |
| Aug 17, 2015 | In committee: Referred to APPR. suspense file. |
| Aug 27, 2015 | From committee: Do pass. (Ayes 6. Noes 0.) (August 27). |
| Aug 31, 2015 | Read second time. Ordered to third reading. |
| Sep 3, 2015 | Read third time and amended. Ordered to second reading. |
| Sep 4, 2015 | Read second time. Ordered to third reading. |
| Sep 8, 2015 | In Assembly. Concurrence in Senate amendments pending. May be considered on or after September 10 pursuant to Assembly Rule 77. |
| Sep 8, 2015 | Read third time. Passed. Ordered to the Assembly. |
| Jun 30, 2015 | Withdrawn from committee. |
| Sep 9, 2015 | Assembly Rule 77 suspended. |
| Sep 9, 2015 | Assembly Rule 77 suspended. (Page 2990.) |
| Sep 9, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. |
| Sep 9, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 79. Noes 0. Page 3000.). |
| Sep 9, 2015 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 79. Noes 0.). |
| Sep 18, 2015 | Enrolled and presented to the Governor at 4 p.m. |
| Oct 6, 2015 | Approved by the Governor. |
| Oct 6, 2015 | Chaptered by Secretary of State - Chapter 518, Statutes of 2015. |
| May 28, 2015 | Read second time. Ordered to third reading. |
| Feb 26, 2015 | From printer. May be heard in committee March 28. |
| Mar 9, 2015 | Referred to Com. on P. & C.P. |
| Apr 6, 2015 | From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended. |
| Apr 7, 2015 | Re-referred to Com. on P. & C.P. |
| Apr 8, 2015 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 11. Noes 0.) (April 7). Re-referred to Com. on APPR. |
| May 20, 2015 | In committee: Set, first hearing. Referred to suspense file. |
| May 20, 2015 | In committee: Set, first hearing. Referred to APPR. suspense file. |
| May 28, 2015 | From committee: Do pass. (Ayes 17. Noes 0.) (May 28). |
| Feb 25, 2015 | Read first time. To print. |
| Jun 2, 2015 | In Senate. Read first time. To Com. on RLS. for assignment. |
| Jun 2, 2015 | Read third time. Passed. Ordered to the Senate. |
| Jun 2, 2015 | Read third time. Passed. Ordered to the Senate. (Ayes 79. Noes 0. Page 1771.) |
| Jun 11, 2015 | Referred to Coms. on G.O. and JUD. |
| Jun 15, 2015 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on G.O. |
| Jun 23, 2015 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on G.O. |
| Jun 29, 2015 | From committee: Do pass and re-refer to Com. on JUD. (Ayes 12. Noes 0.) (June 29). Re-referred to Com. on JUD. |
| Jun 30, 2015 | Re-referred to Com. on APPR. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Sep 9, 2015 | AB 670 IRWIN Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Sep 8, 2015 | Assembly 3rd Reading AB670 Irwin By Hill | Senate Floor |
Passed |
|
| Aug 27, 2015 | Do pass | Senate Standing Committee on Appropriations |
Passed |
|
| Aug 17, 2015 | Placed on suspense file | Senate Standing Committee on Appropriations |
Passed |
|
| Jun 29, 2015 | Do pass, but first be re-referred to the Committee on [Judiciary] | Senate Standing Committee on Governmental Organization |
Passed |
|
| Jun 2, 2015 | AB 670 IRWIN Assembly Third Reading | Assembly Floor |
Passed |
|
| May 28, 2015 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 7, 2015 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| RIMS | ** Support | May 20, 2015 |
| Risk Management Society | ** Support | Sep 8, 2015 |
AB 670
Page 3
CONCURRENCE IN SENATE AMENDMENTS
AB 670
(Irwin)
As Amended September 3, 2015
Majority vote
ASSEMBLY: |
79-0 |
(June 2, 2015) |
SENATE: |
39-0 |
(September 8, 2015) |
Original Committee Reference: P. & C.P.
SUMMARY: Requires the Department of Technology (Department) to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments or offices annually. Specifically, this bill:
Authorizes the California Information Security Office (ISO) within the Department to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office.
Requires the cost of an independent security assessment to be funded by the state agency, department, or office being assessed.
Requires ISO, in consultation with the Office of Emergency Services (OES), to perform all the following duties:
Annually require no fewer than 35 state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.
Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, consideration of the following factors:
Personally identifiable information protected by law.
Health information protected by law.
Confidential financial data.
Self-certification of compliance and indicators of unreported noncompliance with security provisions related to information asset management, risk management, information security program management, information security incident management and technology recovery planning.
Determine the basic standards of services to be performed as part of an independent security assessment.
Authorizes the Military Department to perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.
Requires state agencies and entities required to conduct or receive an independent security assessment to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to ISO and OES.
Requires ISO to report to the Department and OES any state entity found to be noncompliant with information security program requirements.
Specifies, notwithstanding any other law, that during the process of conducting an independent security assessment, information and records concerning the assessment are confidential and shall not be disclosed, except to approved state employees and state contractors.
Declares the results of a completed independent security assessment and any related information to be subject to all disclosure and confidentiality provisions under state law, including the California Public Records Act.
Requires the Department to notify OES, the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
Deletes a pre-existing exemption from independent security assessments for the Department of Forestry and Fire Prevention.
Makes findings and declaration relative to the necessity of imposing a limitation on the public's right of access to the meetings of public bodies or the writings of public officials and agencies, namely that the state has a very strong interest in protecting its information systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government.
The Senate amendments generally revise and recast the provisions of this bill, requiring that no fewer than 35 state entities every year be required to perform an independent security assessment, setting broad criteria for the assessment, and clarifying the provisions for transmission and disclosure of assessment results.
FISCAL EFFECT: According to the Senate Appropriations Committee:
[the Department] would incur costs of approximately $2 million in 2016-17, and ongoing costs of approximately $1.9 million for 12 Personnel Year of staff to conduct security assessments. Staff estimates that ISO would have additional costs in the hundreds of thousands annually for travel and other associated charges. (Technology Services Revolving Fund)
Further, ongoing, potentially significant cost pressures for state entities to make necessary Information Technology improvements to address vulnerabilities identified through security assessments. However, these improvements would decrease the likelihood that agencies would experience a future data breach, thereby avoiding related costs in future years. (General Fund and/or Special Funds)
Finally, an estimated [Department] costs in the range of $100,000 to $150,000 to develop and adopt standards for the ISO, Military Department, or entity conducting a security assessment to follow when conducting those assessments and reporting results. These costs include necessary updates to the State Administrative Manual. (Technology Services Revolving Fund)
COMMENTS: This bill is intended to increase the security of California state computer networks by requiring the ISO within the Department of Technology to conduct a security assessment of the information technology systems of at least 35 state agencies, departments and offices under its jurisdiction every year.
According to the author, the State Administrative Manual currently requires state government entities to conduct security assessments every two years, but there is no mechanism of enforcement and less than one-third of state agencies, departments, or offices have conducted or received an assessment to date. These preventative assessments are a vital tool in combating the increasingly sophisticated cyber-attacks because they reveal vulnerabilities, demonstrate the extent of potential exploitation, and provide recommendations for remediation and risk mitigation.
According to the California Military Department, California's size and prominence makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security. A targeted attack on critical infrastructure and key resources could cause up to $1 billion dollars of economic impact to California each day until services are restored. According to the author's office, there are a total of 384 state entities subject to the ISO (which excludes some constitutional offices). It is not known how many attacks, whether successful or unsuccessful, have been made against state agency computers over the past year.
Under current law, ISO is authorized to conduct independent security assessments of any state agency, department or office, but is not required to do so. It is not known how many security assessments were conducted by ISO in the past year. According to the author's office, a security assessment will generally cost a public entity between $10,000 and $40,000 to complete, depending on its size and sophistication. The assessment usually takes 1-2 days, with the assessed entity receiving a written report on findings within 2-3 weeks.
An August 2015 report released by the California State Auditor entitled "High Risk Update – Information Security" describes a litany of shortcomings in state entities' compliance with the information security requirements of the State Administrative Manual, including widespread misreporting of compliance self-certification. The Auditor found that the Department "failed to take sufficient action to ensure that reporting entities address these deficiencies." The report's primary legislative recommendation is to mandate the performance of an independent security assessment for each entity at least every two years.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002224
AB 670
Page 7
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
THIRD READING
Bill No: AB 670
Amended: 9/3/15 in Senate
SENATE GOVERNMENTAL ORG. COMMITTEE: 12-0, 6/29/15
AYES: Hall, Berryhill, Block, Gaines, Glazer, Hernandez, Hill, Hueso, Lara, McGuire, Runner, Vidak
NO VOTE RECORDED: Galgiani
SENATE APPROPRIATIONS COMMITTEE: 6-0, 8/27/15
AYES: Lara, Bates, Beall, Hill, Leyva, Mendoza
NO VOTE RECORDED: Nielsen
ASSEMBLY FLOOR: 79-0, 6/2/15 - See last page for vote
SUBJECT: Information technology security
DIGEST: Requires the Office of Information Security (OIS), in consultation with the Office of Emergency Services (OES), to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.
Senate Floor amendments of 9/3/15 simplified the components of the independent security assessment and increased the role of the OES. The amendments also clarified that information collected during the process of conducting an independent security assessment shall remain confidential.
ANALYSIS:
Existing law:
Establishes, within the Government Operations Agency (GOA), the California Department of Technology (Caltech) under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. Caltech is generally responsible for the approval and oversight of IT projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Establishes, within Caltech, OIS under the supervision of the Chief of the Office of Information Security. The OIS has the authority to, including, but not limited to, conduct, or require to be conducted, an independent security assessment of any state agency, department, or office the cost of which is to be funded by the state agency, department, or office being assessed.
Requires the cost of an independent security assessment or information security program compliance audit to be funded by the state agency, department or office being assessed or audited.
Specifies that nothing in the California Public Records Act shall be construed to require the disclosure of an information security record of a public agency, if, on the fact of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on an IT system of a public agency.
Creates, within the office of the Governor, the OES which, under the Director of Emergency Services, coordinates disaster response, emergency planning, emergency preparedness, disaster recovery, disaster mitigation, and homeland security activities.
This bill:
Specifies that the OIS may conduct, or require to be conducted, an independent security assessment of every state agency, department, or office. The cost of the assessment shall be funded by the state agency, department, or office being assessed.
Requires the OIS, in consultation with the OES to perform all of the following duties:
Annually require no fewer than 35 state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.
Determine criteria and rank state entities based on an information security risk index, as specified.
Determine the basic standards of services to be performed as part of independent security assessments.
Specifies that the Military Department may perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.
Requires state agencies and entities that are required to conduct or receive an independent security assessment to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities if any, to the OIS and the OES.
Specifies that during the process of conducting an independent security assessment, information and records concerning the independent security assessment are confidential and shall not be disclosed, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform the assessment.
Specifies that the results of a completed assessment and any related information shall be subject to all disclosure and confidentiality provisions pursuant to any state law including the California Public Records Act.
Requires the OIS to notify the OES, Department of the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.
Requires the OIS to report to Caltech and the OES any state entity found to be noncompliant with information security requirements.
Authorizes the OIS to conduct or require to be conducted an audit of information security to ensure program compliance, the cost of which is to be funded by the state agency, department, or office being audited.
Requires state entities, as defined, rather than certain information security officers, to comply with policies and procedures issued by the OIS.
Limits access to information and records of an ongoing independent security assessment and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.
Background
Purpose of the bill. According to the author, “cybersecurity attacks are on the rise and California state government is a priority target because of the value and sheer size of its networks and data. The state bears a responsibility in actively defending the information it collects as well as the critical networks that Californians rely on for services. The State Administrative Manual currently includes the provisions contained in this bill, but there is no mechanism of enforcement and compliance is lacking. These preventative assessments are a vital tool in combating the increasingly sophisticated cyber-attacks that threaten our economy and public safety.”
CalTech/OIS. CalTech is the central IT organization for the
State of California and is responsible for the approval and oversight
of all state IT projects. Among its various offices is the
California Information Security Office, or OIS.
OIS is the
primary state government authority for ensuring the confidentiality,
integrity, and availability of state systems and applications, and
ensuring the protection of state information. The OIS represents
California to federal, state, and local government entities, higher
education, private industry, and others on security-related matters.
According to the author's office, there are a total of 384 state
entities subject to the OIS (which excludes some constitutional
offices). It is not known how many attacks, whether successful or
unsuccessful, have been made against state agency computers over the
past year.
Under current law, OIS is authorized to
conduct independent security assessments of any state agency,
department or office, but is not required to do so. Existing state
policy found in the State Administrative Manual indicates that each
state agency shall conduct a comprehensive IT risk assessment once
every two years. It is not known how many security assessments were
conducted by OIS in the past year.
Cyber
Threats in California. According to the California
Military Department (CMD), California's size
and importance makes it vulnerable to cyber incidents that disrupt
business, shutdown critical infrastructure, and compromise
intellectual property or national security.
CMD
calls cybercrime "a growth industry" causing $400 billion
in negative impacts annually on the global economy. Thirty percent
of all cyber-attacks and other malicious activity are targeted at the
government, making these networks and systems the most vulnerable
target of cybercrime.
According
to CMD, the threat to government networks has never been higher.
“Hacktivists”, nation states, cyber criminals and other threat
groups are attacking government networks to steal sensitive
information and make a political/economic statement.
Prior/Related Legislation
AB 1172 (Chau, 2015) creates a California Cyber Security Task Force within OES to act in an advisory capacity and make policy recommendations on cyber security for the State of California. (Pending on the Senate Floor)
AB 739 (Irwin, 2015) provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)
AB 2200 (Perez, 2014) would have created a 13 member California Cyber Security Steering Committee in OES and continue the existence of the California Cyber Security Task Force until January 1, 2020. (Held at the Assembly Desk)
AB 1620 (Rodriguez, 2014) would have established the California Emergency Management and Disaster Preparedness Commission as a statewide executive-level commission to assess and improve the condition of the State’s emergency preparedness, management, and disaster recovery capabilities. (Vetoed by Governor Brown)
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
According to the Senate Appropriations Committee, CalTech would incur costs of approximately $2 million in 2016-17, and ongoing costs of approximately $1.9 million for 12 PY of staff to conduct security assessments. Staff estimates that OIS would have additional costs in the hundreds of thousands annually for travel and other associated charges. (Technology Services Revolving Fund)
Further, ongoing, potentially significant cost pressures for state entities to make necessary IT improvements to address vulnerabilities identified through security assessments. However, these improvements would decrease the likelihood that agencies would experience a future data breach, thereby avoiding related costs in future years. (General Fund and/or Special Funds)
Finally, an estimated Caltech costs in the range of $100,000 to $150,000 to develop and adopt standards for the OIS, Military Department, or entity conducting a security assessment to follow when conducting those assessments and reporting results. These costs include necessary updates to the State Administrative Manual. (Technology Services Revolving Fund)
Risk Management Society
None received
ARGUMENTS IN SUPPORT: According to the Risk Management Society, “this legislation is a prime example of proactive risk management for a risk, cyber terrorism that is quickly becoming a serious threat for many organizations, including state agencies. We believe it is critical that all organizations, including state agencies, assess their cyber security measures in order to mitigate the risk to those who utilize their services.
ASSEMBLY FLOOR: 79-0, 6/2/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins
NO VOTE RECORDED: Chávez
Prepared by: Felipe Lopez / G.O. / (916) 651-1530
9/4/15 14:17:00
**** END ****
AB 670
Page 7
|
Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 |
THIRD READING
Bill No: AB 670
Amended: 6/23/15 in Senate
SENATE GOVERNMENTAL ORG. COMMITTEE: 12-0, 6/29/15
AYES: Hall, Berryhill, Block, Gaines, Glazer, Hernandez, Hill, Hueso, Lara, McGuire, Runner, Vidak
NO VOTE RECORDED: Galgiani
SENATE APPROPRIATIONS COMMITTEE: 6-0, 8/27/15
AYES: Lara, Bates, Beall, Hill, Leyva, Mendoza
NO VOTE RECORDED: Nielsen
ASSEMBLY FLOOR: 79-0, 6/2/15 - See last page for vote
SUBJECT: Information technology security
DIGEST: This bill requires the Office of Information Security (OIS), within the Department of Technology (Caltech), to conduct an independent security assessments of the information technology (IT) resources of every state agency, department or office at least once every two years.
ANALYSIS:
Existing law:
Establishes, within the Government Operations Agency (GOA), Caltech under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. Caltech is generally responsible for the approval and oversight of IT projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Establishes, within Caltech, OIS under the supervision of the Chief of the Office of Information Security. The OIS has the authority to, including, but not limited to, conduct, or require to be conducted, an independent security assessment of any state agency, department, or office the cost of which is to be funded by the state agency, department, or office being assessed.
Requires the cost of an independent security assessment or information security program compliance audit to be funded by the state agency, department or office being assessed or audited.
Specifies that nothing in the California Public Records Act shall be construed to require the disclosure of an information security record of a public agency, if, on the fact of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on an IT system of a public agency.
This bill:
Requires OIS, within Caltech to conduct an independent security assessment of the IT resources of every state agency, department or office at least once every two years.
Specifies that the cost of the assessment shall be funded by the state agency, department, or office being assessed.
Requires the assessment to be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication 800-53 Controls, and to include, to the extent practicable, all of the following components:
Vulnerability scanning, that includes, but is not limited to, all of the following:
Validation that IT systems have currently supported software, with all necessary security patches and updates applied.
Validation that system security configurations are in compliance with NIST standards.
Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
Penetration testing, when determined appropriate by the Office of Emergency Services (OES).
A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation
Specifies that the Military Department may perform an independent security assessment as specified in this bill.
Specifies that the Military Department may mitigate the impact of a cyber-attack or assist a law enforcement investigation into cyber security upon the request of OES, a state law enforcement agency, or a state agency, department or Caltech.
Specifies that the Military Department may perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of OES.
Requires the OIS, Military Department, or entity that performs the assessment to transmit the results of that assessment only to the state agency, department, or office that was the subject of that assessment.
Specifies that the OIS, Military Department, or entity required to conduct an independent security assessment shall transmit an aggregate of the results of that assessment to Caltech.
Authorizes Caltech to require a state agency, department, or office to redirect any funds within its budget that may be legally expended for the assessment to pay the costs of becoming compliant with any recommendation made in an independent security assessment.
Requires Caltech to adopt standards, to be included within the State Administrative Manual that sets the requirements for the OIS, Military department, or entity required to conduct an independent security assessment to transmit the aggregate results of that assessment to Caltech, including, but not limited to, all of the following:
Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.
Prioritization of vulnerabilities.
Identification of relevant internal resources.
Strategy for addressing and mitigating those vulnerabilities.
Restricts the communication of assessment results only to the assessed entity, approved government employees and validated contractors.
Specifies that the results of an independent security assessment, the aggregate of the results of an independent security assessment transmitted to Caltech, and any related information shall be subject to all disclosure and confidentiality provisions of the California Public Records Act.
Requires data produced by assessments to be retained by all parties for no longer than one year, unless determined otherwise by OES.
Deletes a pre-existing exemption from independent security assessments for the Department of Forestry and Fire Prevention.
Declares that the state have a very strong interest in protecting its IT systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government. Thus, information regarding the specific vulnerabilities of those systems must be protected to preclude use of that information to facilitate attacks on those systems.
Background
Purpose of the bill. According to the author, “cybersecurity attacks are on the rise and California state government is a priority target because of the value and sheer size of its networks and data. The state bears a responsibility in actively defending the information it collects as well as the critical networks that Californians rely on for services. The State Administrative Manual currently includes the provisions contained in this bill, but there is no mechanism of enforcement and compliance is lacking. These preventative assessments are a vital tool in combating the increasingly sophisticated cyber-attacks that threaten our economy and public safety.”
CalTech/OIS. CalTech is the central IT organization for the
State of California and is responsible for the approval and oversight
of all state IT projects. Among its various offices is the
California Information Security Office, or OIS.
OIS is the
primary state government authority for ensuring the confidentiality,
integrity, and availability of state systems and applications, and
ensuring the protection of state information. The office represents
California to federal, state, and local government entities, higher
education, private industry, and others on security-related matters.
According to the author's office, there are a total of 384 state
entities subject to the OIS (which excludes some constitutional
offices). It is not known how many attacks, whether successful or
unsuccessful, have been made against state agency computers over the
past year.
Under current law, OIS is authorized to
conduct independent security assessments of any state agency,
department or office, but is not required to do so. Existing state
policy found in the State Administrative Manual indicates that each
state agency shall conduct a comprehensive IT risk assessment once
every two years. It is not known how many security assessments were
conducted by OIS in the past year.
Cyber
Threats in California. According to the California
Military Department (CMD), California's size
and importance makes it vulnerable to cyber incidents that disrupt
business, shutdown critical infrastructure, and compromise
intellectual property or national security.
CMD
calls cybercrime "a growth industry" causing $400 billion
in negative impacts annually on the global economy. Thirty percent
of all cyber-attacks and other malicious activity are targeted at the
government, making these networks and systems the most vulnerable
target of cybercrime.
According
to CMD, the threat to government networks has never been higher.
“Hacktivists”, nation states, cyber criminals and other threat
groups are attacking government networks to steal sensitive
information and make a political/economic statement.
Prior/Related Legislation
AB 1172 (Chau, 2015) creates a California Cyber Security Task Force within OES to act in an advisory capacity and make policy recommendations on cyber security for the State of California. (Pending on the Senate Floor)
AB 739 (Irwin, 2015) Provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)
AB 2200 (Perez, 2014) would have created a 13 member California Cyber Security Steering Committee in OES and continue the existence of the California Cyber Security Task Force until January 1, 2020. (Held at the Assembly Desk)
AB 1620 (Rodriguez, 2014) would have established the California Emergency Management and Disaster Preparedness Commission as a statewide executive-level commission to assess and improve the condition of the State’s emergency preparedness, management, and disaster recovery capabilities. (Vetoed by Governor Brown)
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
According to the Senate Appropriations Committee, CalTech would incur costs of approximately $2 million in 2016-17, and ongoing costs of approximately $1.9 million for 12 PY of staff to conduct security assessments. Staff estimates that OIS would have additional costs in the hundreds of thousands annually for travel and other associated charges. (Technology Services Revolving Fund)
Further, ongoing, potentially significant cost pressures for state entities to make necessary IT improvements to address vulnerabilities identified through security assessments. However, these improvements would decrease the likelihood that agencies would experience a future data breach, thereby avoiding related costs in future years. (General Fund and/or Special Funds)
Finally, an estimated Caltech costs in the range of $100,000 to $150,000 to develop and adopt standards for the OIS, Military Department, or entity conducting a security assessment to follow when conducting those assessments and reporting results. These costs include necessary updates to the State Administrative Manual. (Technology Services Revolving Fund)
Risk Management Society
OPPOSITION: (Verified 8/28/15)
None received
ARGUMENTS IN SUPPORT: According to the Risk Management Society, “this legislation is a prime example of proactive risk management for a risk, cyber terrorism that is quickly becoming a serious threat for many organizations, including state agencies. We believe it is critical that all organizations, including state agencies, assess their cyber security measures in order to mitigate the risk to those who utilize their services.
ASSEMBLY FLOOR: 79-0, 6/2/15
AYES: Achadjian, Alejo, Travis Allen, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Burke, Calderon, Campos, Chang, Chau, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Jones-Sawyer, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Perea, Quirk, Rendon, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Atkins
NO VOTE RECORDED: Chávez
Prepared by: Felipe Lopez / G.O. / (916) 651-1530
8/31/15 10:14:03
**** END ****
AB 670 (Irwin) Page 3 of 3
SENATE COMMITTEE ON APPROPRIATIONS
Senator Ricardo Lara, Chair
2015 - 2016 Regular Session
AB 670 (Irwin) - Information technology security
|
|
Version: June 23, 2015 |
Policy Vote: G.O. 12 - 0 |
Urgency: No |
Mandate: No |
Hearing Date: August 17, 2015 |
Consultant: Mark McKenzie |
This bill meets the criteria for referral to the Suspense File.
Bill Summary:
AB 670 would require the Office of Information Security (OIS), within the Department of Technology, to conduct an independent security assessment of every state agency at least once every two years, as specified.
Fiscal Impact:
The Department of Technology would incur costs of approximately $2 million in 2016-17, and ongoing costs of approximately $1.9 million for 12 PY of staff to conduct security assessments. Staff estimates that OIS would have additional costs in the hundreds of thousands annually for travel and other associated charges. (Technology Services Revolving Fund)
Ongoing, potentially significant cost pressures for state entities to make necessary IT improvements to address vulnerabilities identified through security assessments. However, these improvements would decrease the likelihood that agencies would experience a future data breach, thereby avoiding related costs in future years. (General Fund and/or Special Funds)
Estimated Department of Technology costs in the range of $100,000 to $150,000 to develop and adopt standards for the OIS, Military Department, or entity conducting a security assessment to follow when conducting those assessments and reporting results. These costs include necessary updates to the State Administrative Manual. (Technology Services Revolving Fund)
Background:
Existing law provides that the Department of Technology is generally responsible for the approval and oversight of state information technology (IT) projects. The OIS within the Department of Technology is responsible for ensuring the confidentiality and integrity of state data systems. The OIS is required to establish policies, standards, and procedures for state agencies to manage security and risk. Existing law authorizes the OIS to conduct independent security assessments of any state agency, department, or office, and requires the state entity whose systems are being assessed to pay for the security assessment. Existing state policy outlined in the State Administrative Manual requires each state agency to conduct a comprehensive IT risk assessment once every two years and document the results in a risk assessment report.
In 2013, the Governor administratively directed the Office of Emergency Services (OES) and the Department of Technology to create a Cyber Security Task Force comprised of specified stakeholders, subject matter experts, and cyber security professionals from public, private, academic, and law enforcement sectors. The mission of the Task Force is to enhance the security of California’s digital infrastructure and to create a culture of cybersecurity through collaboration, information sharing, and education and awareness.
Existing law provides that the California Military Department manages the Computer Network Defense Team (CND-T) to assist Department of Defense, federal, state, local government partners, and critical infrastructure providers to provide confidentiality, integrity, and availability of critical network infrastructure. The CND-T also provides support and assistance through established partnerships with cyber security vendors, academia, and government entities. The 2014 Budget Act provided 6 PY of staff and $774,000 in ongoing funding to support the CND-T with the goal of assisting agencies by providing actionable products, assistance, and services designed to improve overall cyber security compliance, reduce risk, and protect the public.
Proposed Law:
AB 670 would require the OIS to conduct, or cause to be conducted, an independent security assessment of every state agency, department, and office at least once every two years, the cost of which is funded by the state entity being assessed. Specifically, this bill would:
Require the assessment to be conducted in compliance with specified national standards and include, to the extent practicable, vulnerability scanning, penetration testing, and a report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
Authorize the Military Department to perform required independent security assessments, respond to a security incident, or mitigate the impacts of a cyber attack, upon the request of OES.
Require OIS to report to the Department of Technology any state agency found to be noncompliant with information security program requirements.
Authorize the Department of Technology to require an agency to redirect any authorized funds within its budget to pay costs of coming into compliance with recommendations made in a security assessment.
Require OIS, the Military Department, or any entity conducting an assessment to transmit the results only to the agency being that was the subject of the assessment, and to transmit aggregated results of the assessment to the Department of Technology.
Require the Department of Technology to adopt standards that prescribe the manner in which the aggregate results of an assessment are transmitted to the Department of Technology. The standards must include specified information and must be incorporated into the State Administrative Manual.
Specify that transmission of the results of an independent security assessment results must be restricted to state government employees and approved contractors, but those results, the aggregate of the results, and any related information are subject to all disclosure and confidentiality provisions of state law, as specified.
Require that any data produced during the creation of a security assessment be destroyed within one year, unless OES determines it should be retained for a longer period for state security purposes.
Staff Comments:
AB 670 is intended to increase the overall security of state IT systems and networks by requiring OIS, within the Department of Technology, to perform an independent security assessment of every state agency under its jurisdiction every two years. While state policy, as outlined in the State Administrative Manual, currently requires agencies to conduct security assessments once every two years, there is no statutory requirement, and many agencies have failed to comply.
The bill requires OIS to conduct, or require to be conducted, an independent security assessment of every state agency every two years, and authorizes the Military Department to conduct assessments, when directed by the Office of Emergency Services. Since the bill mandates OIS to conduct the assessments, the Department of Technology estimates it will need an additional 12 PY of staff, at an ongoing cost of approximately $1.9 million annually, to conduct security assessments of approximately 75 state agencies each year. There would be additional costs and charges related to travel, meals, and lodging, as well as vendor costs and project management and oversight charges. All costs would be charged to the agencies being assessed, so the bill would result in costs to the funds of various agency budgets, the revenues of which would be transferred to the Technology Services Revolving Fund to support the OIS activities.
The costs to each individual agency would vary, depending on the number of systems and critical applications, the complexity of those systems, and the locations of facilities around the state that would need to be accessed. The Military Department estimates that security assessments range in cost from $11,000 to $35,000, although it is unclear that these costs include all required components specified in the bill. Individual state entities that have reported costs to the Committee, based on previous assessments, indicate that costs can range from the low tens of thousands to the low hundreds of thousands for each department’s security assessment. In addition, the Department of Technology has provided information with a sampling of recent costs incurred by state agencies related to outsourcing independent risk assessments to contractors, with smaller agencies having total costs of $30,000 to $50,000 per assessment, and large agencies having security assessment costs ranging from $200,000 to $500,000. Using these samples of costs, total statewide costs could be as high as $10 million annually, if security assessments were performed solely through contracts with private vendors. These costs are only presented for illustrative and comparative purposes.
-- END --
AB 670 (Irwin) Page 6 of 6
SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION
Senator Isadore Hall, III
Chair
2015 - 2016 Regular
Bill No: AB 670 Hearing Date: 6/29/2015
Author: |
Irwin |
||
Version: |
6/23/2015 Amended |
||
Urgency: |
No |
Fiscal: |
Yes |
Consultant: |
Felipe Lopez |
||
SUBJECT: Information technology security
DIGEST: This bill requires the Office of Information Security (OIS), within the Department of Technology (Caltech), to conduct an independent security assessments of the information technology (IT) resources of every state agency, department or office at least once every two years.
ANALYSIS:
Existing law:
Establishes, within the Government Operations Agency (GOA), Caltech under the supervision of the Director of Technology, who is also known as the State Chief Information Officer. Caltech is generally responsible for the approval and oversight of IT projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
Establishes, within Caltech, OIS under the supervision of the Chief of the Office of Information Security. The OIS has the authority to, including, but not limited to, conduct, or require to be conducted, an independent security assessment of any state agency, department, or office the cost of which is to be funded by the state agency, department, or office being assessed.
Requires the cost of an independent security assessment or information security program compliance audit to be funded by the state agency, department or office being assessed or audited.
Specifies that nothing in the California Public Records Act shall be construed to require the disclosure of an information security record of a public agency, if, on the fact of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on an IT system of a public agency.
This bill:
Requires OIS, within Caltech to conduct an independent security assessment of the IT resources of every state agency, department or office at least once every two years.
Specifies that the cost of the assessment shall be funded by the state agency, department, or office being assessed.
Requires the assessment to be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication 800-53 Controls, and to include, to the extent practicable, all of the following components:
Vulnerability scanning, that includes, but is not limited to, all of the following:
Validation that IT systems have currently supported software, with all necessary security patches and updates applied.
Validation that system security configurations are in compliance with NIST standards.
Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
Penetration testing, when determined appropriate by the Office of Emergency Services (OES).
A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation
Specifies that the Military Department may perform an independent security assessment as specified in this bill.
Specifies that the Military Department may mitigate the impact of a cyber-attack or assist a law enforcement investigation into cyber security upon the request of OES, a state law enforcement agency, or a state agency, department or Caltech.
Specifies that the Military Department may perform a cyber security assessment or respond to a cyber security incident impacting state infrastructure upon the request of OES.
Requires the office, Military Department, or entity that performs the assessment to transmit the results of that assessment only to the state agency, department, or office that was the subject of that assessment.
Specifies that the office, Military Department, or entity required to conduct an independent security assessment shall transmit an aggregate of the results of that assessment to Caltech.
Authorizes Caltech to require a state agency, department, or office to redirect any funds within its budget that may be legally expended for the assessment to pay the costs of becoming compliant with any recommendation made in an independent security assessment.
Requires Caltech to adopt standards, to be included within the State Administrative Manual that sets the requirements for the office, Military department, or entity required to conduct an independent security assessment to transmit the aggregate results of that assessment to Caltech, including, but not limited to, all of the following:
Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.
Prioritization of vulnerabilities.
Identification of relevant internal resources.
Strategy for addressing and mitigating those vulnerabilities.
Restricts the communication of assessment results only to the assessed entity, approved government employees and validated contractors.
Specifies that the results of an independent security assessment, the aggregate of the results of an independent security assessment transmitted to Caltech, and any related information shall be subject to all disclosure and confidentiality provisions of the California Public Records Act.
Requires data produced by assessments to be retained by all parties for no longer than one year, unless determined otherwise by OES.
Deletes a pre-existing exemption from independent security assessments for the Department of Forestry and Fire Prevention.
Declares that the state have a very strong interest in protecting its IT systems from intrusion, because those systems contain confidential information and play a critical role in the performance of the duties of state government. Thus, information regarding the specific vulnerabilities of those systems must be protected to preclude use of that information to facilitate attacks on those systems.
Background
Purpose of the bill. According to the author, “cybersecurity attacks are on the rise and California state government is a priority target because of the value and sheer size of its networks and data. The state bears a responsibility in actively defending the information it collects as well as the critical networks that Californians rely on for services. The State Administrative Manual currently includes the provisions contained in this bill, but there is no mechanism of enforcement and compliance is lacking. These preventative assessments are a vital tool in combating the increasingly sophisticated cyber-attacks that threaten our economy and public safety.”
CalTech/OIS.
CalTech is the central IT organization for the State of California
and is responsible for the approval and oversight of all state IT
projects. Among its various offices is the California Information
Security Office, or OIS.
OIS is the primary state
government authority for ensuring the confidentiality, integrity, and
availability of state systems and applications, and ensuring the
protection of state information. The office represents California to
federal, state, and local government entities, higher education,
private industry, and others on security-related matters. According
to the author's office, there are a total of 384 state entities
subject to the OIS (which excludes some constitutional offices). It
is not known how many attacks, whether successful or unsuccessful,
have been made against state agency computers over the past year.
Under current law, OIS is authorized to conduct
independent security assessments of any state agency, department or
office, but is not required to do so. Existing state policy found in
the State Administrative Manual indicates that each state agency
shall conduct a comprehensive IT risk assessment once every two
years. It is not known how many security assessments were conducted
by OIS in the past year.
Cyber
Threats in California. According to the California
Military Department (CMD), California's size
and importance makes it vulnerable to cyber incidents that disrupt
business, shutdown critical infrastructure, and compromise
intellectual property or national security.
CMD
calls cybercrime "a growth industry" causing $400 billion
in negative impacts annually on the global economy. Thirty percent
of all cyber-attacks and other malicious activity are targeted at the
government, making these networks and systems the most vulnerable
target of cybercrime.
According
to CMD, the threat to government networks has never been higher.
“Hacktivists”, nation states, cyber criminals and other threat
groups are attacking government networks to steal sensitive
information and make a political/economic statement.
Prior/Related Legislation
AB 1172 (Chau, 2015) creates a California Cyber Security Task Force within OES to act in an advisory capacity and make policy recommendations on cyber security for the State of California. (Pending in Senate Governmental Organization Committee)
AB 739 (Irwin, 2015) Provides legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)
AB 2200 (Perez, 2014) would have created a 13 member California Cyber Security Steering Committee in OES and continue the existence of the California Cyber Security Task Force until January 1, 2020. (Held at the Assembly Desk)
AB 1620 (Rodriguez, 2014) would have established the California Emergency Management and Disaster Preparedness Commission as a statewide executive-level commission to assess and improve the condition of the State’s emergency preparedness, management, and disaster recovery capabilities. (Vetoed by Governor Brown)
SB 90 (Budget and Fiscal Review, Chapter 183, Statutes of 2007) created the Office of Information Security and Privacy Protection within the State and Consumer Services Agency with the duty of providing direction for information security and privacy to state government agencies.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
SUPPORT:
Risk Management Society
OPPOSITION:
None received
ARGUMENTS IN SUPPORT: According to the Risk Management Society, “this legislation is a prime example of proactive risk management for a risk, cyber terrorism that is quickly becoming a serious threat for many organizations, including state agencies. We believe it is critical that all organizations, including state agencies, assess their cyber security measures in order to mitigate the risk to those who utilize their services.
DUAL REFERRAL: Senate Judiciary Committee
AB 670
Page 2
ASSEMBLY THIRD READING
AB 670
(Irwin)
As Amended April 6, 2015
Majority vote
Committee |
Votes |
Ayes |
Noes |
Privacy |
11-0 |
Gatto, Wilk, Baker, Calderon, Chang, Chau, Cooper, Dababneh, Dahle, Gordon, Low |
|
Appropriations |
17-0 |
Gomez, Bigelow, Bonta, Calderon, Chang, Daly, Eggman, Gallagher, Eduardo Garcia, Gordon, Holden, Jones, Quirk, Rendon, Wagner, Weber, Wood |
|
SUMMARY: Requires the Department of Technology (CalTech) to conduct security assessments of the information technology resources of every state agency, department or office at least once every two years. Specifically, this bill:
Requires the Office of Information Security (OIS) within CalTech to conduct an independent security assessment of every state agency, department, or office at least once every two years.
Requires the assessment to be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls, and to include, to the extent practicable, all of the following components:
Vulnerability scanning, as specified.
Penetration testing, when determined to be appropriate by the Governor's Office of Emergency Services.
A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
Authorizes CalTech to require any agency out of compliance with the assessment requirement to redirect any funds within the agency's budget, which may be legally expended for these purposes, to pay the costs of the assessment.
Deletes a pre-existing exemption from independent security assessments for the Department of Forestry and Fire Prevention.
Authorizes the Governor's Office of Emergency Services to conduct the strategic direction of security assessments performed by the Military Department's Computer Network Defense Team (CND-T), as specified
Requires CalTech to adopt standards to be included in the State Administrative Manual that set forth the manner for the assessed agency or entity to communicate the assessment results to CalTech, as specified:
Restricts the communication of assessment results only to the assessed entity, approved government employees and validated contractors.
Requires assessment results and relative aggregated reports to be confidential and exempt from Freedom of Information Act distribution and protected from disclosure by Public Records Act requests.
Requires data produced by assessments to be retained by all parties for no longer than one year, unless determined otherwise by the Governor's Office of Emergency Services.
FISCAL EFFECT: According to the Assembly Appropriations Committee:
Major state costs of approximately $5 million (General Fund) for two years, for 32 Personal Years for the California Military Department to perform the CND-T assessments.
On-going costs to state agencies, in the range of $20,000 to $200,000, per agency for the assessments. Costs will vary by agency depending on their current security budgets and to what extent this bill mandates a broader or more frequent security assessment and redirection of funds.
COMMENTS:
Purpose of this bill. This bill is intended to increase the security of California state computer networks by requiring CalTech to conduct a security assessment of the 384 state agencies, departments and offices under its jurisdiction every two years. This bill is author-sponsored.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000578
AB 670
Page 4
Date of Hearing: May 20, 2015
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Jimmy Gomez, Chair
AB 670
(Irwin) – As Amended April 6, 2015
Policy Committee: |
Privacy and Consumer Protection |
Vote: |
11 - 0 |
|
|
|
|
|
|
|
|
Urgency: No State Mandated Local Program: No Reimbursable: No
SUMMARY:
This bill requires the Office of Information Security (OIS), within the Department of Technology (CalTech), to conduct security assessments of the information technology resources of every state agency, department or office at least once every two years. Specifically, this bill:
Requires the assessment to be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls, and to include, to the extent practicable, vulnerability scanning, penetration testing, and a report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
Authorizes CalTech to require any agency out of compliance with the assessment requirement to redirect any funds within the agency’s budget, which may be legally expended for these purposes, to pay the costs of the assessment.
Authorizes the Governor’s Office of Emergency Services (OES) to conduct the strategic direction of security assessments performed by the Military Department’s Computer Network Defense Team (CND-T)
Requires CalTech to adopt standards that set forth the manner for the assessed agency or entity to communicate the assessment results to CalTech.
Requires assessment results and relative aggregated reports to be confidential and exempt from Freedom of Information Act distribution and protected from disclosure by Public Records Act requests.
Requires data produced by assessments to be retained by all parties for no longer than one year, unless determined otherwise by OES
FISCAL EFFECT:
Major state costs of approximately $5 million (GF) for two years, for 32 PYs for the California Military Department to perform the CND-T assessments.
On-going costs to state agencies, in the range of $20,000 to $200,000, per agency for the assessments. Costs will vary by agency depending on their current security budgets and to what extent this bill mandates a broader or more frequent security assessment and redirection of funds.
COMMENTS:
Purpose. According to the author, "Cybersecurity attacks are on the rise and California state government is a priority target because of the value and sheer size of its networks and data. The state bears a responsibility in actively defending the information it collects as well as the critical networks that Californians rely on for services. The State Administrative Manual currently includes the provisions contained in this bill, but there is no mechanism of enforcement and less than one-third of state agencies, departments, or offices have conducted or received an assessment to date. These preventative assessments are a vital tool in combating the increasingly sophisticated cyber-attacks because they reveal vulnerabilities, demonstrate the extent of potential exploitation, and provide recommendations for remediation and risk mitigation."
This bill seeks to increase the security of California state computer networks by requiring CalTech to conduct a security assessment of each agency, department and office under its jurisdiction every two years.
Background. According to the California Military Department (CMD), California's size and prominence makes it vulnerable to cyber incidents. In 2012, 17% of the data breaches recorded in the United States took place in California – more than any other state; and the number of reported breaches in California increased by 28% in 2013. California leads the nation in high tech employment and cyber innovation, with 40% of all U.S. venture capital investment in cyber residing here. A targeted attack on critical infrastructure and key resources could cause up to $1 billion dollars of economic impact to California each day until services are restored. According to the State Attorney General’s 2014 Data Breach Report, organizations should conduct risk assessments at least annually and update privacy and security practices based on the findings.
CalTech and OIS. CalTech is the central IT organization for the State and is responsible for the approval and oversight of all state IT projects. OIS, within CalTech, is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. OIS represents California to federal, state, and local government entities, higher education, private industry, and others on security-related matters. According to the author's office, there are a total of 384 state entities subject to the OIS (which excludes some constitutional offices). Under current law, OIS is authorized to conduct independent security assessments of any state agency, department or office, but is not required to do so.
National Guard. The CMD, which oversees the state's National Guard units, supports state law enforcement and OES in the prevention and protection of supported networks, which helps enable the state to respond to vulnerabilities or attacks. OES coordinates and requests the support of the CMD to provide cyber defense, incident support and cyber recovery operations.
The CMD temporarily maintains CND-T, a pilot project funded in the Budget Act of 2014. CND-T's goal is to "assist agencies by providing actionable products, assistance, and services designed to improve overall cyber security compliance, reduce risk, and protect the public.” CND-T currently has nine full time staff, with the capability to add six more. CMD will also draw upon a soon-to-be created 39-member Cyber Protection Team under its command, which has been authorized by the federal government; it will be based in San Diego and operational in 2017. According to the CMD, in the first quarter of FY2015, the CND-T performed 2,863 end-point scans identifying 39,880 risks with an average of 13.6 vulnerabilities per system. Agencies supported by the CND-T generally show a ten-fold reduction in system vulnerabilities. According to the author's office, a security assessment usually takes 1-2 days, with the assessed entity receiving a written report on findings within 2-3 weeks.
This bill would authorize OES to direct assessments conducted by the CND-T, and authorize CalTech to "redirect" funds from an assessed agency to pay for the costs of the assessment.
Related legislation.
AB 1172 (Chau), pending in this Committee, continues in existence the California Cyber Security Task Force, and authorize the task force to act in an advisory capacity and compile policy recommendations on cyber security for the state until January 1, 2020. Also creates a State Director of Cyber Security with within OES.
AB 739 (Irwin), pending in the Assembly Judiciary Committee, requires the Attorney General to create a registry of private entities that intend to engage in communication of cyber security-threat information, and provides that there is no civil or criminal liability for a registered entity based upon its communication of cyber security-threat information to another public or private entity.
Previous legislation.
AB 2200 (Perez) of 2014 would have created a California Cyber Security Steering Committee within OES, and would have continued the existence of the California Cyber Security Task Force until January 1, 2020. This bill was held at the Assembly Desk.
SB 1286 (Corbett) of 2014 would have raised from $35 million to $65 million the amount that the PUC may devote to research and development projects for the purposes of cyber security and grid integration. This bill was held in the Senate Rules Committee.
AB 1620 (Rodriguez) of 2014 would have established in state government the California Emergency Management and Disaster Preparedness Commission as a statewide executive-level commission to assess and improve the condition of the state’s emergency preparedness, management, and disaster recovery capabilities. This bill was vetoed by Governor Brown.
SB 90 (Budget and Fiscal Review), Chapter 183, Statutes of 2007, created the Office of Information Security and Privacy Protection within the State and Consumer Services Agency. The duties of the new office include providing direction for information security and privacy to state government agencies, conducting security assessments and review of any state agency, providing educational information to consumers on effective ways of protecting personal information, and assisting in the prosecution of identity theft and other privacy-related crimes.
Analysis Prepared by: Jennifer Swenson / APPR. / (916) 319-2081
AB 670
Page 7
Date of Hearing: April 7, 2015
ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION
Mike Gatto, Chair
AB 670
(Irwin) – As Amended April 6, 2015
SUBJECT: Security assessments
SUMMARY: Requires the Department of Technology (CalTech) to conduct security assessments of the information technology resources of every state agency, department or office at least once every two years. Specifically, this bill:
Requires the Office of Information Security (OIS) within CalTech to conduct an independent security assessment of every state agency, department, or office at least once every two years.
Requires the assessment to be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls, and to include, to the extent practicable, all of the following components:
Vulnerability scanning, which includes, but is not limited to, the following:
validation that information technology (IT) systems have currently supported software, security patches, and updates applied;
validation that system security configurations are in compliance with NIST standards; and,
validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.
Penetration testing, when determined to be appropriate by the Governor’s Office of Emergency Services.
A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.
Authorizes CalTech to require any agency out of compliance with the assessment requirement to redirect any funds within the agency’s budget, which may be legally expended for these purposes, to pay the costs of the assessment.
Deletes a pre-existing exemption from independent security assessments for the Department of Forestry and Fire Prevention.
Authorizes the Governor’s Office of Emergency Services to conduct the strategic direction of security assessments performed by the Military Department’s Computer Network Defense Team (CND-T), which shall include:
Contracting and negotiating with state agencies, departments, offices, or private entities to be assessed;
Setting an assessment calendar to be followed by the CND-T; and,
Prioritizing incident response.
Requires CalTech to adopt standards to be included in the State Administrative Manual that set forth the manner for the assessed agency or entity to communicate the assessment results to CalTech, including, but not limited to, all of the following:
Aggregated, statistical information relevant to the assessment results, including the number of identified vulnerabilities categorized by high, medium, or low risk, but not to include any specific and potentially exploitable information relative to the nature of risk;
Prioritization of vulnerabilities;
Identification of relevant internal resources; and,
Strategy for addressing and mitigating those vulnerabilities.
Restricts the communication of assessment results only to the assessed entity, approved government employees and validated contractors.
Requires assessment results and relative aggregated reports to be confidential and exempt from Freedom of Information Act distribution and protected from disclosure by Public Records Act requests.
Requires data produced by assessments to be retained by all parties for no longer than one year, unless determined otherwise by the Governor’s Office of Emergency Services.
EXISTING LAW:
Establishes CalTech within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. The department is responsible for the approval and oversight of IT projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. (Government Code (GC) Section 11545 and 12803.2)
Establishes the Office of Technology Services within the department, under the supervision of the Chief of the Office of Technology Services, and sets forth its duties, including, but not limited to, the authority to conduct or require a security assessment of any state agency, as prescribed. (GC 11549.3)
Requires the cost of an independent security assessment or information security program compliance audit to be funded by the state agency, department or office being assessed or audited. (GC 11549.3(c-d))
FISCAL EFFECT: Unknown
COMMENTS:
Purpose of this bill. This bill is intended to increase the security of California state computer networks by requiring CalTech to conduct a security assessment of each agency, department and office under its jurisdiction every two years. AB 670 is author-sponsored.
Author's statement. According to the author, "Cybersecurity attacks are on the rise and California state government is a priority target because of the value and sheer size of its networks and data. The state bears a responsibility in actively defending the information it collects as well as the critical networks that Californians rely on for services.
"The State Administrative Manual currently includes the provisions contained in this bill, but there is no mechanism of enforcement and less than one-third of state agencies, departments, or offices have conducted or received an assessment to date. These preventative assessments are a vital tool in combating the increasingly sophisticated cyber-attacks because they reveal vulnerabilities, demonstrate the extent of potential exploitation, and provide recommendations for remediation and risk mitigation.
"AB 670 would require state agencies, departments, and offices to receive a network security assessment at least once every 2 years. The bill would authorize the Department of Technology to require agencies that are not in compliance to redirect available funding to pay the costs of the assessments. The bill would require the Department to adopt standards for the assessed agency to report the results. The bill would give the Office of Emergency Services the authority to direct the activity of the Military Department’s Computer Network Defense Team, which performs these network assessments."
Understanding the cyber security threat. According to the California Military Department, California's size and prominence makes it vulnerable to cyber incidents that disrupt business, shutdown critical infrastructure, and compromise intellectual property or national security. In 2012, 17% of the data breaches recorded in the United States took place in California – more than any other state; and the number of reported breaches in California increased by 28% in 2013. California leads the nation in high tech employment and cyber innovation with 40% of all U.S. venture capital investment in cyber residing here.
CMD calls cybercrime "a growth industry" causing $400 billion in negative impacts annually on the global economy. Thirty percent of all cyber-attacks and other malicious activity is targeted at the government, making these networks and systems the most vulnerable target of cybercrime.
According to CMD, the State of California is extremely vulnerable to cyber incidents that can disrupt industry, compromise personal information, shutdown critical infrastructure and compromise intellectual property or national security. A targeted attack on critical infrastructure and key resources could cause up to $1 billion dollars of economic impact to California each day until services are restored.
According to the State Attorney General’s 2014 Data Breach Report, organizations should conduct risk assessments at least annually and update privacy and security practices based on the findings.
CalTech and OIS. CalTech is the central IT organization for the State of California and is responsible for the approval and oversight of all state IT projects. Among its various offices and subdivisions is the California Information Security Office, or OIS.
OIS is the primary state government authority for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. The office represents California to federal, state, and local government entities, higher education, private industry, and others on security-related matters. According to the author's office, there are a total of 384 state entities subject to the OIS (which excludes some constitutional offices). It not known how many attacks, whether successful or unsuccessful, have been made against state agency computers over the past year.
Under current law, OIS is authorized to conduct independent security assessments of any state agency, department or office, but is not required to do so. It is not known how many security assessments were conducted by OIS in the past year.
The role of the California National Guard in cyber security. The CMD, which oversees the state's National Guard units, supports state law enforcement and emergency services in the prevention and protection of supported networks, which helps enable the state to respond to vulnerabilities or attacks. The California Office of Emergency Services, which is responsible for assuring the state's readiness to respond to and recover from all hazards, coordinates and requests the support of the CMD to provide cyber defense, incident support and cyber recovery operations.
The CMD temporarily maintains CND-T, a pilot project funded as Item 8940-001-0001 of the Budget Act of 2014. CND-T's goal is to "assist agencies by providing actionable products, assistance, and services designed to improve overall cyber security compliance, reduce risk, and protect the public. These high-quality reduced cost services are easily accessible via an Interagency Agreement. This simplifies the request and procurement process." CND-T currently has nine full time staff, with the capability to add six more.
CMD can leverage other resources as well, such as the Air National Guard's Emergency State Active Duty Component. In the near future, CMD will also be able to draw upon a soon-to-be created 39-member Cyber Protection Team under its command, which has been authorized by the federal government and will be based in San Diego and operational in 2017.
CND-T provides a wide range of consulting, training and direct services, from pre-incident cyber security services such as vulnerability assessments, best practice analysis, and the development of mitigation strategies for government and critical infrastructure providers, to cyber security incident recovery services designed to facilitate restoration to secure normal operations.
According to the CMD, in the first quarter of FY2015, the CND-T performed 2,863 end-point scans identifying 39,880 risks with an average of 13.6 vulnerabilities per system. Agencies supported by the CND-T generally show a ten-fold reduction in system vulnerabilities.
According to the author's office, a security assessment will generally cost a public entity between $10,000 and $40,000 to complete, depending on its size and sophistication. The assessment usually takes 1-2 days, with the assessed entity receiving a written report on findings within 2-3 weeks.
This bill would authorize OES to direct assessments conducted
by the CND-T, and authorize CalTech to "redirect" funds
from an assessed agency to pay for the costs of the assessment.
The NIST SP 800-53 cyber security standard. This bill requires that the security assessments be conducted in compliance with the NIST SP 800-53 Controls. That standard, released as Revision 4 on April 20, 2013, and titled "Security and Privacy Controls for Federal Information Systems and Organizations," is the most comprehensive update to the security controls catalog since the introduction of the standard in 2005. The standard was developed by NIST, the Department of Defense, the Intelligence Community (a coalition of 17 federal agencies within the Executive Branch), and the Committee on National Security Systems, and was motivated principally by the increasing sophistication of cyber-attacks and the quicker operations tempo of adversaries.
According to NIST, the standard "provides a more holistic approach to information security and risk management by providing organizations with the breadth and depth of security controls necessary to fundamentally strengthen their information systems and the environments in which those systems operate—contributing to systems that are more resilient in the face of cyber attacks and other threats."
Because the language of the bill references the publication number of the NIST standard but not the revision number, OIS should be able to continue to use the most recent version of the standard as new revisions are published.
Exemption from open records laws. This bill provides that assessment results are documents not available to the public via a federal Freedom of Information Act request or California's own Public Records Act (CPRA). The CPRA already contains a provision which protects from disclosure any government record that "would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency."
Questions for the Committee. The Committee may wish to consider whether OIS has the capacity to conduct the assessments required by this bill. Given that California has approximately 384 state agencies, departments and commissions that would be subject to this mandate, the question arises as to how many security assessments OIS could realistically complete over the course of a year and at what cost. And while the bill authorizes CND-T to help complete the assessments as directed, CND-T’s capacity is also unknown. As a result, it is not yet clear whether it will be feasible for OIS (and CND-T) to complete the security assessments required by this bill within the given two years.
The Committee may wish to inquire of the author as to what evidence exists that a two-year assessment cycle is feasible given available resources. And if current resources are not sufficient, whether or not new resources should be allocated or the assessment cycle should be extended beyond two years.
Arguments in support. According to RIMS, a risk management society, "We view this legislation as a prime example of pro-active risk management for a risk, cyber terrorism, that is quickly becoming a serious threat for many organizations including state agencies. We believe it is critical that all organizations, including state agencies, assess their cyber security measures in order to mitigate the risk to those who utilize their services."
Related legislation. AB 1172 (Chau) would continue in existence the California Cyber Security Task Force, and authorize the task force to convene stakeholders to act in an advisory capacity and compile policy recommendations on cyber security for the state until January 1, 2020. The measure would also create a State Director of Cyber Security with specified duties within the Governor’s Office of Emergency Services. AB 1172 is currently pending in the Assembly Privacy and Consumer Protection Committee.
AB 739 (Irwin) would require the Attorney General to create a registry of private entities that intend to engage in communication of cyber security-threat information, and would further provide that there is no civil or criminal liability for a registered entity based upon its communication of cyber security-threat information to another public or private entity. AB 739 is currently pending in the Assembly Privacy and Consumer Protection Committee.
Previous legislation. AB 2200 (Perez) of 2014 would have created a thirteen member California Cyber Security Steering Committee within the Governor’s Office of Emergency Services (OES), and would have continued the existence of the California Cyber Security Task Force until January 1, 2020. This bill was held at the Assembly Desk.
SB 1286 (Corbett) of 2014 would have raised from $35 million to $65 million the amount that the Public Utilities Commission may devote to research and development projects for the purposes of cyber security and grid integration. This bill was held in the Senate Rules Committee.
AB 1620 (Rodriguez) of 2014 would have established in state
government the California Emergency Management and Disaster
Preparedness Commission as a statewide executive-level commission to
assess and improve the condition of the state’s emergency
preparedness, management, and disaster recovery capabilities. This
bill was vetoed by Governor Brown.
SB 90 (Budget and
Fiscal Review), Chapter 183, Statutes of 2007, created the Office of
Information Security and Privacy Protection within the State and
Consumer Services Agency. The duties of the new office include, but
are not limited to: providing direction for information security and
privacy to state government agencies; conducting security assessments
and review of any state agency; providing educational information to
consumers on effective ways of protecting personal information; and
assisting in the prosecution of identity theft and other
privacy-related crimes.
REGISTERED SUPPORT / OPPOSITION:
Support
RIMS
Opposition
None received.
Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200
Discussed in Hearing
1MIN
Assembly Floor
2MIN
Senate Floor
4MIN
Senate Standing Committee on Appropriations
4MIN
Senate Standing Committee on Governmental Organization
1MIN
Assembly Floor
2MIN
Assembly Standing Committee on Appropriations
Bill Author
Bill Co-Author(s):