Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the Cal-CSIC within the Office of Emergency Services to develop a statewide cybersecurity strategy for California in coordination with the Cybersecurity Task Force. The bill would provide that Cal-CSIC would have the same primary mission as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include, but not be limited to, representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would incorporate language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information. The bill would also direct all state departments and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist the California Governors Office of Emergency Services and the Cal-CSIC.

The bill would authorize the Governor to suspend the operations of the Cal-CSIC if federal funding for its continued operation is unavailable. The bill would prohibit the Cal-CSIC from requiring private sector companies to share information but would permit voluntary sharing.

Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the Cal-CSIC within the Office of Emergency Services to develop a statewide cybersecurity strategy for California in coordination with the Cybersecurity Task Force. The bill would provide that Cal-CSIC would have the same primary mission as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include, but not be limited to, representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would incorporate language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information. The bill would also direct all state departments and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist the California Governors Office of Emergency Services and the Cal-CSIC.

The bill would authorize the Governor to suspend the operations of the Cal-CSIC if federal funding for its continued operation is unavailable. The bill would prohibit the Cal-CSIC from requiring private sector companies to share information but would permit voluntary sharing.

(1)Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the Cal-CSIC within the Office of Emergency Services to develop a statewide cybersecurity strategy for California in coordination with the Cybersecurity Task Force. The bill would provide that Cal-CSIC would have the same primary mission as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include, but not be limited to, representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others. The

The bill would incorporate the language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, develop a statewide cyber security strategy, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information. The bill would also direct all state departments and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist the California Governors Office of Emergency Services and the Cal-CSIC.

The bill would authorize the Governor to suspend the operations of the Cal-CSIC if federal funding for its continued operation is unavailable. The bill would prohibit the Cal-CSIC from requiring private sector companies to share information but would permit voluntary sharing.

Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center, Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the California Cybersecurity Integration Center Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) Cal-CSIC within the Office of Emergency Services to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. The bill would provide that Cal-CSIC would have the same primary mission as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include, but not be limited to, representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others. The bill would incorporate the language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, develop a statewide cyber security strategy, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information. The bill would also direct all state departments and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist the California Governors Office of Emergency Services and the Cal-CSIC.

Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the California Cybersecurity Integration Center be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. The bill would provide that Cal-CSIC would have the same primary mission as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include, but not be limited to, representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would authorize the Director of Emergency Services, as specified, to administer, authorize, and allocate federal homeland security grant funding and would require the director to prioritize grant funding for prevention measures undertaken by the Office of Information Security in the Department of Technology in furtherance of a specified provision of the Governors Executive order. The bill also would specify the authority of the Director of Emergency Services to administer the grant programs to respond to statewide emergencies requiring immediate attention.

Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the California Cybersecurity Integration Center be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force. The bill would provide that Cal-CSIC would have the same primary mission as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include, but not be limited to, representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would authorize the Director of Emergency Services, as specified, to administer, authorize, and allocate federal homeland security grant funding and would require the director to prioritize grant funding for prevention measures undertaken by the Office of Information Security in the Department of Technology in furtherance of a specified provision of the Governors Executive order. The bill also would specify the authority of the Director of Emergency Services to administer the grant programs to respond to statewide emergencies requiring immediate attention.

The bill would require that the Department of Technology be included in the cyber attack response portion of the State Emergency Plan.

GOVERNOR'S VETO

GV Bill Id:AB 1306

Author:(Obernolte)

As Enrolled Ver:September 15, 2017

2/3 vote

Original Committee Reference: P. & C.P.

SUMMARY: Codifies in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a statewide cybersecurity strategy in coordination with the California Task Force on Cybersecurity (Task Force), authorizes the Governor to suspend the operations of the Cal-CSIC if federal funding is unavailable, and prohibits the Cal-CSIC from requiring private sector companies to share information.

The Senate amendments

1. Clarify that OES is required to establish and lead the Cal-CSIC which shall serve as the central organizing hub of state government's cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
2. Expand the list of representatives of which the Cal-CSIC shall be comprised to include:
   1. United States Department of Homeland Security;
   2. United States Federal Bureau of Investigation;
   3. United States Secret Service;
   4. United States Coast Guard; and
   5. Other members as designated by the Director of OES.
3. Require the Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security — National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources.
4. Require the Cal-CSIC to do all of the following:
5. Provide warnings of cyber-attacks to government agencies and nongovernmental partners and coordinate information sharing among these entities.
6. Assess risks to critical infrastructure and information technology networks.
7. Prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks.
8. Enable cross-sector coordination and sharing of recommended best practices and security measures.
9. Support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of California's agencies and departments.
10. Clarify that the Cal-CSIC statewide cybersecurity strategy, informed by recommendations from the Task Force, is required to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers. The strategy is also intended to strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among California's workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
11. Require the Cal-CSIC to establish a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team shall also provide assistance to law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and to agencies responsible for advancing information security within state government. This team shall be comprised of personnel from agencies, departments, and organizations represented on the Cal-CSIC.
12. Require information sharing by the Cal-CSIC to be conducted in a manner that protects the privacy and civil liberties of individuals; safeguards sensitive information; preserves business confidentiality; and enables public officials to detect, investigate, respond to, and prevent cyber-attacks that threaten public health and safety, economic stability, and national security.
13. Strike references to the authorization of the Director to administer, authorize, and allocate federal homeland security grant funding and delete the clarification stating that the provisions of this bill do not preclude the Director from administering the grant programs to respond to statewide emergencies requiring immediate attention.
14. Authorize the Governor, by executive order, to suspend the operations of the Cal-CSIC if federal funds for its continued operation are not available. Requires the suspension to remain in effect only until federal funds for the operation of the Cal-CSIC become available.
15. Require all state department and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist the California Governor's Office of Emergency Services and the Cal-CSIC.
16. Delete the definitions for "prevention measures" and "federal homeland security grant funding."
17. Prohibit the Cal-CSIC from either duplicating the efforts of other governmental agencies or requiring involuntary information sharing by private sector entities.

EXISTING LAW:

1. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The Act creates within the office of the Governor the OES, which is responsible for the state's emergency and disaster response services, as specified. (Government Code Sections 8550-8668, et seq.; 8569; 8585)
2. Requires, by Executive order in 2015, OES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15)

FISCAL EFFECT: According to the Senate Appropriations Committee, significant cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated and the Governor not suspend the Cal-CSIC. (General Fund)

COMMENTS:

This bill would have codified in statute the Cal-CSIC created by Governor Brown's Executive Order in 2015. In doing so, this bill would prevent any current or any future Governor from modifying or deleting its provisions without a legislative change.

On August 31, 2015, Governor Brown signed Executive Order B-34-15 to establish the Cal-CSIC with the goal to "bolster California's preparedness and response to destructive cyber-attacks." Cal-CSIC is charged with serving as as the "central organizing hub" of state government's cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from 15 different state and federal public entities.

Its main purposes are threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CSIC is responsible for developing a statewide cybersecurity strategy. Cal-CSIC is also charged with establishing a CIRT to serve as California's primary unit to lead cyber threat detection, reporting, and response.

GOVERNOR'S VETO MESSAGE:

Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center's flexibility as it pursues its mission to protect the state against cyberattacks.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002450

1306CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1306

Author:(Obernolte)

As Amended Ver:September 8, 2017

Majority vote

Original Committee Reference: P. & C.P.

SUMMARY: Codifies in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a statewide cybersecurity strategy in coordination with the California Task Force on Cybersecurity (Task Force), authorizes the Governor to suspend the operations of the Cal-CSIC if federal funding is unavailable, and prohibits the Cal-CSIC from requiring private sector companies to share information.

The Senate amendments

1. Clarify that OES is required to establish and lead the Cal-CSIC which shall serve as the central organizing hub of state government's cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
2. Expand the list of representatives of which the Cal-CSIC shall be comprised to include:  
3. United States Department of Homeland Security;
4. United States Federal Bureau of Investigation;
5. United States Secret Service;
6. United States Coast Guard; and
7. Other members as designated by the Director of OES.
8. Require the Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security — National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources.
9. Require the Cal-CSIC to do all of the following:
10. Provide warnings of cyber-attacks to government agencies and nongovernmental partners and coordinate information sharing among these entities.
11. Assess risks to critical infrastructure and information technology networks.
12. Prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks.
13. Enable cross-sector coordination and sharing of recommended best practices and security measures.
14. Support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of California's agencies and departments.
15. Clarify that the Cal-CSIC statewide cybersecurity strategy, informed by recommendations from the Task Force, is required to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers. The strategy is also intended to strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among California's workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
16. Require the Cal-CSIC to establish a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team shall also provide assistance to law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and to agencies responsible for advancing information security within state government. This team shall be comprised of personnel from agencies, departments, and organizations represented on the Cal-CSIC.
17. Require information sharing by the Cal-CSIC to be conducted in a manner that protects the privacy and civil liberties of individuals; safeguards sensitive information; preserves business confidentiality; and enables public officials to detect, investigate, respond to, and prevent cyber-attacks that threaten public health and safety, economic stability, and national security.
18. Strike references to the authorization of the Director to administer, authorize, and allocate federal homeland security grant funding and delete the clarification stating that the provisions of this bill do not preclude the Director from administering the grant programs to respond to statewide emergencies requiring immediate attention.
19. Authorize the Governor, by executive order, to suspend the operations of the Cal-CSIC if federal funds for its continued operation are not available. Requires the suspension to remain in effect only until federal funds for the operation of the Cal-CSIC become available.
20. Require all state department and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist the California Governor's Office of Emergency Services and the Cal-CSIC.
21. Delete the definitions for "prevention measures" and "federal homeland security grant funding."
22. Prohibit the Cal-CSIC from either duplicating the efforts of other governmental agencies or requiring involuntary information sharing by private sector entities.

EXISTING LAW:

1. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The Act creates within the office of the Governor the OES, which is responsible for the state's emergency and disaster response services, as specified. (Government Code Sections 8550-8668, et seq.; 8569; 8585)
2. Requires, by Executive order in 2015, OES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15)

FISCAL EFFECT: According to the Senate Appropriations Committee, significant cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated and the Governor not suspend the Cal-CSIC. (General Fund)

COMMENTS:

This bill codifies in statute the Cal-CSIC created by Governor Brown's Executive Order in 2015. In doing so, this bill prevents any current or any future Governor from modifying or deleting its provisions without a legislative change.

According to the author's office, "cybersecurity is a growing concern to our State. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state's response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measures that are in line with our cybersecurity readiness goals."

On August 31, 2015, Governor Brown signed Executive Order B-34-15 to establish the Cal-CSIC with the goal to "bolster California's preparedness and response to destructive cyber-attacks." Cal-CSIC is charged with serving as as the "central organizing hub" of state government's cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from 15 different state and federal public entities.

Its main purposes are threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CSIC is responsible for developing a statewide cybersecurity strategy. Cal-CSIC is also charged with establishing a CIRT to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT provides assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002304

 THIRD READING  

Bill No: AB 1306

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 7/11/17

AYES: Dodd, Berryhill, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Mendoza, Portantino, Vidak

SENATE APPROPRIATIONS COMMITTEE: 7-0, 9/1/17

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 73-1, 5/30/17 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill establishes in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a stateside cybersecurity strategy for California in coordination with the Cybersecurity Task Force, as specified.

Senate Floor Amendments of 9/8/17 delete a provision that prohibits Cal-CSIC from sharing or disclosing information voluntarily obtained from private sector companies.

ANALYSIS:

Existing law:

1. Establishes OES by the Governor’s Reorganization Plan No.2, operative July 1, 2013.
2. Requires OES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
3. Requires OES, by Executive Order B-34-15, to establish the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
4. Requires, by Executive Order B-34-15, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.
5. Establishes the Office of Information Security (OIS), within the California Department of Technology, to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this State.
6. Requires, under the California Public Records Act, state and local agencies to make their records available for public inspections, unless an exemption from disclosure applies.

This bill:

1. Establishes in statute the Cal-CSIC within OES to develop a statewide cybersecurity strategy for California in coordination with the Cybersecurity Task Force.
2. Provides that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
3. Specifies that Cal-CSIC shall serve as the central organizing hub of state government’s cybersecurity activities, as specified.
4. Provides that a specified list of individuals shall compromise that the membership of the Cal-CSIC.
5. Requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security, as specified.
6. Requires Cal-CSIC to establish a Cyber Incident Response Team that shall serve as the State’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state and other specified duties in a specified manner.
7. Authorizes the Governor, by executive order, to suspend the operation of Cal-CSIC if federal funds are not available.
8. Specifies that Cal-CSIC shall not duplicate the efforts of other governmental agencies, or require involuntary information sharing by private sector entities.

Background

Purpose of the bill. According to the author’s office, “cybersecurity is a growing concern to our State. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state’s response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measures that are in line with our cybersecurity readiness goals.”

Executive Order B-34-15. On August 31, 2015, Governor Brown signed Executive Order B-34-15 with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.” With that goal in mind, the Executive Order established the Cal-CISC.

Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the "central organizing hub" of state government's cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from different state and federal public entities.

Its main purpose is threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CISC is responsible for developing a statewide cybersecurity strategy.

Cal-CISC is also charged with establishing a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT provides assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity.

This bill establishes the Cal-CSIC in statute. In doing so, this bill prevents any current or any future Governor from modifying or deleting its provisions.

Related/Prior Legislation

AB 531 (Irwin, 2017) requires the OIS, on or before July 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. (Pending on the Senate Floor)

AB 1841 (Irwin, Chapter 508, Statutes of 2016) required OES to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further required OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019.

AB 1881 (Chang, 2016) would have required the Director of the California Department of Technology to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held in the Assembly Appropriations Committee Suspense File)

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Never heard in Senate Governmental Organizations Committee)

AB 2595 (Linder, 2015) would have established Cal-CSIC in statute to develop a cybersecurity strategy for California. (Held in Assembly Appropriations Committee Suspense File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, the bill would result in significant cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated and the Governor not suspend the Cal-CSIC.

SUPPORT: (Verified 9/8/17)

None received

OPPOSITION: (Verified 9/8/17)

None received

ASSEMBLY FLOOR: 73-1, 5/30/17

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bocanegra, Bonta, Brough, Burke, Caballero, Calderon, Cervantes, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dababneh, Dahle, Daly, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gomez, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Ridley-Thomas, Rodriguez, Salas, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NOES: Irwin

NO VOTE RECORDED: Chau, Choi, Eggman, Limón, Rubio, Santiago

Prepared by:

9/12/17 9:25:01

**** END ****

 THIRD READING  

Bill No: AB 1306

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 7/11/17

AYES: Dodd, Berryhill, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Mendoza, Portantino, Vidak

SENATE APPROPRIATIONS COMMITTEE: 7-0, 9/1/17

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 73-1, 5/30/17 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill establishes in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a stateside cybersecurity strategy for California in coordination with the Cybersecurity Task Force, as specified.

Existing law:

1. Establishes OES by the Governor’s Reorganization Plan No.2, operative July 1, 2013.
2. Requires OES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
3. Requires OES, by Executive Order B-34-15, to establish the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
4. Requires, by Executive Order B-34-15, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.
5. Establishes the Office of Information Security (OIS), within the California Department of Technology, to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this State.
6. Requires, under the California Public Records Act, state and local agencies to make their records available for public inspections, unless an exemption from disclosure applies.

This bill:

1. Establishes in statute the Cal-CSIC within OES to develop a statewide cybersecurity strategy for California in coordination with the Cybersecurity Task Force.
2. Provides that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
3. Specifies that Cal-CSIC shall serve as the central organizing hub of state government’s cybersecurity activities, as specified.
4. Provides that a specified list of individuals shall compromise that the membership of the Cal-CSIC.
5. Requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security, as specified.
6. Requires Cal-CSIC to establish a Cyber Incident Response Team that shall serve as the State’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state and other specified duties in a specified manner.
7. Authorizes the Governor, by executive order, to suspend the operation of Cal-CSIC if federal funds are not available.
8. Specifies that Cal-CSIC shall not duplicate the efforts of other governmental agencies, require involuntary information sharing by private sector entities, or release to the public any information that is voluntarily provided to private sector entities.

Background

Purpose of the bill. According to the author’s office, “cybersecurity is a growing concern to our State. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state’s response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measures that are in line with our cybersecurity readiness goals.”

Executive Order B-34-15. On August 31, 2015, Governor Brown signed Executive Order B-34-15 with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.” With that goal in mind, the Executive Order established the Cal-CISC.

Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the "central organizing hub" of state government's cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from different state and federal public entities.

Its main purpose is threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CISC is responsible for developing a statewide cybersecurity strategy.

Cal-CISC is also charged with establishing a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT provides assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity.

This bill establishes the Cal-CSIC in statute. In doing so, this bill prevents any current or any future Governor from modifying or deleting its provisions.

Related/Prior Legislation

AB 531 (Irwin, 2017) requires the OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. (Pending on the Senate Floor)

AB 1841 (Irwin, Chapter 508, Statutes of 2016) required OES to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further required OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019.

AB 1881 (Chang, 2016) would have required the Director of the California Department of Technology to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held in the Assembly Appropriations Committee Suspense File)

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Never heard in Senate Governmental Organizations Committee)

AB 2595 (Linder, 2015) would have established Cal-CSIC in statute to develop a cybersecurity strategy for California. (Held in Assembly Appropriations Committee Suspense File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, the bill would result in significant cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated and the Governor not suspend the Cal-CSIC.

SUPPORT: (Verified 9/1/17)

None received

OPPOSITION: (Verified 9/1/17)

None received

ASSEMBLY FLOOR: 73-1, 5/30/17

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bocanegra, Bonta, Brough, Burke, Caballero, Calderon, Cervantes, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dababneh, Dahle, Daly, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gomez, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Ridley-Thomas, Rodriguez, Salas, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NOES: Irwin

NO VOTE RECORDED: Chau, Choi, Eggman, Limón, Rubio, Santiago

Prepared by:

9/3/17 18:13:11

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2017 - 2018 Regular Session

AB 1306 (Obernolte) - California Cybersecurity Integration Center

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on September 1, 2017

Bill Summary:

AB 1306 would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California, in coordination with the Cybersecurity Task Force.

Fiscal Impact:

• Significant cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated and the Governor not suspend the Cal-CSIC. (GF)

Author Amendments:

• Authorize the Governor to suspend the Cal-CSIC if federal funds are not available, as specified.
• Specify that the Cal-CSIC shall not duplicate the efforts of other governmental agencies.
• Specify the requirements on information sharing.

-- END --

SENATE COMMITTEE ON APPROPRIATIONS

Senator Ricardo Lara, Chair

2017 - 2018 Regular Session

AB 1306 (Obernolte) - California Cybersecurity Integration Center

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 1306 would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California, in coordination with the Cybersecurity Task Force.

Fiscal Impact:

• Significant cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated. (GF)

Background:

On August 31, 2015, Governor Brown signed an Executive Order that established the Cal-CSIC to work closely with the California State Threat Assessment System and the U.S Department of Homeland Security to “bolster California’s preparedness and response to destructive cyber-attacks.”

The main purpose of the Cal-CSIC is threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination, sharing of best practices, and developing a statewide cybersecurity strategy. The Cal-CSIC is also charged with establishing a Cyber Incident Response Team to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state.

Proposed Law:

This bill would establish in statute the Cal-CSIC within OES to develop a cybersecurity strategy for California, in accordance with state and federal requirements, in coordination with the Cybersecurity Task Force. Specifically, this bill would:

• Require OES to establish and lead the Cal-CSIC whose primary mission will be to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state;
• Provide that the Cal-CSIC will serve as the central organizing hub of state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations;
• Require the Cal-CSIC to be composed of representatives from the following organizations:
  • OES;
  • Department of Technology, Office of Information Security;
  • State Threat Assessment Center;
  • Department of the California Highway Patrol;
  • Military Department;
  • Office of the Attorney General;
  • California Health and Human Services Agency;
  • California Utilities Emergency Association;
  • California State University;
  • University of California;
  • California Community Colleges;
  • United States Department of Homeland Security;
  • United States Federal Bureau of Investigation;
  • United States Secret Service;
  • United States Coast Guard;
  • Other members as designated by the Director of OES
• Require the Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security — National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources;
• Require the Cal-CSIC to provide warnings of cyber attacks to government agencies and nongovernmental partners and coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law;
• Require the Cal-CSIC to develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices;
• Require the Cal-CSIC to establish a Cyber Incident Response Team, composed of personnel from agencies, departments, and organizations represented on the California Cybersecurity Integration Center, to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state and provide assistance to law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and to agencies responsible for advancing information security within state government;
• Require information sharing by the Cal-CSIC to be conducted in a manner that protects the privacy and civil liberties of individuals; safeguards sensitive information; preserves business confidentiality; and enables public officials to detect, investigate, respond to, and prevent cyber attacks that threaten public health and safety, economic stability and national security;
• Require all state departments and agencies to ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce, and assist OES and the Cal-CSIC.

Related Legislation:

AB 531 (Irwin, 2017) would require the OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. This bill is pending in the Senate Appropriations Committee.

AB 1841 (Irwin, Chapter 508, Statutes of 2016) required OES to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further required OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019.

AB 2595 (Linder, 2015) would have established Cal-CSIC in statute to develop a cybersecurity strategy for California. This bill was held in the Assembly Appropriations Committee.

Staff Comments:

A total of $193 million in homeland security grants have been allocated for California. The Homeland Security Grant Program provides $60.3 million of those grants funds. The Homeland Security Grant Program assists the state, Tribal, and local preparedness activities that address high-priority preparedness gaps across all core capabilities and mission areas where a nexus to terrorism exists. The federal government currently provides $1.8 million specifically to support the Cal-CSIC; therefore with current federal funding, the there are no state costs for supporting the Cal-CSIC. However, by codifying an existing Executive Order, this bill creates ongoing General Fund cost pressures to fund Cal-CSIC in perpetuity; thereby removing the authority of any Governor to modify or otherwise adjust the program in response to future budget constraints. Should the federal government reduce or eliminate its current funding, California would be responsible for funding the $1.8 million to support the center.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2017 - 2018 Regular

Bill No: 1306 Hearing Date: 7/11/2017

SUBJECT: California Cybersecurity Integration Center

DIGEST: This bill establishes in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force, as specified.

Existing law:

1. Establishes OES by the Governor’s Reorganization Plan No.2, operative July 1, 2013.
2. Requires OES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
3. Requires OES, by Executive Order B-34-15, to establish the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
4. Requires, by Executive Order B-34-15, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.
5. Establishes the Office of Information Security (OIS), within the California Department of Technology, to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this State.

This bill:

1. Establishes in statute the Cal-CSIC within OES to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force.
2. Provides that the primary mission of the CAL-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
3. Specifies that the membership of the Cal-CSIC shall include representatives from all of the following organizations:
   1. OES.
   2. OIS.
   3. State Threat Assessment Center.
   4. Department of the California Highway Patrol.
   5. Military Department.
   6. Office of the Attorney General.
   7. California Health and Human Services Agency.
   8. California Utilities Emergency Association.
   9. California State University.
   10. University of California.
   11. California Community Colleges.
4. Authorizes the Director of OES, in consultation with OIS or the Cybersecurity Task Force, or both, to administer, authorize and allocate federal homeland security grant funding in accordance with federal grant guidelines
5. Requires the Director of OES to prioritize grand funding for prevention measures undertaken by OIS in furtherance of the provision in the Governor’s Executive Order B-34-15 that directs state departments and agencies to “ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce.”
6. Clarifies that nothing in this bill precludes the Director of OES from administering the grant programs to respond to statewide emergencies requiring immediate attention.

Background

Purpose of the bill. According to the author’s office, “cybersecurity is a growing concern to our State. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state’s response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measures that are in line with our cybersecurity readiness goals.”

Executive Order B-34-15. On August 31, 2015, Governor Brown signed Executive Order B-34-15 with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.” With that goal in mind, the Executive Order established the Cal-CISC.

Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the "central organizing hub" of state government's cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from different state and federal public entities.

Its main purpose is threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CISC is responsible for developing a statewide cybersecurity strategy.

Cal-CISC is also charged with establishing a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT provides assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity.

This bill would establish the Cal-CSIC in statute. In doing so, the bill would prevent any current or any future Governor from modifying or deleting its provisions. However, it should be noted that substantial portions of the Executive Order are not included in this bill, including the right of the Director of OES to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserves business confidentiality.

If the goal of the bill is to codify the Cal-CSIC it is unclear why portions of the Executive Order are not included in the provisions of this bill.

Homeland security grant funding. According to the author’s office, the most recent publicly available figures show that a total of $193 million in homeland security grants have been allocated for California. The State Homeland Security Program ($60.2 million) assists the state, Tribal and local preparedness activities that address high-priority preparedness gaps across all core capabilities and mission areas where a nexus to terrorism exists.

The Urban Areas Security Initiative ($124.7 million) assists high-threat, high-density urban areas in efforts to build and sustain the capabilities necessary to prevent, protect against, mitigate, respond to, and recover from acts of terrorism. Operation Stonegarden ($9.4 million) supports enhanced cooperation and coordination among Customs and Border Protection, United States Border Patrol, and local, Tribal, territorial, state, and federal law enforcement agencies and funds investments in joint efforts to secure the United States borders along routes of ingress from international borders to include travel corridors in states bordering Mexico and Canada, as well as states and territories with international water borders.

This bill authorizes the Director of OES, in consultation with OIS or the Cybersecurity Task Force, or both, to administer, authorize and allocate federal homeland security grant funding in accordance with federal grant guidelines. The bill also requires the Director of OES to prioritize grand funding for prevention measures undertaken by OIS in furtherance of the provision in the Governor’s Executive Order B-34-15 that directs state departments and agencies to “ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce.”

It is unclear why the Director of OES needs authorization to administer these grants given the fact that the Director of OES already has this authority. In addition, the bill as written could impact the way these federal grants are used. Under this bill, the Director of OES must prioritize grant funding for prevention measures for the furtherance of the Governor’s Executive Order.

Finally, the federal government currently provides $1.8 million to support the Cal-CSIC. If the federal government were to eliminate that funding, California would be responsible for funding the $1.8 million.

Suggested amendments. As previously stated, it is unclear why the bill does not include various provisions of the Executive Order. Since the Cal-CSIC is already operating, the author may wish to amend the bill to include all the different components of the Executive Order. These provisions include the right of the Director of OES to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.

Furthermore, it is unclear why the bill authorizes the Director of OES to administer federal grants, when that authority already exists. In addition, the bill requires the Director of OES to prioritize grant funding for prevention measures undertaking by OIS in furtherance of the provision of the Executive Order. Such language could diminish the Director’s discretion and ability to prioritize funding according to the specific threats the state is facing at that particular point in time and instead require the Director of OES to prioritize cybersecurity threats over other more imminent dangers.

As such, the author may wish to amend the bill and strike out the language pertaining to that authorization and prioritization of those funds. By striking out that language, it would allow the Director of OES the tools necessary to effectively protect the state against various types of threats rather than prioritizing one threat over others.

Prior/Related Legislation

AB 531 (Irwin, 2017) would require the OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. (Pending in Senate Appropriations Committee)

AB 2595 (Linder, 2015) would have established Cal-CSIC in statute to develop a cybersecurity strategy for California. (Held in Assembly Appropriations Committee Suspense File)

AB 1841 (Irwin, Chapter 508, Statutes of 2016) required OES to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further required OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019.

AB 1881 (Chang, 2016) would have required the Director of the California Department of Technology to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held in the Assembly Appropriations Committee Suspense File)

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Never heard in Senate Governmental Organizations Committee)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

None received

OPPOSITION:

None received

ASSEMBLY THIRD READING

ATR Bill Id:AB 1306

Author:(Obernolte)

As Amended Ver:April 6, 2017

Majority vote

SUMMARY: Establishes the California Cybersecurity Integration Center (Cal-CSIC), requires it to develop a cybersecurity strategy for California, and the Director of Emergency Services (Director) to administer federal grant money for cybersecurity prevention measures. Specifically, this bill:

1. Establishes the Cal-CSIC within the Governor’s Office of Emergency Services (CalOES), and requires the Cal-CSIC to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force, as specified.
2. Specifies that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
3. Specifies that the membership of the Cal-CSIC shall include representatives of CalOES, the Department of Technology's Office of Information Security (OIS); the State Threat Assessment Center; the Department of the California Highway Patrol; the California Military Department; the Office of the Attorney General; the California Health and Human Services Agency; the California Utilities Emergency Association; the California State University; the University of California; and the California Community Colleges.
4. Authorizes the Director, in consultation with OIS or the Cybersecurity Task Force, or both, to administer, authorize, and allocate federal homeland security grant funding in accordance with federal grant guidelines and shall prioritize grant funding for prevention measures undertaken by OIS in furtherance of the provision in the Governor’s Executive Order B-34-15 that directs state departments and agencies to “ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce."
5. Clarifies that the provisions of this bill do not preclude the Director from administering the grant programs to respond to statewide emergencies requiring immediate attention.
6. Defines the terms "prevention measures" and "federal homeland security grant funding."

FISCAL EFFECT: According to the Assembly Appropriations Committee,

1. No state costs to the extent that the federal government continues to provide the funding to support Cal-CSIC.
2. Cost pressure of $1.8 million annually to continue to support Cal-CSIC if the federal funding that currently supports the center is not provided in the future.

COMMENTS:

1. Purpose of this bill: This bill is intended to accomplish two goals related to state cybersecurity: the codification of a new state CISC created by Executive Order in 2015, and providing more specific guidance to OES regarding the expenditure of federal grant money for cybersecurity purposes. This measure is author-sponsored.
2. The practical effect of codifying the Executive Order: Codifying the Executive Order has little practical effect other than preventing the current or any future Governor from modifying or deleting its provisions. It should also be noted that substantial portions of the Executive Order are not included in this bill, including the right of the Director to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.
3. Homeland security grant-funding: According to the author, the most recent publicly available figures show that a total of $193 million in homeland security grants have been allocated for California. The practical effect of the authorization language of this bill would be to formally authorize the Director of OES to administer, authorize and allocate federal homeland security grant funding, and to require the Director to prioritize the use of that grant funding (except in state emergencies) for preventive measures taken by OIS to ensure compliance by state departments and agencies with existing information security standards and policies, including the performance of risk assessments.

There is no obvious reason to believe that the Director of OES lacks the authority to administer and allocate such federal grants, as the Director has presumably been administering such grants for years. However, this language would appear to require the Director to prioritize the expenditure of otherwise unrestricted grant funds for helping state departments and agencies ensure compliance with existing information security and privacy policies.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000695

Date of Hearing: May 10, 2017

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 1306

Author:(Obernolte) – As Amended Ver:April 6, 2017

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill codifies the California Cybersecurity Integration Center (Cal-CSIC) within the Governor’s Office of Emergency Services (CalOES) that was previously established through an Executive Order. Specifically, this bill would place certain portions of the executive order into state law.

FISCAL EFFECT:

1. No state costs to the extent that the federal government continues to provide the funding to support Cal-CSIC.
2. Cost pressure of $1.8 million annually to continue to support Cal-CSIC if the federal funding that currently supports the center is not provided in the future.

COMMENTS:

1. Background. Governor Brown signed Executive Order B-34-15 (EO) which noted the increasing number and complexity of cyberattacks against public and private networks, and in response announced the establishment of the Cal-CISC. Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the "central organizing hub" of state government's cybersecurity activities to coordinate information sharing with a variety of government agencies. It is comprised of representatives from 15 different state and federal public entities. CalOES currently funds Cal-SCIC with federal grant funds.
2. Purpose. According to the author, "Cybersecurity is a growing concern to our state. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state’s response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measures that are in line with our cybersecurity readiness goals. Finally, in the unfortunate case of a response to a cyber-attack becoming necessary, the California Department of Technology should absolutely be outlined in the Emergency Plan."

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 19, 2017

ASSEMBLY COMMITTEE ON GOVERNMENTAL ORGANIZATION

Adam Gray, Chair

ABPCA Bill Id:AB 1306 (

Author:Obernolte) – As Amended Ver:April 6, 2017

SUBJECT: California Cybersecurity Integration Center

SUMMARY: Establishes the California Cybersecurity Integration Center (Cal-CSIC), requires it to develop a cybersecurity strategy for California, and the Director of Emergency Services (Director) to administer federal grant money for cybersecurity prevention measures. Specifically, this bill:

1. Establishes the Cal-CSIC within the Governor’s Office of Emergency Services (CalOES), and requires the Cal-CSIC to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force, as specified.
2. Specifies that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
3. Specifies that the membership of the Cal-CSIC shall include representatives of CalOES, the Department of Technology's Office of Information Security (OIS); the State Threat Assessment Center; the Department of the California Highway Patrol; the California Military Department; the Office of the Attorney General; the California Health and Human Services Agency; the California Utilities Emergency Association; the California State University; the University of California; and the California Community Colleges.
4. Authorizes the Director, in consultation with OIS or the Cybersecurity Task Force, or both, to administer, authorize, and allocate federal homeland security grant funding in accordance with federal grant guidelines and shall prioritize grant funding for prevention measures undertaken by OIS in furtherance of the provision in the Governor’s Executive Order B-34-15 that directs state departments and agencies to “ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce."
5. Clarifies that the provisions of this bill do not preclude the Director from administering the grant programs to respond to statewide emergencies requiring immediate attention.
6. Defines the terms "prevention measures" and "federal homeland security grant funding."

EXISTING LAW:

1. Establishes CalOES by the Governor's Reorganization Plan No.2, operative July 1, 2013.
2. Requires CalOES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
3. Requires the Governor and CalOES, pursuant to the California Emergency Services Act (CESA), to prepare for and mitigate the effects of emergencies in the state.
4. Requires CalOES, and its appointed Director, to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state, including emergency medical services.
5. Requires, by Executive order in 2015, CalOES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15)
6. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15)
7. Establishes, within the California Department of Technology (CDT), the Office of Information Security to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.

FISCAL EFFECT: Unknown

COMMENTS:

Purpose of the Bill: According to the author, "Cybersecurity is a growing concern to our state. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state’s response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measure that are in line with our cybersecurity readiness goals. Finally, in the unfortunate case of a response to a cyber-attack becoming necessary, the California Department of Technology should absolutely be outlined in the Emergency Plan."

Background: In 2009, the California Legislature merged the powers, purposes, and responsibilities of the former CalOES with those of the Office of Homeland Security (OHS) into the newly- created California Emergency Management Agency (CalEMA).On July 1, 2013, Governor Edmund G. Brown Jr.’s Reorganization Plan #2 eliminated CalEMA and restored it to the Governor’s Office, renaming it the California Governor’s Office of Emergency Services (CalOES), and merging it with the Office of Public Safety Communications. Today, CalOES is responsible for overseeing and coordinating emergency preparedness, response, recovery and homeland security activities within the state.

Additionally, CESA authorizes the Governor to take actions to prepare for, respond to, and prevent natural or human-caused emergencies that endanger life, property, and the state's resources, and further authorizes CalOES and its Director to take actions to coordinate emergency planning, preparedness, and response activities. On August 31, 2015, Governor Brown, under the authority of CESA, signed Executive Order B-34-15.

Executive Order B-34-15 (EO): Governor Brown signed Executive Order B-34-15 (EO) which noted the increasing number and complexity of cyberattacks against public and private networks, and in response announced the establishment of the California Cybersecurity Integration Center (Cal-CISC).

Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and would serve as the "central organizing hub" of state government's cybersecurity activities and coordinate information sharing" with a variety of government agencies. It would be comprised of representatives from 15 different state and federal public entities.

Its main purposes would be threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CISC would be responsible for developing a statewide cybersecurity strategy. It would also be charged with establishing a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT would also provide assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity. The team would be populated with staff from the agencies, departments and organizations represented on Cal-CISC.

Cal-CSIC: In April 2016, CalOES placed the Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System, California’s intelligence community.

According to CalOES, since April of 2016, "Cal-CSIC representatives from Cal OES, the California Department of Technology, the California Military Department, and the California Highway Patrol [have been] pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them. The Cal-CSIC endeavors to provide useful information that will help protect California’s residents and infrastructure."

"Furthermore, Cal-CSIC personnel are working to identify best and cost-effective technological solutions to augment the state’s cybersecurity mission and protect the privacy and civil liberties of California’s residents. The Cal-CSIC seeks to instill trust and confidence by promoting transparency of internal processes and protocols, and maintaining confidentiality and integrity while exchanging cybersecurity information with its partners."

Homeland Security Grant Funding: According to the author, the most recent publicly available figures show that a total of $193 million in homeland security grants have been allocated for California. The State Homeland Security Program ($60.2 million) assists state, tribal and local preparedness activities that address high-priority preparedness gaps across all core capabilities and mission areas where a nexus to terrorism exists. The Urban Areas Security Initiative ($124.7 million) assists high-threat, high-density urban areas in efforts to build and sustain the capabilities necessary to prevent, protect against, mitigate, respond to, and recover from acts of terrorism. Operation Stonegarden ($9.4 million) supports enhanced cooperation and coordination among Customs and Border Protection, United States Border Patrol, and local, Tribal, territorial, state, and federal law enforcement agencies and funds investments in joint efforts to secure the United States borders along routes of ingress from international borders to include travel corridors in states bordering Mexico and Canada, as well as states and territories with international water borders.

As noted by the Committee on Privacy and Consumer Protection, the practical effect of the language of this bill is to authorize the Director of CalOES to administer, authorize and allocate federal homeland security grant funding, and to prioritize that grant funding (except in state emergencies) for preventative measures taken by OIS to ensure compliance by state departments and agencies with existing information security standards and policies, including the performance of risk assessments. There is no clear reason to believe that the Director of CalOES lacks the authority to administer and allocate such federal grants, as such administration has been ongoing for years.

Policy Considerations:

Should AB 1306 become law, it would place only a portion of the EO in statute. As stated above, the Governor, under the authority of CESA, signed B-34-15, thus, the contents in the EO do not need to be codified in statute for the directions/orders of the Governor to be realized. However, it certainly does not hurt and could provide for additional accountability for all involved agencies and remove the Governor's authority to unilaterally change any of the provisions added to statute. The Committee may wish to consider whether it is necessary to codify the EO in statute. If yes, the Committee and author may wish to consider adding the entire EO into statute.

Should AB 1306 become law, it would bill authorize the Director of CalOES to administer, authorize and allocate federal homeland security grant funding. As stated above, there is no clear reason to believe that the Director lacks the authority to administer and allocate said federal grant funds. Should the intent of AB 1306 be to provide more transparency or allocation control of federal homeland security grants funds, the Committee and author may wish to consider whether or not more specific provisions related to transparency or allocation control is appropriate, such as a requirement to annually report online any expenditures or allocations of federal homeland security grants funds.

Double Referral: AB 1306 was first heard in Assembly Committee on Privacy and Consumer Protection on March 28, 2017, and passed on a 9-1 vote.

Related legislation: AB 2595 (Linder) of 2015/2016 Session. Would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by OES. (Held in the Assembly Appropriations Committee.).

AB 1841 (Irwin) Chapter 508, Statutes of 2016. Requires CalOES to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further requires OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019.

AB 1881 (Chang) of 2015/2016 Session. Would have required the Director of the California Department of Technology to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held in the Assembly Appropriations Committee.).

SB 949 (Jackson) of 2015/2016 Session. Would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Died in Senate Governmental Organizations Committee)

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Kenton Stanhope / G.O. / (916) 319-2531

Date of Hearing: March 28, 2017

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 1306 (

Author:Obernolte) – As Introduced Ver:February 17, 2017

SUBJECT: California Cybersecurity Integration Center

SUMMARY: Establishes the California Cybersecurity Integration Center (Cal-CSIC), requires it to develop a cybersecurity strategy for California, and the Director of Emergency Services (Director) to administer federal grant money for cybersecurity prevention measures. Specifically, this bill:

1. Establishes the Cal-CSIC within the Governor’s Office of Emergency Services (OES), and requires the Cal-CSIC to develop a cybersecurity strategy for California in coordination with the Cybersecurity Task Force, as specified.
2. Specifies that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
3. Specifies that the membership of the Cal-CSIC shall include representatives of OES, the Department of Technology's Office of Information Security (OIS); the State Threat Assessment Center; the Department of the California Highway Patrol; the California Military Department; the Office of the Attorney General; the California Health and Human Services Agency; the California Utilities Emergency Association; the California State University; the University of California; and the California Community Colleges.
4. Authorizes the Director, in consultation with OIS or the Cybersecurity Task Force, or both, to administer, authorize, and allocate federal homeland security grant funding in accordance with federal grant guidelines and shall prioritize grant funding for prevention measures undertaken by OIS in furtherance of the provision in the Governor’s Executive Order B-34-15 that directs state departments and agencies to “ensure compliance with existing information security and privacy policies, promote awareness of information security standards with their workforce."
5. Clarifies that the provisions of this bill do not preclude the Director from administering the grant programs to respond to statewide emergencies requiring immediate attention.
6. Defines the terms "prevention measures" and "federal homeland security grant funding."
7. Requires the Department of Technology to be included in the cyber-attack response portion of the State Emergency Plan.

EXISTING LAW:

1. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The Act creates within the office of the Governor the OES, which is responsible for the state’s emergency and disaster response services, as specified. (Government Code Sections 8550-8668, et seq.; 8569; 8585)
2. Requires, by Executive order in 2015, OES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15)
3. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill is intended to accomplish two goals related to state cybersecurity: the codification of a new state CISC created by Executive Order in 2015, and providing more specific guidance to OES regarding the expenditure of federal grant money for cybersecurity purposes. This measure is author-sponsored.
2. Author's statement: According to the author, "Cybersecurity is a growing concern to our state. We must do everything we can as a state to be prepared for a possible attack. Cal-CSIC has been a vital part of the state’s response plan and it is time to codify the organization to make sure they will be around to assess threats and prepare for attacks. Additionally, we should be prioritizing our cybersecurity grant dollars for the prevention measure that are in line with our cybersecurity readiness goals. Finally, in the unfortunate case of a response to a cyber attack becoming necessary, the California Department of Technology should absolutely be outlined in the Emergency Plan."
3. What Executive Order B-34-15 does: On August 31, 2015, Governor Brown issued Executive Order B-34-15, which directed OES to establish the California Cyber Security Integration Center (Cal-CSIC). In the accompanying press release, the Cal-CSIC is described as "responsible for strengthening the state's cybersecurity strategy and improving inter-agency, cross-sector coordination to reduce the likelihood and severity of cyber-attacks. Cal-CSIC will work closely with the California State Threat Assessment System and the U.S. Department of Homeland Security and will facilitate more integrated information sharing and communication with local, state and federal agencies, tribal governments, utilities and other service providers, academic institutions and non-governmental organizations." The underlying Executive Order has five main elements:

First, it specifies the creation of the Cal-CSIC by OES, as well as its mission and membership.

Second, it specifies the functions of the Cal-CSIC as facilitating the sharing of cyber threat information, providing warnings of cyber attacks to public and private sector entities, assessment of risks to critical infrastructure and computer networks, prioritization of threats and supporting public and private-sector partners, sharing of best practices, and supporting cybersecurity assessments, audits and accountability programs.

Third, the Cal-CSIC is directed to develop a statewide cybersecurity strategy to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers. The strategy should also strengthen preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber-investigative capabilities, deepen state workforce expertise on cybersecurity, and expand cybersecurity awareness and public education.

Fourth, the Cal-CSIC must establish a Cyber Incident Response Team (CIRT) to serve as the state's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, as well as assist law enforcement agencies with cyber-related criminal investigations.

Finally, it makes clear that information sharing must be conducted in a manner that protects privacy and civil liberties, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyber-attacks.

1. The creation of the Cal-CSIC: In April 2016, OES stood up the Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System), California’s intelligence community.

According to OES, since April of 2016, "Cal-CSIC representatives from Cal OES, the California Department of Technology, the California Military Department, and the California Highway Patrol [have been] pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them. The Cal-CSIC endeavors to provide useful information that will help protect California’s residents and infrastructure."

"Furthermore, Cal-CSIC personnel are working to identify best and cost-effective technological solutions to augment the state’s cybersecurity mission and protect the privacy and civil liberties of California’s residents. The Cal-CSIC seeks to instill trust and confidence by promoting transparency of internal processes and protocols, and maintaining confidentiality and integrity while exchanging cybersecurity information with its partners."

1. The practical effect of codifying the Executive Order: Codifying the Executive Order has little practical effect other than preventing the current or any future Governor from modifying or deleting its provisions. It should also be noted that substantial portions of the Executive Order are not included in this bill, including the right of the Director to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.
2. Homeland security grant funding: According to the author, the most recent publicly available figures show that a total of $193 million in homeland security grants have been allocated for California. The State Homeland Security Program ($60.2 million) assists state, tribal and local preparedness activities that address high-priority preparedness gaps across all core capabilities and mission areas where a nexus to terrorism exists. The Urban Areas Security Initiative ($124.7 million) assists high-threat, high-density urban areas in efforts to build and sustain the capabilities necessary to prevent, protect against, mitigate, respond to, and recover from acts of terrorism. Operation Stonegarden ($9.4 million) supports enhanced cooperation and coordination among Customs and Border Protection, United States Border Patrol, and local, Tribal, territorial, state, and federal law enforcement agencies and funds investments in joint efforts to secure the United States borders along routes of ingress from international borders to include travel corridors in states bordering Mexico and Canada, as well as states and territories with international water borders.

The practical effect of the authorization language of this bill would be to formally authorize the Director of OES to administer, authorize and allocate federal homeland security grant funding, and to require the Director to prioritize the use of that grant funding (except in state emergencies) for preventive measures taken by OIS to ensure compliance by state departments and agencies with existing information security standards and policies, including the performance of risk assessments.

There is no obvious reason to believe that the Director of OES lacks the authority to administer and allocate such federal grants, as the Director has presumably been administering such grants for years. However, this language would appear to require the Director to prioritize the expenditure of otherwise unrestricted grant funds for helping state departments and agencies ensure compliance with existing information security and privacy policies.

1. Previous legislation: AB 2595 (Linder) would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by OES. AB 2595 was held on the Suspense File in the Assembly Appropriations Committee.
2. Double-referral: This bill is double-referred to the Assembly Governmental Organization Committee, where it will be heard if passed by this Committee.
   

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Hank Dempsey / P. & C.P. /