The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology. Existing law requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. Existing law requires each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorizes the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. Existing law prohibits public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

This bill would require each state agency, as part of its Technology Recovery Plan, to provide the department with an inventory of all critical infrastructure controls, and their associated assets, in the possession of the agency. The bill would authorize a local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, upon the request of the department, to submit a Technology Recovery Plan, as specified, to the department. The bill would authorize the department to provide suggestions with regard to the plans. The bill would prohibit public disclosure of these plans.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology. Existing law requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. Existing law requires each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorizes the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. Existing law prohibits public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

This bill would require each state agency, as part of its Technology Recovery Plan, to provide the department with an inventory of all critical infrastructure controls, and their associated assets, in the possession of the agency. The bill would authorize a local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, upon the request of the department, to submit a Technology Recovery Plan, as specified, to the department. The bill would authorize the department to provide suggestions with regard to the plans. The bill would prohibit public disclosure of these plans.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology. Existing law requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. Existing law requires each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorizes the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. Existing law prohibits public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

This bill would require each state agency, as part of its Technology Recovery Plan, to provide the department with an inventory of all critical infrastructure controls, and their associated assets, in the possession of the agency. The bill would also authorize any other state or a local entity that is not defined as a state agency to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in the possession of the entity, that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, upon the request of the department, to submit a Technology Recovery Plan, as specified, to the department. The bill would authorize the department to provide suggestions with regard to the plans. The bill would prohibit public disclosure of these inventories. plans.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

The California Constitution requires local agencies, for the purpose of ensuring public access to the meetings of public bodies and the writings of public officials and agencies, to comply with a statutory enactment that amends or enacts laws relating to public records or open meetings and contains findings demonstrating that the enactment furthers the constitutional requirements relating to this purpose.

This bill would make legislative findings to that effect.

The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology. Existing law requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. Existing law requires each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorizes the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. Existing law prohibits public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified.

This bill would require each state agency, as part of its Technology Recovery Plan, to provide the department with an inventory of all critical infrastructure controls, and their associated assets, in the possession of the agency. The bill would also authorize any other state or local entity that is not defined as a state agency to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in the possession of the entity, to the department. The bill would prohibit public disclosure of these inventories.

Existing law establishes, within the Government Operations Agency, the Department of Technology under the supervision of the Director of Technology, who also serves as the State Chief Information Officer. The department is generally responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.

Existing law establishes, within the department, the Office of Information Security under the supervision of the Chief of the Office of Information Security. Existing law requires the chief to establish an information security program including, among other things, the creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual. Existing law requires all state entities to implement the policies and procedures issued by the office. Existing law requires the office to report to the Department of Technology and the Office of Emergency Services any state entity found to be noncompliant with information security program requirements.

This bill would make a nonsubstantive change to these provisions.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1022

Author:(Irwin)

As Amended Ver:September 6, 2017

Majority vote

Original Committee Reference: P. & C.P.

SUMMARY: Requires state agencies to include within their Technology Recovery Plan (TRP) an inventory of all critical infrastructure controls and associated assets.

The Senate amendments

1. Clarify that at the request of the California Department of Technology (CDT), any local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, may submit a TRP to the department.
2. Specify that CDT is authorized to provide suggestions to a local entity that voluntarily provided a TRP in order to improve compliance with reporting standards, as specified.
3. Declares TRPs submitted by local entities to be confidential and not to be disclosed pursuant to any state law.
4. Makes findings and declarations relative to the need to prevent public disclosure of critical infrastructure control inventories.
5. Make other technical or nonsubstantive changes.

EXISTING LAW:

1. Establishes CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Government Code Section (GC) 11545(a))
2. Requires state entities to implement the information security and privacy policies, standards and procedures issued by the Office of Information Security (OIS). (GC 11549.3(b))
3. Requires CDT, on or before July 1, 2018, to update the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. (GC 8592.35(a))
4. Requires state agencies to report on their compliance with the updated Technology Recovery Plan standards to CDT in the manner and at the time directed by CDT no later than July 1, 2019. (GC 8592.40(a))
5. Defines "critical infrastructure controls" as networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. (GC 8592.30(a))

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. Significant ongoing costs of approximately $580,000 per year, to CDT for increased workload to process and review submissions. (GF)
2. Potentially significant cost pressure, in the tens of thousands, if entities that are not required to report their updated TRP choose to report to CDT. CDT would require additional secured storage space to host the additional information. (GF)
3. Unknown, potentially significant ongoing costs to state agencies to update their TRP with an inventory of their critical infrastructure controls and associated assets. (GF and special funds)

COMMENTS:

This bill is intended to give CDT access to more complete information about state agency critical infrastructure assets and controls by requiring state agencies to submit inventories of those assets and controls as part of the pre-existing TRP program. This bill is author-sponsored.

The state's TRP program is a sub-set of the state entity's Business Continuity Plan, which is premised on identifying all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Every state entity is required by the State Administrative Manual (section 5325.1) to develop a TRP in support of the Continuity Plan and the business need to protect critical information assets to ensure their availability following an interruption or disaster.

Every state entity must keep its TRP up-to-date and provide annual documentation for those updates to the Chief Information Security Officer (CISO). The TRP must outline a planned approach to managing risks to the state entity's mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing. (State Information Management Manual (SIMM) Section 5325-A)

This bill would explicitly direct all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT (specifically, the CISO), as part of the agency's TRP. The bill would also authorize any other state or local governmental agency to voluntarily submit a similar inventory to CDT as well.

The author contends that this inventory is necessary so that the CISO has a better strategic view of the state's critical infrastructure assets and controls, making "the inventory no longer an optional appendix, but a key component of the report that can be accessed by the CDT for planning, budgeting, and security purposes."

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002228

 THIRD READING  

Bill No: AB 1022

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 6/27/17

AYES: Dodd, Berryhill, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Mendoza, Portantino, Vidak

SENATE JUDICIARY COMMITTEE: 7-0, 7/11/17

AYES: Jackson, Moorlach, Anderson, Hertzberg, Monning, Stern, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 9/1/17

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 76-0, 5/31/17 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill requires state agencies, as part of their Technology Recovery Plan (TRP), to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession.

Senate Floor Amendments of 9/6/17 narrow the scope of the voluntary local entity inventory submission by making those submissions only by local entities that receive state funding or a project relationship with a state entity and only upon the request of a TRP by CDT. The amendments also authorize CDT to provide suggestions with regards to TRPs.

ANALYSIS:

Existing law:

1. Sets forth the duties of the Office of Emergency Services (OES) with respect to specified emergency preparedness, mitigation, and response activities within the state.
2. Establishes CDT under the supervision of the Director of CDT, and generally requires CDT to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
3. Establishes the Office of Information Security (OIS), within CDT, which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy to ensure the trust of residents of the state.
4. Requires CDT, in consultation with OES, on or before July 1, 2018, to update the TRP element of the State Administrative Manual to ensure inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure information.
5. Requires state agencies, as defined, to report on their compliance with the updated TRP standards to CDT in the manner directed by CDT, no later than July 1, 2019.
6. Defines “critical infrastructure” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
7. Defines a “state agency” as every state office, officer, department, division, bureau, board, and commission. A “state agency” does not include the California State University.

This bill:

1. Requires state agencies, as part of their TRP, to provide CDT with an inventory of all critical infrastructure controls and associated assets in their possession.
2. Authorizes, at the request of CDT, any local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, to submit a TRP, as specified.
3. Authorizes CDT to provide suggestions with regards to the TRPs.
4. Makes findings and declarations that this bill strikes the appropriate balance between the public’s right to access information about the conduct of their governmental agencies and the need to protect cybersecurity of critical infrastructure controls within the state.
5. Makes other technical and nonsubstantive changes to existing law.

Background

Technology Recovery Plans. The state's TRP program is a sub-set of the state entity’s Business Continuity Plan, which identifies all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Each state entity is required by the State Administrative Manual to develop a TRP in support of the Continuity Plan and the businesses need to protect critical information assets to ensure their availability following an interruption or disaster.

Every state entity must keep its TRP current and provide annual documentation for those updates to CDT. The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing.

AB 1022 explicitly directs all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT, as part of the agency's TRP. This bill also authorizes a local governmental agency to voluntarily submit similar information to CDT.

Comments

Purpose of the bill. According to the author’s office, “cybersecurity is an ever growing threat to both the private and public sectors. For state governments, these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within OIS will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to CDT, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds.”

Related/Prior Legislation

AB 531 (Irwin, 2017) requires OIS, on or before July 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.

AB 1036 (Obernolte, 2017) establishes in statute the California Cybersecurity Integration Center within the OES to develop a cybersecurity strategy for California, which currently operates under the authority of Executive Order B-34-15.

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure, as defined, to submit critical infrastructure information to OES. (Never heard in Senate Governmental Organization Committee)

AB 2595 (Linder, 2016) would have established in statute the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. (Held in Assembly Appropriations Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually.

AB 739 (Irwin, 2015) would have provided legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)

AB 1172 (Chau, 2015) would have continued in existence the California Cybersecurity Task Force, created in 2013 by OES and CDT. (Held on the Senate Inactive File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, significant ongoing costs of approximately $580,000 per year, to CDT for increased workload to process and review submissions.

In addition, the bill adds potentially significant cost pressure, in the tens of thousands, if entities that are not required to report their updated TRP choose to report to CDT. CDT would require additional secured storage space to host the additional information.

Finally, the bill will result in unknown, but potentially significant ongoing costs to state agencies to update their TRP with an inventory of their critical infrastructure controls and associated assets.

SUPPORT: (Verified 9/8/17)

None received

OPPOSITION: (Verified 9/8/17)

None received

ASSEMBLY FLOOR: 76-0, 5/31/17

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bocanegra, Bonta, Brough, Burke, Caballero, Calderon, Cervantes, Chau, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dababneh, Dahle, Daly, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gomez, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Quirk, Quirk-Silva, Reyes, Ridley-Thomas, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NO VOTE RECORDED: Choi, Eggman, Melendez, Patterson

Prepared by:

9/8/17 15:28:09

**** END ****

 THIRD READING  

Bill No: AB 1022

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 6/27/17

AYES: Dodd, Berryhill, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Mendoza, Portantino, Vidak

SENATE JUDICIARY COMMITTEE: 7-0, 7/11/17

AYES: Jackson, Moorlach, Anderson, Hertzberg, Monning, Stern, Wieckowski

SENATE APPROPRIATIONS COMMITTEE: 7-0, 9/1/17

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 76-0, 5/31/17 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill requires state agencies, as part of their Technology Recovery Plan (TRP), to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession.

ANALYSIS:

Existing law:

1. Sets forth the duties of the Office of Emergency Services (OES) with respect to specified emergency preparedness, mitigation, and response activities within the state.
2. Establishes CDT under the supervision of the Director of CDT, and generally requires CDT to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
3. Establishes the Office of Information Security (OIS), within CDT, which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy to ensure the trust of residents of the state.
4. Requires CDT, in consultation with OES, on or before July 1, 2018, to update the TRP element of the State Administrative Manual to ensure inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure information.
5. Requires state agencies, as defined, to report on their compliance with the updated TRP standards to CDT in the manner directed by CDT, no later than July 1, 2019.
6. Defines “critical infrastructure” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
7. Defines a “state agency” as every state office, officer, department, division, bureau, board, and commission. A “state agency” does not include the California State University.

This bill:

1. Requires state agencies, as part of their TRP, to provide CDT with an inventory of all critical infrastructure controls and associated assets in their possession.
2. Authorizes any state or local governmental that is not required to report their updated TRP to CDT to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in their possession.
3. Makes findings and declarations that this bill strikes the appropriate balance between the public’s right to access information about the conduct of their governmental agencies and the need to protect cybersecurity of critical infrastructure controls within the state.
4. Makes other technical and nonsubstantive changes to existing law.

Background

Technology Recovery Plans. The state's TRP program is a sub-set of the state entity’s Business Continuity Plan, which identifies all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Each state entity is required by the State Administrative Manual to develop a TRP in support of the Continuity Plan and the businesses need to protect critical information assets to ensure their availability following an interruption or disaster.

Every state entity must keep its TRP current and provide annual documentation for those updates to CDT. The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing.

AB 1022 explicitly directs all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT, as part of the agency's TRP. This bill also authorizes any other state or local governmental agency to voluntarily submit similar information to CDT.

Comments

Purpose of the bill. According to the author’s office, “cybersecurity is an ever growing threat to both the private and public sectors. For state governments, these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within OIS will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to CDT, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds.”

Related/Prior Legislation

AB 531 (Irwin, 2017) requires OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. (Pending on the Senate Floor)

AB 1036 (Obernolte, 2017) establishes in statute the California Cybersecurity Integration Center (Cal-CSIC) within the OES to develop a cybersecurity strategy for California, which currently operates under the authority of Executive Order B-34-15. (Pending on the Senate Floor)

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure, as defined, to submit critical infrastructure information to OES. (Never heard in Senate Governmental Organization Committee)

AB 2595 (Linder, 2016) would have established in statute the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. (Held in Assembly Appropriations Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually.

AB 739 (Irwin, 2015) would have provided legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)

AB 1172 (Chau, 2015) would have continued in existence the California Cybersecurity Task Force, created in 2013 by OES and CDT. (Held on the Senate Inactive File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, significant ongoing costs of approximately $580,000 per year, to CDT for increased workload to process and review submissions.

In addition, the bill adds potentially significant cost pressure, in the tens of thousands, if entities that are not required to report their updated TRP choose to report to CDT. CDT would require additional secured storage space to host the additional information.

Finally, the bill will result in unknown, but potentially significant ongoing costs to state agencies to update their TRP with an inventory of their critical infrastructure controls and associated assets.

SUPPORT: (Verified 9/1/17)

None received

OPPOSITION: (Verified 9/1/17)

None received

ASSEMBLY FLOOR: 76-0, 5/31/17

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bocanegra, Bonta, Brough, Burke, Caballero, Calderon, Cervantes, Chau, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dababneh, Dahle, Daly, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gomez, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Quirk, Quirk-Silva, Reyes, Ridley-Thomas, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NO VOTE RECORDED: Choi, Eggman, Melendez, Patterson

Prepared by:

9/4/17 12:19:21

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2017 - 2018 Regular Session

AB 1022 (Irwin) - Information technology: Technology Recovery Plans: inventory

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 1022 would require each state agency, as part of their Technology Recovery Plan (TRP) to provide the California Department of Technology (CDT) an inventory of all critical infrastructure controls and their associated assets.

Fiscal Impact:

• Significant ongoing costs of approximately $580,000 per year, to CDT for increased workload to process and review submissions. (GF)
• Potentially significant cost pressure, in the tens of thousands, if entities that are not required to report their updated TRP choose to report to CDT. CDT would require additional secured storage space to host the additional information. (GF)
• Unknown, potentially significant ongoing costs to state agencies to update their TRP with an inventory of their critical infrastructure controls and associated assets. (GF and special funds)

Background:

State agencies are required to develop a TRP in support of their Business Continuity Plan. Every state entity must keep its TRP current and provide CDT with annual documentation of those updates. The TRP must outline a planned approach to managing risks to that entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover state entity administrative information, critical business functions and applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information, and testing. An agency’s TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online.

Proposed Law:

This bill would make changes to the requirement for state agencies’ TRPs. Specifically, this bill would:

• Require state agencies, as part of their TRP, to provide CDT with an inventory of all critical infrastructure controls and associated assets in their possession;
• Authorize any state or local entity that is not required to report their updated TRP to CDT to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in their possession;
• Provide that the inventory submission is confidential and shall not be disclosed pursuant to any state law.

Related Legislation:

AB 531 (Irwin, 2017) would require OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. This bill is pending in the Senate Appropriations Committee.

AB 1306 (Obernolte, 2017) would establish the California Cybersecurity Integration Center (Cal-CSIC) within OES to develop a cybersecurity strategy for California, which currently operates under the authority of an Executive Order. This bill is pending in Senate Appropriations Committee.

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES. This bill was held in the Senate Governmental Organization Committee.

AB 1841 (Irwin Chapter 508, Statutes of 2016) requires CDT, in conjunction with OES, by July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 2595 (Linder, 2016) would have established the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in Coordination with the Cybersecurity Task Force. This bill was held in the Assembly Appropriations Committee.

AB 670 (Irwin, Chapter 518, Statutes of 2015) requires OIS, in consultation with OES, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2017-2018 Regular Session

Bill No: AB 1022 (Author:Irwin)

Version: April 17, 2017

Hearing Date: July 11, 2017

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Information technology: Technology Recovery Plans: inventory

DESCRIPTION

This bill would require each state agency to provide the Department of Technology an inventory of all critical infrastructure controls, and their associated assets. Additional state and local entities would be permitted to also submit such inventories.

BACKGROUND

Within the Department of Technology exists the Office of Information Security led by a chief. The purpose of the Office of Information Security is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The duties of the Office of Information Security are to provide direction for information security and privacy to state government agencies, departments, and offices.

As part of the responsibilities of the Office of Information Security’s chief, the chief must establish an information security program. The program responsibilities include the creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual. These responsibilities also include the creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each state agency’s disaster recovery plan.

The State Administrative Manual provides that each agency/state entity is required to establish and maintain a Technology Recovery Plan, so that it will be able to protect its information assets in the event of a disaster or serious disruption to its operations, and submit the plan or its update to the Office of Information Security as outlined in the Technology Recovery Plan Reporting Schedule.

Last year, AB 1841 (Irwin, Ch. 508, Stats. 2016) was enacted to address increased concerns about cybersecurity attacks, attacks that have become more frequent and sophisticated. In order to streamline disaster planning and resource allocations, AB 1841 required the Department of Technology, in consultation with the Office of Emergency Services, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. “Critical infrastructure controls” was defined to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. “Critical infrastructure information” was defined to mean information not customarily in the public domain pertaining to any of the following:

• actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof;
• the ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure;
• any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls.

Each state agency was also required to provide the department with a copy of its updated Technology Recovery Plan and to report on its compliance with the standards updated by the Department of Technology in the manner and at the time directed by the department, but no later than July 1, 2019.

A recent audit detailing deficiencies in the state’s information security has prompted this bill, which would address some of the issues identified in that audit. This bill would require each state agency, as part of its Technology Recovery Plan, to provide an inventory of all critical infrastructure controls, and their associated assets. Additionally, those state or local entities not required to comply, would be permitted to voluntarily submit such inventories to the Department of Technology. This bill would provide that the required and voluntary inventories of all critical infrastructure controls, and their associated assets provided to the Department of Technology pursuant to this bill are confidential and not subject to the California Public Records Act.

This bill passed out of the Senate Governmental Organization Committee 13-0.

CHANGES TO EXISTING LAW

Existing law, the data breach notification law, requires any agency, person, or business that owns or licenses computerized data that includes personal information to disclose a breach of the security of the system to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified. (Civ. Code Secs. 1798.29(a), (c) and 1798.82(a), (c).)

Existing law, the Information Practices Act of 1977, requires each agency to establish appropriate and reasonable administrative, technical, and physical safeguards to ensure compliance with the provisions of the Act, to ensure the security and confidentiality of records, and to protect against anticipated threats or hazards to their security or integrity which could result in any injury. (Civ. Code Sec. 1798.21.)

Existing law, the California Emergency Services Act, directs the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state, and to coordinate the preparation of plans and programs for the mitigation of the effects of an emergency by the political subdivisions of this state. (Gov. Code Sec. 8569.)

Existing law states that the State Emergency Plan shall be in effect in each political subdivision of the state, and the governing body of each political subdivision shall take such action as may be necessary to carry out the provisions thereof. (Gov. Code Sec. 8568.)

Existing law provides for the Office of Information Security in the Department of Technology whose purpose is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The duties of the Office of Information Security, under the direction of the chief, are to provide direction for information security and privacy to state government agencies, departments, and offices, pursuant to Section 11549.3 of the Government Code. (Gov. Code Sec. 11549.)

Existing law requires the chief of the Office of Information Security to establish an information security program with responsibilities that include the creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual. (Gov. Code Sec. 11549.3.)

Existing law requires the Department of Technology, on or before July 1, 2018, in consultation with the Office of Emergency Services and in compliance with Section 11549.3 of the Government Code, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. The Department of Technology is required to at least consider the following factors:

• costs to implement the standards;
• security of critical infrastructure information;
• centralized management of risk;
• industry best practices;
• continuity of operations; and
• protection of personal information. (Gov. Code Sec. 8592.35(a).)

Existing law defines “critical infrastructure controls” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. (Gov. Code Sec. 8592.30.)

Existing law requires each state agency to provide the Department of Technology with a copy of its updated Technology Recovery Plan. (Gov. Code Sec. 8592.35(b).)

Existing law requires each state agency to report on its compliance with the standards updated pursuant to Section 8592.35 of the Government Code^[1] to the Department of Technology in the manner and at the time directed by the Department of Technology, but no later than July 1, 2019. (Gov. Code Sec. 8592.40(a).)

Existing law provides that the information required by subdivision (b) of Section 8592.35, the report required by subdivision (a) of Section 8592.40, and any public records relating to any communication made pursuant to, or in furtherance of the purposes of, subdivision (b) of Section 8592.40 are confidential and shall not be disclosed pursuant to any state law, including, but not limited to, the California Public Records Act. (Gov. Code Sec. 8592.45.)

Existing law, the California Constitution, declares the people have the right of access to information concerning the conduct of the people’s business, and therefore, the meetings of public bodies and the writings of public officials and agencies shall be open to public scrutiny. (Cal. Const., art. I, Sec. 3.)

Existing law provides individuals an express right to privacy specifically designed to “prevent government . . . from collecting and stockpiling unnecessary information about us and misusing information gathered for one purpose in order to serve another purpose.” (Cal. Const., art. I., Sec. 1; White v. Davis (1975) 13 Cal.3d 757, 774.)

Existing law, the California Public Records Act (CPRA), governs the public disclosure of information collected and maintained by public agencies. (Gov. Code Sec. 6250 et seq.) Generally, all public records are accessible to the public upon request, unless the record requested is exempt from public disclosure. (Gov. Code Sec. 6254.) There are 30 general categories of documents or information that are exempt from disclosure, essentially due to the character of the information, and unless it is shown that the public’s interest in disclosure outweighs the public’s interest in non-disclosure of the information, the exempt information may be withheld by the public agency with custody of the information. (Gov. Code Sec. 6254 et seq.)

Existing law, the California Constitution, requires that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. (Cal. Const., art. 1, Sec. 3.)

This bill would require each state agency, as part of its Technology Recovery Plan, to provide an inventory of all critical infrastructure controls, and their associated assets. Additionally, those state or local entities not required to comply, would be permitted to voluntarily submit such inventories to the Department of Technology. This additional information that would be provided would be considered confidential and not subject to the California Public Records Act.

This bill makes related findings and declarations.

COMMENT

1. Stated need for the bill

According to the author:

Cybersecurity is an ever growing threat to both the private and public sectors. For state government these threats put at risk the ability for agencies and departments to provide critical services to Californians.

While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within the Office of Information Security will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to the Department of Technology, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds.

2. Cyber threats to critical infrastructure are still a concern

With the development of digital technology, the owners and operators of California’s critical infrastructure – things like power plants, water distribution systems, refineries, and communications equipment – have largely replaced outdated analog control systems with digital controls, often interconnected with other systems through computer networks. These updated control systems simplify the management of critical infrastructure and make it more productive. Unfortunately, this same technology also makes our infrastructure vulnerable to cyber attack.

In recent years, critical infrastructure in the United States has been subject to a number of attacks by cybercriminals, including a 2014 incident where an overseas hacker gained access to systems regulating the flow of natural gas. These incidents have prompted state and federal leaders to warn operators of critical infrastructure of the need to bolster cyber defenses to protect against debilitating attacks that threaten our public safety and economic well-being. Indeed, the Governor has declared that “cyber attacks aimed at breaching and damaging computer networks and infrastructure in California represent a major security risk and increase the state’s vulnerability to economic disruption, critical infrastructure damage, privacy violations, and identity theft.” (See Executive Order B-34-15 [August 31, 2015].)

AB 1841 (Irwin, Ch. 508, Stats. 2016) took steps to bolster the security of California’s critical infrastructure controls and critical infrastructure information. The bill required state agencies to implement cybersecurity incident response standards developed by the Department of Technology, in conjunction with the Office of Emergency Services. The goal was, and continues to be, to help agencies plan their responses to cyber attacks carried out against their infrastructure and resources. In return, each agency is required to submit their updated Technology Recovery Plan and to report compliance with the updated standards to the Department of Technology.

However, under the current scheme the chief of the Office of Information Security does not have the capability to know what critical infrastructure assets are under the possession or control of state agencies and what critical infrastructure controls are being utilized to maintain the security and operability of those assets. The author argues that without this information the department is unable to achieve a strategic understanding of the agencies and departments that may require additional oversight or assistance, and is unable to respond to specific threats to certain types of assets or controls.

A California State Auditor’s report in 2015 highlights this issue, finding that many state entities’ information assets are potentially vulnerable to attack or disruption. In relevant part, the report specifically found:

To implement an effective information security program, reporting entities need to maintain a complete, accurate, and up‐to‐date inventory of their information assets. A current inventory is necessary for effective monitoring, testing, and evaluation of information security controls. It is also critical to support information technology planning, budgeting, acquisition, and management. Until reporting entities fully inventory their information assets, they cannot ensure that they have implemented appropriate information system security controls.

This bill would require relevant state agencies to provide, as part of their Technology Recovery Plans, an inventory of all critical infrastructure controls, and their associated assets to the Department of Technology. To further bolster cybersecurity in the state, the bill would permit other state or local entities, who are not under a legal obligation to comply with the above, to also submit inventories of all critical infrastructure controls and their associated assets.

3. Confidentiality is critical

The California Public Records Act (CPRA) generally requires state and local agencies to make all of their records available to the public for inspection upon request. (Gov. Code Sec. 6253.) Section 8592.45 provides that the information required by Section 8592.35(b), the report required by Section 8592.40(a), and any public records relating to communications in connection with Section 8592.40(b) are confidential and cannot be disclosed, even pursuant to the CPRA. (Gov. Code Sec. 8592.45.) AB 1841, which created these limitations on the public’s right of access, included legislative findings justifying such restrictions:

The Legislature finds and declares that . . . Section 8592.45 . . . imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:

Preventing public disclosure of the individual cybersecurity preparations and critical infrastructure information of state agencies promotes public safety by prohibiting access to those who would use that information to thwart the cybersecurity of critical infrastructure controls within the state.

This bill would provide that the required and voluntary inventories of all critical infrastructure controls, and their associated assets provided to the Department of Technology pursuant to this bill are also confidential and not to be disclosed pursuant to any state law. The nature of the information in these inventories and the related records is by definition extremely sensitive. Critical infrastructure controls are the networks and systems that control assets “so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.” (Gov. Code Sec. 8592.30.) Protecting this information is vital to the cybersecurity of our state.

Support: None Known

Opposition: None Known

HISTORY

Source: Author

Related Pending Legislation:

SB 452 (Glazer, 2017) would add “cyberattacks” to the list of conditions that are named in the California Emergency Services Act that may be cited to support the proclamation of a state of emergency or local emergency. This bill is currently in the Assembly Governmental Organization Committee.

AB 1306 (Obernolte, 2017) would create within the Governor’s Office of Emergency Services the California Cybersecurity Integration Center, which would develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. This bill is currently in the Senate Governmental Organization Committee.

AB 531 (Irwin, 2017) would require the Office of Information Security to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content inside or outside the firewall of state agencies. It would require the Office of Information Security to develop a plan to respond to any needs therein identified. This bill is currently in the Senate Governmental Organization Committee.

Prior Legislation:

AB 1841 (Irwin, Ch. 508, Stats. 2016) See Background.

SB 1444 (Hertzberg, 2016) would have required state agencies that own or license computerized data that include personal information to prepare a security plan that details the agency’s strategy to respond to a security breach of that information and its associated consequences. It would have listed certain minimum requirements to be included in an agency’s security plan, including a requirement to inventory personal information stored or transmitted by the agency and procedures for facilitating communication between an incident response team, agency officials, and individuals affected by a breach. This bill died on the Senate inactive file.

AB 670 (Irwin, Ch. 518, Stats. 2015) requires the Office of Information Security, in consultation with the Office of Emergency Services, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

Prior Vote:

Senate Governmental Organization Committee (Ayes 13, Noes 0)

Assembly Floor (Ayes 76, Noes 0)

Assembly Appropriations Committee (Ayes 16, Noes 1)

Assembly Governmental Organization Committee (Ayes 20, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 10, Noes 0)

**************

1. All further statutory references are to the Government Code unless otherwise indicated. ↑

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2017 - 2018 Regular

Bill No: 1022 Hearing Date: 6/27/2017

SUBJECT: Information technology: Technology Recovery Plans: inventory

DIGEST: This bill requires state agencies, as part of their Technology Recovery Plan (TRP), to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession.

ANALYSIS:

Existing law:

1. Sets forth the duties of the Office of Emergency Services (OES) with respect to specified emergency preparedness, mitigation, and response activities within the state.
2. Establishes CDT under the supervision of the Director of CDT, and generally requires CDT to be responsible for the approval and oversight of information technology (IT) projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.
3. Establishes the Office of Information Security (OIS), within CDT, which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy to ensure the trust of residents of the state.
4. Requires CDT, in consultation with OES, on or before July 1, 2018, to update the TRP element of the State Administrative Manual to ensure inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure information.
5. Requires state agencies, as defined, to report on their compliance with the updated TRP standards to CDT in the manner directed by CDT, no later than July 1, 2019.
6. Defines “critical infrastructure” to mean networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.
7. Defines a “state agency” as every state office, officer, department, division, bureau, board, and commission. A “state agency” does not include the California State University.

This bill:

1. Requires state agencies, as part of their TRP, to provide CDT with an inventory of all critical infrastructure controls and associated assets in their possession.
2. Authorizes any state or local governmental that is not required to report their updated TRP to CDT to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in their possession.
3. Makes findings and declarations that this bill strikes the appropriate balance between the public’s right to access information about the conduct of their governmental agencies and the need to protect cybersecurity of critical infrastructure controls within the state.
4. Makes other technical and nonsubstantive changes to existing law.

Background

Purpose of the bill. According to the author’s office, “cybersecurity is an ever growing threat to both the private and public sectors. For state governments, these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within OIS will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to CDT, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds.”

Technology Recovery Plans. The state's TRP program is a sub-set of the state entity’s Business Continuity Plan, which identifies all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Each state entity is required by the State Administrative Manual to develop a TRP in support of the Continuity Plan and the businesses need to protect critical information assets to ensure their availability following an interruption or disaster.

Every state entity must keep its TRP current and provide annual documentation for those updates to CDT. The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing.

AB 1022 would explicitly direct all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT, as part of the agency's TRP. This bill would also authorize any other state or local governmental agency to voluntarily submit similar information to CDT.

Snapshot of California’s critical infrastructure. According to OES, the following represents a snapshot of California’s critical infrastructure:

• Water: 1468 dams, of which 140 have capacities greater than 10,000 acre-feet; 701 miles of canals and pipelines; and 1.595 miles of levees.
• Electrical Power: 1,008 in state power plants, nearly 70,000 megawatts install generation capacity, and substations and transmission lines deliver over 200 billion kilowatt hours to customers annually.
• Oil and Natural Gas: over 115,000 miles of oil and natural gas pipelines, 20 refineries and over 100 oil and natural gas terminal facilities, and more than a dozen of the U.S.’s largest oil fields.
• Transportation: over 170,000 miles of public roads; over 50,000 lane miles of highways; over 12,000 bridges; 246 public use airports, 30 of which provide scheduled passenger service. Los Angeles Airport is the seventh busiest worldwide.
• California has 11 seaports handling more than half of all the US shipping freight. Three of the country’s largest container ports are in California: Los Angeles, Long Beach, and Oakland. Nationally, Los Angeles is the busiest container volume, internationally the eighth busiest, and when combined with Long Beach is the fifth busiest.
• Public Health: 450 acute care hospitals.
• Emergency Services: 1,974 fire stations.
• Chemical: Approximately 95 “high risk” facilities.
• Agriculture: 81,500 farms; more than 400 commodities; in 2012 total agriculture-related sales for output was $44.7 billion, representing 11.3% of the national total.
• Finance: 7,374 commercial banks with deposits totaling $753 billion; 410 credit unions with assets totaling $115 billion.

Prior/Related Legislation

AB 531 (Irwin, 2017) would require OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. (Pending in Senate Governmental Organization Committee)

AB 1036 (Obernolte, 2017) would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the OES to develop a cybersecurity strategy for California, which currently operates under the authority of Executive Order B-34-15. (Pending in the Senate Governmental Organization Committee)

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure, as defined, to submit critical infrastructure information to OES. (Never heard in Senate Governmental Organization Committee)

AB 2595 (Linder, 2016) would have established in statute the California Cybersecurity Integration Center within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. (Held in Assembly Appropriations Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually.

AB 739 (Irwin, 2015) would have provided legal immunity for civil or criminal liability for private entities that communicate anonymized cyber security threat information and meet specified requirements, until January 1, 2020. (Held in Assembly Judiciary Committee)

AB 1172 (Chau, 2015) would have continued in existence the California Cybersecurity Task Force, created in 2013 by OES and CDT. (Held on the Senate Inactive File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

None received

OPPOSITION:

None received

DUAL REFERRAL: Senate Judiciary Committee

ASSEMBLY THIRD READING

ATR Bill Id:AB 1022

Author:(Irwin)

As Amended Ver:April 17, 2017

Majority vote

SUMMARY: Requires state agencies to include within their Technology Recovery Plan (TRP) an inventory of all critical infrastructure controls and associated assets. Specifically, this bill:

1. Requires state agencies, as part of their TRP, to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession.
2. Authorizes any state or local governmental entity that is not required to report their updated TRP to CDT to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in the possession of the entity, to CDT.
3. Declares the reports required or authorized by this bill to be confidential, and shall not be disclosed pursuant to any state law, including the California Public Records Act.
4. Makes findings and declarations that this bill strikes the appropriate balance between the public's right to access information about the conduct of their governmental agencies and the need to protect the cybersecurity of critical infrastructure controls within the state.
5. Makes other technical or nonsubstantive amendments.

FISCAL EFFECT: According to the Assembly Appropriations Committee, GF costs of about $620,000 annually, primarily for staff to handle increased workload to receive, review, and store the additional information.

COMMENTS:

1. Purpose of this bill: This bill is intended to give CDT access to more complete information about state agency critical infrastructure assets and controls by requiring state agencies to submit inventories of those assets and controls as part of the pre-existing TRP program. This bill is author-sponsored.
2. Author's statement: According to the author, "[c]ybersecurity is an ever growing threat to both the private and public sectors. For state government these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California's state agencies and departments continue to mature their information security programs, additional strategic capabilities within the Office of Information Security will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to the Department of Technology, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds. "
3. Technology Recovery Plans: The state's TRP program is a sub-set of the state entity's Business Continuity Plan, which is premised on identifying all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Every state entity is required by the State Administrative Manual (section 5325.1) to develop a TRP in support of the Continuity Plan and the business need to protect critical information assets to ensure their availability following an interruption or disaster.

Every state entity must keep its TRP up-to-date and provide annual documentation for those updates to the Chief Information Security Officer (CISO). The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing. (State Information Management Manual (SIMM) Section 5325-A)

The SIMM 5325-A instructions do currently require description of critical business functions and their supporting applications (SIMM 5325-A(2.1)), and a comprehensive list of the equipment, space, telecommunication needs, data, software, hard-copy references (forms and procedures), and personnel necessary for recovery (SIMM 5325-A(7.1)).

This bill would explicitly direct all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT (specifically, the CISO), as part of the agency's TRP. The bill would also authorize any other state or local governmental agency to voluntarily submit a similar inventory to CDT as well.

The author contends that this inventory is necessary so that the CISO has a better strategic view of the state's critical infrastructure assets and controls, making "the inventory no longer an optional appendix, but a key component of the report that can be accessed by the CDT for planning, budgeting, and security purposes."

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000696

Date of Hearing: May 17, 2017

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 1022

Author:(Irwin) – As Amended Ver:April 17, 2017

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill adds to the information that a state agency must include in its already-required Technology Recovery Plan (TRP). Specifically, this bill:

1. Requires state agencies to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession, as part of the TRPs.
2. Allows any state or local governmental entity not subject to the TRP requirements to voluntarily submit to CDT an inventory of all critical infrastructure controls and associated assets.
3. Declares the reports required or authorized by this bill to be confidential, and not be disclosed pursuant to any state law, including the California Public Records Act.

FISCAL EFFECT:

GF costs of about $620,000 annually, primarily for staff to handle increased workload to receive, review, and store the additional information.

COMMENTS:

1. Background. Under existing law, by July 1, 2018, CDT must update the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. Existing law also requires state agencies to report to CDT on their compliance with the updated TRP standards by July 1, 2019.
2. Purpose. This bill is intended to give CDT access to more complete information about state agency critical infrastructure assets and controls by requiring state agencies to submit inventories of those assets and controls as part of the TRP program. According to the author, "Cybersecurity is an ever growing threat to both the private and public sectors. For state government these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within the Office of Information Security will help ensure the state is protected against cyber threats. By
3. reporting critical infrastructure control inventories to the Department of Technology, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds."

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 27, 2017

ASSEMBLY COMMITTEE ON GOVERNMENTAL ORGANIZATION

Adam Gray, Chair

ABPCA Bill Id:AB 1022 (

Author:Irwin) – As Amended Ver:April 17, 2017

SUBJECT: Information technology: Technology Recovery Plans: inventory

SUMMARY: Requires state agencies to include within their Technology Recovery Plan (TRP) an inventory of all critical infrastructure controls and associated assets. Specifically, this bill:

1. Requires state agencies, as part of their TRP, to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession.
2. Authorizes any state or local governmental entity that is not required to report their updated TRP to CDT to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in the possession of the entity, to CDT.
3. Declares the reports required or authorized by this bill to be confidential, and shall not be disclosed pursuant to any state law, including the California Public Records Act.
4. Makes findings and declarations that this bill strikes the appropriate balance between the public's right to access information about the conduct of their governmental agencies and the need to protect the cybersecurity of critical infrastructure controls within the state.
5. Makes other technical or non-substantive amendments.

EXISTING LAW:

1. Establishes the Office of Emergency Services (CalOES) by the Governor's Reorganization Plan No.2, operative July 1, 2013.
2. Requires CalOES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
3. requires the Department of Technology, in consultation with the Office of Emergency Services and in compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information.
4. Establishes CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer.
5. Requires state entities to implement the information security and privacy policies, standards and procedures issued by the Office of Information Security (OIS).
6. Requires CDT, on or before July 1, 2018, to update the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information.
7. Requires state agencies to report on their compliance with the updated Technology Recovery Plan standards to CDT in the manner and at the time directed by CDT no later than July 1, 2019.
8. Defines "critical infrastructure controls" as networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof.

FISCAL EFFECT: Unknown

COMMENTS:

Purpose of the bill: According to the author, "cybersecurity is an ever growing threat to both the private and public sectors. For state government these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within the Office of Information Security will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to the Department of Technology, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds."

CalOES: The California Disaster Act was enacted by the State Legislature in 1945. The Act combined responsibility for planning and preparing for emergencies, whether natural, technological and human-caused into a single state agency. The California Emergency Services Act was enacted in 1970 to supersede the California Disaster Act. The new Act established the Governor's Office Emergency Services with a Director reporting to the Governor. The office was given responsibility to coordinate statewide emergency preparedness, post emergency recovery and mitigation efforts, and the development, review, approval, and integration of emergency plans.

In 2009, the California Legislature merged the powers, purposes, and responsibilities of the former Cal OES with those of the Office of Homeland Security (OHS) into the newly- created California Emergency Management Agency (CalEMA). On July 1, 2013, Governor Edmund G. Brown Jr.’s Reorganization Plan #2 eliminated Cal EMA and restored it to the Governor’s Office, renaming it the California Governor’s Office of Emergency Services (CalOES), and merging it with the Office of Public Safety Communications. Today, CalOES is responsible for overseeing and coordinating emergency preparedness, response, recovery and homeland security activities within the state.

Current law requires the CDT, in consultation with CalOES to update the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information.

Technology Recovery Plans: According to the Committee on Privacy and Consumer Protection, the state's TRP program is a sub-set of the state entity’s Business Continuity Plan, which is premised on identifying all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Every state entity is required by the State Administrative Manual (section 5325.1) to develop a TRP in support of the Continuity Plan and the business need to protect critical information assets to ensure their availability following an interruption or disaster.

Every state entity must keep its TRP up-to-date and provide annual documentation for those updates to the Chief Information Security Officer. The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing. (State Information Management Manual (SIMM) Section 5325-A)

The SIMM 5325-A instructions do currently require description of critical business functions and their supporting applications (SIMM 5325-A(2.1)), and a comprehensive list of the equipment, space, telecommunication needs, data, software, hard-copy references (forms and procedures), and personnel necessary for recovery (SIMM 5325-A(7.1)).

AB 1022 would explicitly direct all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT (specifically, the CISO), as part of the agency's TRP. The bill would also authorize any other state or local governmental agency to voluntarily submit a similar inventory to CDT as well.

The author contends that this inventory is necessary so that the CISO has a better strategic view of the state's critical infrastructure assets and controls, making "the inventory no longer an optional appendix, but a key component of the report that can be accessed by the CDT for planning, budgeting, and security purposes."

Prior/Related Legislation: AB 531 (Irwin) of 2017/2018 of the Legislative Session. Would require the state OIS to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, and develop a plan for state agencies to implement any information security technology OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency. (Pending in Assembly Privacy and Consumer Protection Committee)

AB 1306 (Obernolte) of 2017/2018 Legislative Session. Would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California, which currently operates under the authority of Executive Order B-34-15 (August 31, 2015). (Pending in the Assembly Governmental Organization Committee).

AB 1841 (Irwin), Chapter 508, Statutes of 2016. Requires CDT, in conjunction with OES, to update by July 1, 2018, the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 1881 (Chang) of 2015/2016 of the Legislative Session. Would have required the Director of CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held on Suspense in the Assembly Appropriations Committee).

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Kenton Stanhope / G.O. / (916) 319-2531

Date of Hearing: April 18, 2017

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 1022 (

Author:Irwin) – As Amended Ver:April 17, 2017

SUBJECT: Information technology: Technology Recovery Plans: inventory

SUMMARY: Requires state agencies to include within their Technology Recovery Plan (TRP) an inventory of all critical infrastructure controls and associated assets. Specifically, this bill:

1. Requires state agencies, as part of their TRP, to provide the California Department of Technology (CDT) with an inventory of all critical infrastructure controls and associated assets in their possession.
2. Authorizes any state or local governmental entity that is not required to report their updated TRP to CDT to voluntarily submit an inventory of all critical infrastructure controls, and their associated assets, in the possession of the entity, to CDT.
3. Declares the reports required or authorized by this bill to be confidential, and shall not be disclosed pursuant to any state law, including the California Public Records Act.
4. Makes findings and declarations that this bill strikes the appropriate balance between the public's right to access information about the conduct of their governmental agencies and the need to protect the cybersecurity of critical infrastructure controls within the state.
5. Makes other technical or nonsubstantive amendments.

EXISTING LAW:

1. Establishes CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Government Code Section (GC) 11545(a))
2. Requires state entities to implement the information security and privacy policies, standards and procedures issued by the Office of Information Security (OIS). (GC 11549.3(b))
3. Requires CDT, on or before July 1, 2018, to update the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. (GC 8592.35(a))
4. Requires state agencies to report on their compliance with the updated Technology Recovery Plan standards to CDT in the manner and at the time directed by CDT no later than July 1, 2019. (GC 8592.40(a))
5. Defines "critical infrastructure controls" as networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. (GC 8592.30(a))

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill is intended to give CDT access to more complete information about state agency critical infrastructure assets and controls by requiring state agencies to submit inventories of those assets and controls as part of the pre-existing TRP program. This bill is author-sponsored.
2. Author's statement: According to the author, "[c]ybersecurity is an ever growing threat to both the private and public sectors. For state government these threats put at risk the ability for agencies and departments to provide critical services to Californians. While California’s state agencies and departments continue to mature their information security programs, additional strategic capabilities within the Office of Information Security will help ensure the state is protected against cyber threats. By reporting critical infrastructure control inventories to the Department of Technology, project and budgetary oversight will be more informed and allow for efficient use of taxpayer funds. "
3. Technology Recovery Plans: The state's TRP program is a sub-set of the state entity’s Business Continuity Plan, which is premised on identifying all business functions within a state entity, and then assigning a level of importance to each business function. An agency's TRP is activated immediately after a disaster strikes and focuses on getting critical systems back online. Every state entity is required by the State Administrative Manual (section 5325.1) to develop a TRP in support of the Continuity Plan and the business need to protect critical information assets to ensure their availability following an interruption or disaster.
   
   Every state entity must keep its TRP up-to-date and provide annual documentation for those updates to the Chief Information Security Officer (CISO). The TRP must outline a planned approach to managing risks to the state entity’s mission, including risk and potential impact to critical information technology assets. The TRP is currently required to cover: state entity administrative information, critical business functions/applications, recovery strategy, backup and offsite storage procedures, technology recovery procedures, data center services, resource requirements, assignments of responsibility, contact information and testing. (State Information Management Manual (SIMM) Section 5325-A)
   
   The SIMM 5325-A instructions do currently require description of critical business functions and their supporting applications (SIMM 5325-A(2.1)), and a comprehensive list of the equipment, space, telecommunication needs, data, software, hard-copy references (forms and procedures), and personnel necessary for recovery (SIMM 5325-A(7.1)).
   
   AB 1022 would explicitly direct all state agencies to provide an inventory of all critical infrastructure controls and associated assets to CDT (specifically, the CISO), as part of the agency's TRP. The bill would also authorize any other state or local governmental agency to voluntarily submit a similar inventory to CDT as well.
   
   The author contends that this inventory is necessary so that the CISO has a better strategic view of the state's critical infrastructure assets and controls, making "the inventory no longer an optional appendix, but a key component of the report that can be accessed by the CDT for planning, budgeting, and security purposes."
4. Related legislation: AB 531 (Irwin) would require the state OIS to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, and develop a plan for state agencies to implement any information security technology OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency. AB 531 is currently pending in this Committee.

AB 1306 (Obernolte) would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California, which currently operates under the authority of Executive Order B-34-15 (August 31, 2015). AB 1306 is currently pending in the Assembly Governmental Organization Committee.

1. Previous legislation: AB 1841 (Irwin), Chapter 508, Statutes of 2016, requires CDT, in conjunction with OES, to update by July 1, 2018, the TRP element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.
   
   AB 1881 (Chang) would have required the Director of CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. AB 1881 was held on Suspense in the Assembly Appropriations Committee.
2. Double-referral: This bill is double-referred to the Assembly Governmental Organization Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Hank Dempsey / P. & C.P. /