Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the Cal-CSIC within the Office of Emergency Services, the primary mission of which is the same as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would incorporate language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information.

Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the Cal-CSIC within the Office of Emergency Services, the primary mission of which is the same as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would incorporate language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information.

Existing law authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. The act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. The act creates within the office of the Governor the Office of Emergency Services, which is responsible for the states emergency and disaster response services, as specified.

By Executive order in 2015, the Governor directed the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center (Cal-CSIC), with its primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state.

The Executive order, among other things, required that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.

This bill would establish in statute the Cal-CSIC within the Office of Emergency Services, the primary mission of which is the same as Cal-CSIC as created by Executive order. The bill would require Cal-CSIC to include representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and others.

The bill would incorporate language of the Executive order to, among other things, require Cal-CSIC to coordinate with the California State Threat Assessment System and the United States Department of Homeland Security, establish a cyber incident response team, and safeguard the privacy of individuals sensitive information.

Existing law establishes, within the Department of Technology, the Office of Information Security. The offices purpose is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.

This bill would state the intent of the Legislature to enact legislation regarding the states information security practices.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 2813

Author:(Irwin and Obernolte)

As Amended Ver:June 19, 2018

Majority vote

Original Committee Reference: P. & C.P.

SUMMARY: Establishes the California Cybersecurity Integration Center (Cal-CSIC), as specified, and requires it to develop a cybersecurity strategy for California.

The Senate amendments add Assemblymember Obernolte as a joint author and make other technical amendments.

EXISTING LAW:

1. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. (Government Code Sec. 8550 et seq.) The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. (Government Code Sec. 8569.) The Act creates within the office of the Governor the Cal OES, which is responsible for the state's emergency and disaster response services, as specified. (Government Code Section 8585.)
2. Requires, by Executive order in 2015, Cal OES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15.)
3. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15.)
4. Establishes the California Department of Technology (CDT) within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Government Code Section 11545(a).) Establishes within CDT the OIS, the duties of which shall be to provide direction for information security and privacy to state government agencies, departments, and offices, as specified. (Government Code Section 11549.)
5. Requires state entities to implement the information security and privacy policies, standards and procedures issued by the OIS. (Government Code Section 11549.3(b).) Authorizes OIS to conduct, or require to be conducted, an independent security assessment (ISA) of every state agency, department, or office, as specified. State agencies and entities required to conduct or receive an ISA pursuant to those provisions are required to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to OIS and Cal OES. (Government Code Section 11549.3(c), (d).) Further requires OIS to report to CDT and Cal OES any state entity found to be noncompliant with information security program requirements, and also requires OIS to notify Cal OES, CHP, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. (Government Code Section 11549.3(e), (h).)
6. Authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. (Government Code Section 11549.3(c)(3).)
7. Requires OIS to consult with the Director of Technology, the Cal OES, the Director of General Services, the Director of Finance, and any other relevant agencies concerning policies, standards, and procedures related to information security and privacy. (Government Code Section 11549.4.)

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. Significant ongoing cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated. (GF)
2. Unknown, potentially significant costs to each state entity required to be represented in Cal-CSIC. These costs will be dependent on the resources of each state entity. (GF/special fund)

COMMENTS:

1. Purpose of this bill: This bill represents a second attempt to codify a state CSIC created by way of a 2015 Executive order to ensure the preservation of that entity into any future administrations. This bill is author-sponsored.
2. Author's statement: According to the author: "This bill is needed because the importance and need for the Cal-CSIC, and in general a coordinated state response structure for cybersecurity, is only increasing. Over the course of the past six months since the Governor's veto [of AB 1306 (Obernolte) of 2016], the Cal-CSIC has made significant strides in developing its capabilities and mission. With the Cal-CSIC's continued existence directly connected to the pleasure of the sitting Governor, and Gov. Brown's tenure soon coming to a close, [this bill represents an attempt to] re-engage in a discussion with the Executive Branch about the benefits of placing core provisions providing for the Cal-CSIC into statute before a new administration comes into office.

Additionally Cal OES has published both the 'Cyber Incident Response Guide for the State of California' and 'California Joint Cyber Incident Communications and Escalation Framework' that are intended in part to constitute the Emergency Support Function 18 'Cybersecurity' of the State Emergency Plan. These documents place the Cal-CSIC in important roles in planning for, and responding to cyber incidents. All other partners under the Response Guide and Communication Framework have statutory mandates to participate to some degree in state information security and are all allocated budget funds (CDT, CMD, CHP), leaving Cal-CSIC as the component with the most near and long-term uncertainty in addressing the state's long term cybersecurity goals.

Testimony from the recent Joint Oversight Hearing, from CDT's annual report, and other briefings provided by the Executive Branch to Legislature makes clear that cyber threats to the state government network, both private and public critical infrastructure, and other Cal-CSIC partners is on the rise. These threats are becoming more sophisticated and require large amounts of information-sharing to detect trends and allocated response resources. This is a core service of the Cal-CSIC and [it] would be difficult if not impossible in the short-term for any one of the other core four partners to take on the service offerings of the Cal-CSIC if it were to be discontinued by a future Governor."

1. Key difference from last year's AB 1306 attempt to codify Cal-CSIC: By and large, this bill is very similar to a prior bill, AB 1306 (Obernolte) of 2016 which also sought to codify the Cal-CSIC. AB 1306 was ultimately vetoed by Governor Brown with the following message:

Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center's flexibility as it pursues its mission to protect the state against cyberattacks.

AB 1306, however, did not include substantial portions of the Executive Order that are contained in this bill, including the right of the Cal OES Director to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; provisions related to the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.

Another key difference between this bill and AB 1306 is that this bill does not contain any of the AB 1306 provisions that would have provided specific direction to Cal OES regarding the expenditure of federal grant money for cybersecurity purposes. There is no obvious reason to believe that the Director of Cal OES lacks the authority to administer and allocate such federal grants in the absence of such language, as the Director has presumably been administering such grants for years.

Arguably, given the differences between this bill and AB 1306, and in particular, the absence of any language prioritizing how the Director of OES would manage federal homeland security grant funding, as well as the ability of the Director to add new members to Cal-CSIC as time goes on, this bill may provide the flexibility necessary to encourage the Governor to now consider codifying the Cal-CSIC into statute

1. Prior legislation: AB 1306 (Obernolte) of 2016 See Comment 3.

AB 2595 (Linder), of 2016 would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by Cal OES. AB 2595 was held on the Suspense File in the Assembly Appropriations Committee.

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200 FN: 0004297

 THIRD READING  

Bill No: AB 2813

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 6/26/18

AYES: Dodd, Wilk, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Portantino, Vidak, Wiener

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/16/18

AYES: Portantino, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 78-0, 5/30/18 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST:

This bill codifies in statute the California Cybersecurity Integration Center (Cal-CSIC), within the Office of Emergency Services (OES), and requires Cal-CSIC to develop a cybersecurity strategy for California, as specified.

ANALYSIS:

Existing law:

1. Establishes, under the California Emergency Services Act (Act), OES in the Office of the Governor and provides that OES is responsible for the state’s emergency and disaster response services for natural, technological, or manmade disasters and emergencies.
2. Requires, by Executive Order B-34-15, OES to establish and lead Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
3. Establishes the Office of Information Security (OIS), within the Department of Technology (CDT), for the purposes of ensuring the confidentiality, integrity, and availability of state systems and applications.
4. Requires OIS to consult with the Director of CDT, the Director of General Services, the Director of Finance, OES, and any other relevant agencies concerning policies, standards, and procedures related to information security and privacy.

This bill:

1. Requires OES to establish and lead Cal-CSIC, and provides that its primary mission shall be to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
2. Provides that Cal-CSIC shall serve as the central organizing hub of the state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
3. Provides that Cal-CSIC shall be comprised of representatives from the following organizations:
   1. The Office of Emergency Services.
   2. The Office of Information Security.
   3. The State Threat Assessment Center.
   4. The Department of the California Highway Patrol.
   5. The Military Department.
   6. The Office of the Attorney General.
   7. The California Health and Human Services Agency.
   8. The California Utilities Emergency Association.
   9. The California State University.
   10. The University of California.
   11. The California Community Colleges.
   12. The United States Department of Homeland Security.
   13. The United States Federal Bureau of Investigation.
   14. The United States Secret Service.
   15. The United States Coast Guard.
   16. Other members as designated by the Director of OES.
4. Requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security – National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources.
5. Requires Cal-CSIC to provide warnings of cyber-attacks to government agencies and nongovernmental partners to protect the information technology (IT) networks of California’s agencies and departments, as specified.
6. Requires Cal-CSIC to develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.
7. Provides that the cybersecurity strategy shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers, as specified.
8. Requires Cal-CSIC to establish a Cyber Incident Response Team (CIRT) to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, and provides that CIRT be comprised of personnel from agencies, departments, and organizations represented on Cal-CSIC.
9. Provides that the information sharing by Cal-CSIC shall be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyber-attacks that threaten public health and safety, economic stability and national security.

Background

Purpose of the bill. According to the author, “California’s cybersecurity posture has developed substantially since Governor Brown’s Executive Order B-34-15 which created Cal-CSIC. As Chair of the Select Committee on Cybersecurity, I have followed closely the work of the executive branch departments responsible for cybersecurity, including OES, CDT, the Military Department (CMD), and the California Highway Patrol (CHP). Through their individual efforts, and joint efforts through Cal-CSIC, they have improved existing response plans and provided new services to state agencies and departments, public and private critical infrastructure partners, and local governments in need of cybersecurity assistance.”

Executive Order B-34-15. On August 31, 2015, Governor Brown signed Executive Order B-34-15 with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.” With that goal in mind, the Executive Order established Cal-CSIC.

Cal-CSIC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the “central organizing hub” of state government’s cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from different state and federal public entities.

This bill establishes Cal-CSIC in statute. In doing so, this bill prevents any current or any future Governor from modifying or deleting its provisions.

California Cybersecurity Integration Center. In April 2016, OES placed Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System, and California’s intelligence community.

According to OES, since April of 2016, Cal-CSIC representatives from OES, CDT, CMD, and the CHP have been pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them.

Second try. This bill is very similar to AB 1306 (Obernolte, 2017), which also sought to codify Executive Order B-34-15 and Cal-CSIC. That bill was vetoed by Governor Brown with the following message:

Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center’s flexibility as it pursues its mission to protect the state against cyberattacks.

Key differences in this bill include removal of language from AB 1306 which would have required all state departments and agencies to ensure compliance with existing information security and privacy policies, to promote awareness of information security standards with their workforce, and to assist OES and Cal-CSIC.

The author argues that while the Governor cautioned last year that Cal-CSIC needs flexibility as it helps to further develop California’s cybersecurity posture, it is worthwhile to consider placing some components of this successful executive order into statute as the executive branch transitions to a new administration in 2019.

Related/Prior Legislation

SB 532 (Dodd, 2018) adds “cyberterrorism” to the list of conditions that are named in the California Emergency Services Act that may be cited to support the proclamation of a state of emergency or local emergency. (Pending on the Assembly Floor)

AB 1306 (Obernolte, 2017) would have codified Cal-CSIC, within OES, to develop a statewide cybersecurity strategy in coordination with the California Task Force on Cybersecurity, and would have authorized the Governor to suspend the operations of Cal-CSIC if federal funding is unavailable. (Vetoed by Governor Brown)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, significant ongoing cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated. (GF)

Unknown, potentially significant costs to each state entity required to be represented in Cal-CSIC. These costs will be dependent on the resources of each state entity. (GF/special fund)

SUPPORT: (Verified 8/16/18)

None received

OPPOSITION: (Verified 8/16/18)

None received

ASSEMBLY FLOOR: 78-0, 5/30/18

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bonta, Brough, Burke, Caballero, Calderon, Carrillo, Cervantes, Chau, Chávez, Chen, Chiu, Choi, Chu, Cooley, Cooper, Cunningham, Dahle, Daly, Eggman, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kamlager-Dove, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

Prepared by:

8/18/18 13:41:56

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2017 - 2018 Regular Session

AB 2813 (Irwin) - California Cybersecurity Integration Center

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 2813 would codify in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (Cal OES) and would require Cal-CSIC to develop a cybersecurity strategy for California, as specified.

Fiscal Impact:

• Significant ongoing cost pressure of $1.8 million annually to support staff, contracts, and licenses to continue the Cal-CSIC should federal funding for the center be eliminated. (GF)
• Unknown, potentially significant costs to each state entity required to be represented in Cal-CSIC. These costs will be dependent on the resources of each state entity. (GF/special fund)

Background:

On August 31, 2015, Governor Brown signed Executive Order B-34-15 establishing Cal-CSIC, with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.” Cal-CSIC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the “central organizing hub” of state government’s cybersecurity activities and coordinates information sharing with a variety of government agencies. It is composed of representatives from various state and federal public entities.

The main purpose of Cal-CSIC is threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CSIC is also responsible for developing a statewide cybersecurity strategy.

Cal-CSIC is also charged with establishing the Cyber Incident Response Team (CIRT) to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT provides assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity.

Proposed Law:

This bill would require Cal OES to establish the Cal-CSIC whose primary mission is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state. Specifically, this bill would:

• Require Cal-CSIC to serve as the central organizing hub of state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations;
• Require the Cal-CSIC to be composed of representatives from the Cal OES, the Office of Information Security, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, the California Utilities Emergency Association, the California State University, the University of California, the California Community Colleges, the United States Department of Homeland Security, the United States Federal Bureau of Investigation, the United States Secret Service, the United States Coast Guard, and other members as designated by the Director of Cal OES;
• Require Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security — National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources;
• Require the Cal-CSIC to provide warnings of cyber attacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of California’s agencies and departments;
• Require Cal-CSIC to develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices, as specified;
• Require Cal-CSIC to establish Cyber Incident Response Team, composed of personnel from agencies, departments, and organizations represented in the Cal-CSIC, to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state;
• Require information sharing by the Cal-CSIC to be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyber-attacks that threaten public health and safety, economic stability, and national security.

Related Legislation:

AB 1306 (Obernolte, 2017) would have codified Cal-CSIC within Cal OES to develop a statewide cybersecurity strategy in coordination with the California Task Force on Cybersecurity, and would have authorized the Governor to suspend the operations of Cal-CSIC if federal funding is unavailable. It was vetoed by Governor Brown with the veto message “Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center's flexibility as it pursues its mission to protect the state against cyberattacks.”

Staff Comments:

The Cal-CSIC is currently up and running with four Cal OES positions and two Military Department State Active Duty positions. The federal government currently provides $1.8 million specifically to support the Cal-CSIC; therefore with current federal funding, the there are no state costs for supporting the Cal-CSIC. However, by codifying an existing Executive Order, this bill creates ongoing General Fund cost pressures to fund Cal-CSIC in perpetuity; thereby removing the authority of any Governor to modify or otherwise adjust the program in response to future budget constraints. Should the federal government reduce or eliminate its current funding, California would be responsible for funding the $1.8 million to support the center.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2017 - 2018 Regular

Bill No: 2813 Hearing Date: 6/26/2018

SUBJECT: California Cybersecurity Integration Center

DIGEST: This bill codifies in statute the California Cybersecurity Integration Center (Cal-CSIC), within the Office of Emergency Services (OES), and requires Cal-CSIC to develop a cybersecurity strategy for California, as specified.

ANALYSIS:

Existing law:

1. Establishes OES in the office of the Governor and provides that OES is responsible for the state’s emergency and disaster response services for natural, technological, or manmade disasters and emergencies.
2. Requires OES to perform a variety of duties with respect to specified emergency preparedness, mitigation, and response activities in the state.
3. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act (Act).
4. Requires the Governor to coordinate the preparation of plans and programs for the mitigation of the effects of an emergency by the political subdivisions of the State of California, such plans and programs to be integrated into and coordinated with the State Emergency Plan (SEP), and the plans and programs of the federal government and of other states to the fullest extent possible.
5. Requires, by Executive Order B-34-15, OES to establish and lead Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
6. Requires, by Executive Order B-34-15, that Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices, among other things.
7. Establishes the Office of Information Security (OIS), within the Department of Technology (CDT), for the purposes of ensuring the confidentiality, integrity, and availability of state systems and applications.
8. Requires OIS to consult with the Director of Technology, the Director of General Services, the Director of Finance, OES, and any other relevant agencies concerning policies, standards, and procedures related to information security and privacy.

This bill:

1. Requires OES to establish and lead Cal-CSIC, and provides that its primary mission shall be to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
2. Provides that Cal-CSIC shall serve as the central organizing hub of the state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
3. Provides that Cal-CSIC shall be comprised of representatives from the following organizations:
   1. The Office of Emergency Services.
   2. The Office of Information Security.
   3. The State Threat Assessment Center.
   4. The Department of the California Highway Patrol.
   5. The Military Department.
   6. The Office of the Attorney General.
   7. The California Health and Human Services Agency.
   8. The California Utilities Emergency Association.
   9. The California State University.
   10. The University of California.
   11. The California Community Colleges.
   12. The United States Department of Homeland Security.
   13. The United States Federal Bureau of Investigation.
   14. The United States Secret Service.
   15. The United States Coast Guard.
   16. Other members as designated by the Director of OES.
4. Requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security – National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources.
5. Requires Cal-CSIC to provide warnings of cyber-attacks to government agencies and nongovernmental partners to protect the information technology (IT) networks of California’s agencies and departments, as specified.
6. Requires Cal-CSIC to develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices.
7. Provides that the cybersecurity strategy shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers, as specified.
8. Requires Cal-CSIC to establish a Cyber Incident Response Team (CIRT) to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, and provides that CIRT be comprised of personnel from agencies, departments, and organizations represented on Cal-CSIC.
9. Provides that the information sharing by Cal-CSIC shall be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyber-attacks that threaten public health and safety, economic stability and national security.

Background

Purpose of the bill. According to the author, “California’s cybersecurity posture has developed substantially since Governor Brown’s Executive Order B-34-15 which created Cal-CSIC. As Chair of the Select Committee on Cybersecurity, I have followed closely the work of the executive branch departments responsible for cybersecurity, including OES, CDT, the Military Department (CMD), and the California Highway Patrol (CHP). Through their individual efforts, and joint efforts through Cal-CSIC, they have improved existing response plans and provided new services to state agencies and departments, public and private critical infrastructure partners, and local governments in need of cybersecurity assistance.”

Additionally, the author states that, “while the Governor cautioned last year that Cal-CSIC needs flexibility as it helps to further develop California’s cybersecurity posture, I believe that it is worthwhile to consider placing some components of this successful executive order into statute as we transition to a new administration next year. With cybersecurity threats growing at an alarming rate, we as a state cannot afford to lose any progress we have made, and the loss of Cal-CSIC would be detrimental to our entire cybersecurity program.”

Executive Order B-34-15. On August 31, 2015, Governor Brown signed Executive Order B-34-15 with the goal to “bolster California’s preparedness and response to destructive cyber-attacks.” With that goal in mind, the Executive Order established Cal-CSIC.

Cal-CSIC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and serves as the “central organizing hub” of state government’s cybersecurity activities and coordinates information sharing with a variety of government agencies. It is comprised of representatives from different state and federal public entities.

Its main purpose is threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CSIC is responsible for developing a statewide cybersecurity strategy.

Cal-CSIC is also charged with establishing CIRT to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT provides assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity.

This bill would establish Cal-CSIC in statute. In doing so, the bill would prevent any current or any future Governor from modifying or deleting its provisions.

California Cybersecurity Integration Center. In April 2016, OES placed Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System, and California’s intelligence community.

According to OES, since April of 2016, Cal-CSIC representatives from OES, CDT, CMD, and the CHP have been pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them. Cal-CSIC endeavors to provide useful information that will help protect California’s residents and infrastructure.

Additionally, OES states that Cal-CSIC personnel are working to identify best and cost-effective technological solutions to augment the state’s cybersecurity mission and protect the privacy and civil liberties of California’s residents. Cal-CSIC seeks to instill trust and confidence by promoting transparency of internal processes and protocols, and maintaining confidentiality and integrity while exchanging cybersecurity information with its partners.

Second try. This bill is very similar to AB 1306 (Obernolte, 2017), which also sought to codify Executive Order B-34-15 and Cal-CSIC. That bill was vetoed by Governor Brown with the following message:

Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center’s flexibility as it pursues its mission to protect the state against cyberattacks.

A few differences in AB 1306 included language stating that the Governor may, by executive order, suspend the operations of Cal-CSIC if federal funds for its continued operation are not available; a provision which explicitly prevented Cal-CSIC from duplicating the efforts of other governmental agencies, and requiring involuntary information sharing by private sector entities; and, requiring all state departments and agencies to ensure compliance with existing information security and privacy policies, to promote awareness of information security standards with their workforce, and to assist OES and Cal-CSIC.

Prior/Related Legislation

SB 532 (Dodd, 2018) adds “cyberterrorism” to the list of conditions that are named in the California Emergency Services Act that may be cited to support the proclamation of a state of emergency or local emergency. (Pending in the Assembly Governmental Organization Committee)

AB 531 (Irwin, 2017) would have required OIS to review the technologies used by state agencies to protect sensitive information, and develop a statewide plan to require state agencies to implement any information security technology that OIS determines to be necessary to protect that sensitive information. (Vetoed by Governor Brown)

AB 1306 (Obernolte, 2017) would have codified Cal-CSIC, within OES, to develop a statewide cybersecurity strategy in coordination with the California Task Force on Cybersecurity, and would have authorized the Governor to suspend the operations of Cal-CSIC if federal funding is unavailable. (Vetoed by Governor Brown)

AB 1841 (Irwin, Chapter 508, Statutes of 2016) required CDT, in conjunction with OES, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 1881 (Chang, 2016) would have required the Director CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held in the Assembly Appropriations Committee)

AB 2595 (Linder, 2016) would have established Cal-CSIC to develop a cybersecurity strategy for California, and would have authorized the administration of federal homeland security grant funding by OES. (Held in the Assembly Appropriations Committee)

SB 949 (Jackson, 2016) would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Never heard in the Senate Governmental Organizations Committee)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

None received

OPPOSITION:

None received

ASSEMBLY THIRD READING

ATR Bill Id:AB 2813

Author:(Irwin)

As Amended Ver:March 23, 2018

Majority vote

SUMMARY: This bill establishes the California Cybersecurity Integration Center (Cal-CSIC), as specified, and requires it to develop a cybersecurity strategy for California. Specifically, this bill:

1. Requires the Office of Emergency Services (Cal OES) to establish and lead the Cal-CSIC, and require the Cal-CSIC to develop a cybersecurity strategy for California informed by recommendations by the Cybersecurity Task Force, as specified, and requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the U.S. Department of Homeland Security – National Cybersecurity and Communications Integration Center, as specified.
2. Specifies that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in our state.
3. Specifies that the membership of the Cal-CSIC shall include representatives of Cal OES, the Office of Information Security (OIS); the State Threat Assessment Center; the Department of the California Highway Patrol (CHP); the California Military Department (CMD); the Office of the Attorney General; the California Health and Human Services Agency; the California Utilities Emergency Association; the California State University; the University of California; the California Community Colleges; the U.S. Department of Homeland Security; the U.S. Federal Bureau of Investigation; the U.S. Secret Service; the U.S. Coast Guard; and other members as designated by the Director of Cal OES.
4. Specifies that the cybersecurity strategy developed by Cal-CSIC shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers. The strategy would also be required to strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among California's workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
5. Requires Cal-CSIC to establish a Cyber Incident Response Team, as specified, to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, as well as assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government.

FISCAL EFFECT: According to the Assembly Appropriations Committee:

1. No state costs to the extent that the federal government continues to provide funding to support Cal-CSIC.
2. Cost pressure of $1.8 million annually to continue to support Cal-CSIC if the federal funding that currently supports the center is not provided.

COMMENTS:

1. Purpose of this bill: This bill represents a second attempt to codify a state CSIC created by way of a 2015 Executive order to ensure the preservation of that entity into any future administrations. This bill is author-sponsored.
2. Author's statement: According to the author: "This bill is needed because the importance and need for the Cal-CSIC, and in general a coordinated state response structure for cybersecurity, is only increasing. Over the course of the past six months since the Governor's veto [of AB 1306 (Obernolte) of 2016], the Cal-CSIC has made significant strides in developing its capabilities and mission. With the Cal-CSIC's continued existence directly connected to the pleasure of the sitting Governor, and Gov. Brown's tenure soon coming to a close, [this bill represents an attempt to] re-engage in a discussion with the Executive Branch about the benefits of placing core provisions providing for the Cal-CSIC into statute before a new administration comes into office.

Additionally Cal OES has published both the 'Cyber Incident Response Guide for the State of California' and 'California Joint Cyber Incident Communications and Escalation Framework' that are intended in part to constitute the Emergency Support Function 18 'Cybersecurity' of the State Emergency Plan. These documents place the Cal-CSIC in important roles in planning for, and responding to cyber incidents. All other partners under the Response Guide and Communication Framework have statutory mandates to participate to some degree in state information security and are all allocated budget funds (CDT, CMD, CHP), leaving Cal-CSIC as the component with the most near and long-term uncertainty in addressing the state's long term cybersecurity goals.

Testimony from the recent Joint Oversight Hearing, from CDT's annual report, and other briefings provided by the Executive Branch to Legislature makes clear that cyber threats to the state government network, both private and public critical infrastructure, and other Cal-CSIC partners is on the rise. These threats are becoming more sophisticated and require large amounts of information-sharing to detect trends and allocated response resources. This is a core service of the Cal-CSIC and [it] would be difficult if not impossible in the short-term for any one of the other core four partners to take on the service offerings of the Cal-CSIC if it were to be discontinued by a future Governor."

1. Key difference from last year's AB 1306 attempt to codify Cal-CSIC: By and large, this bill is very similar to a prior bill, AB 1306 (Obernolte, 2017) which also sought to codify the Cal-CSIC. AB 1306 was ultimately vetoed by Governor Brown with the following message:

Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center's flexibility as it pursues its mission to protect the state against cyberattacks.

AB 1306, however, did not include substantial portions of the Executive Order that are contained in this bill, including the right of the Cal OES Director to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; provisions related to the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.

Another key difference between this bill and AB 1306 is that this bill does not contain any of the AB 1306 provisions that would have provided specific direction to Cal OES regarding the expenditure of federal grant money for cybersecurity purposes. That AB 1306 language essentially sought to formally authorize the Cal OES Director to administer, authorize and allocate federal homeland security grant funding, and to require the Director to prioritize the use of that grant funding (except in state emergencies) for preventive measures taken by OIS to ensure compliance by state departments and agencies with existing information security standards and policies, including the performance of risk assessments. That being said, there was no obvious reason to believe that the Director of Cal OES lacks the authority to administer and allocate such federal grants, as the Director has presumably been administering such grants for years.

Arguably, given the differences between this bill and AB 1306, and in particular, the absence of any language prioritizing how the Director of OES would manage federal homeland security grant funding, as well as the ability of the Director to add new members to Cal-CSIC as time goes on, this bill may provide the flexibility necessary to encourage the Governor to now consider codifying the Cal-CSIC into statute.

1. Prior legislation: AB 1306 (Obernolte) of 2016 See Comment 2.

AB 2595 (Linder, 2016) would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by Cal OES. AB 2595 was held on the Suspense File in the Assembly Appropriations Committee.

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200 FN: 0003184

Date of Hearing: May 2, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 2813

Author:(Irwin) – As Amended Ver:March 23, 2018

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill codifies the California Cybersecurity Integration Center (Cal-CSIC) within the Governor’s Office of Emergency Services (CalOES) that was previously established through an executive order.

FISCAL EFFECT:

1. No state costs to the extent that the federal government continues to provide funding to support Cal-CSIC.
2. Cost pressure of $1.8 million annually to continue to support Cal-CSIC if the federal funding that currently supports the center is not provided.

COMMENTS:

1. Background. Governor Brown signed Executive Order B-34-15, which noted the increasing number and complexity of cyberattacks against public and private networks. In response, the governor announced the establishment of the Cal-CISC. Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California and serves as the "central organizing hub" of state government's cybersecurity activities to coordinate information sharing with a variety of government agencies. It is comprised of representatives from 15 different state and federal public entities. CalOES currently funds Cal-SCIC with federal grant funds.
2. Purpose. According to the author:

This bill is needed because the importance and need for the Cal-CSIC, and in general a coordinated state response structure for cybersecurity, is only increasing. Over the course of the past six months since the Governor’s veto of AB 1306 (Obernolte, 2016), the Cal-CSIC has made significant strides in developing its capabilities and mission. With the Cal-CSIC’s continued existence directly connected to the pleasure of the sitting Governor, and Gov. Brown’s tenure soon coming to a close, this bill represents an attempt to re-engage in a discussion with the Executive Branch about the benefits of placing core provisions providing for the Cal-CSIC into statute before a new administration comes into office.

1. Prior legislation. AB 1306 (Obernolte), of the current legislative session, is similar to this bill. AB 1306 was vetoed by Governor Brown.

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 18, 2018

ASSEMBLY COMMITTEE ON GOVERNMENTAL ORGANIZATION

Adam Gray, Chair

ABPCA Bill Id:AB 2813 (

Author:Irwin) – As Amended Ver:March 23, 2018

SUBJECT: California Cybersecurity Integration Center

SUMMARY: This bill would establish the California Cybersecurity Integration Center (Cal-CSIC), as specified, and require it to develop a cybersecurity strategy for California. Specifically, this bill would:

1. Require the Office of Emergency Services (Cal OES) to establish and lead the Cal-CSIC, and require the Cal-CSIC to develop a cybersecurity strategy for California informed by recommendations by the Cybersecurity Task Force, as specified, and requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the U.S. Department of Homeland Security—National Cybersecurity and Communications Integration Center, as specified.
2. Specify that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
3. Specify that the membership of the Cal-CSIC shall include representatives of Cal OES, the Office of Information Security (OIS); the State Threat Assessment Center; the Department of the California Highway Patrol (CHP); the California Military Department (CMD); the Office of the Attorney General; the California Health and Human Services Agency; the California Utilities Emergency Association; the California State University; the University of California; the California Community Colleges; the U.S. Department of Homeland Security; the U.S. Federal Bureau of Investigation; the U.S. Secret Service; the U.S. Coast Guard; and other members as designated by the Director of Cal OES.
4. Specify that the cybersecurity strategy developed by Cal-CSIC shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers. The strategy would also be required to strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among California’s workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
5. Requires Cal-CSIC to establish a Cyber Incident Response Team, as specified, to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, as well as assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government.

EXISTING LAW:

1. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. (Gov. Code Sec. 8550 et seq.) The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. (Gov. Code Sec. 8569.) The Act creates within the office of the Governor the Cal OES, which is responsible for the state’s emergency and disaster response services, as specified. (Gov. Code Sec. 8585.)
2. Requires, by Executive order in 2015, Cal OES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15.)
3. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15.)
4. Establishes the California Department of Technology (CDT) within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Gov. Code Sec. 11545(a).) Establishes within CDT the OIS, the duties of which shall be to provide direction for information security and privacy to state government agencies, departments, and offices, as specified. (Gov. Code Sec. 11549.)
5. Requires state entities to implement the information security and privacy policies, standards and procedures issued by the OIS. (Gov. Code Sec. 11549.3(b).) Authorizes OIS to conduct, or require to be conducted, an independent security assessment (ISA) of every state agency, department, or office, as specified. State agencies and entities required to conduct or receive an ISA pursuant to those provisions are required to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to OIS and Cal OES. (Gov. Code Sec. 11549.3(c), (d).) Further requires OIS to report to CDT and Cal OES any state entity found to be noncompliant with information security program requirements, and also requires OIS to notify Cal OES, CHP, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. (Gov. Code Sec. 11549.3(e), (h).)
6. Authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. (Gov. Code Sec. 11549.3(c)(3).)
7. Requires OIS to consult with the Director of Technology, the Cal OES, the Director of General Services, the Director of Finance, and any other relevant agencies concerning policies, standards, and procedures related to information security and privacy. (Gov. Code Sec. 11549.4.)

FISCAL EFFECT: Unknown

COMMENTS:

Purpose of the bill: According to the author: “This bill is needed because the importance and need for the Cal-CSIC, and in general a coordinated state response structure for cybersecurity, is only increasing. Over the course of the past six months since the Governor’s veto [of AB 1306 (Obernolte), 2016)], the Cal-CSIC has made significant strides in developing its capabilities and mission. With the Cal-CSIC’s continued existence directly connected to the pleasure of the sitting Governor, and Gov. Brown’s tenure soon coming to a close, [this bill represents an attempt to] re-engage in a discussion with the Executive Branch about the benefits of placing core provisions providing for the Cal-CSIC into statute before a new administration comes into office.

Additionally Cal OES has published both the ‘Cyber Incident Response Guide for the State of California’ and ‘California Joint Cyber Incident Communications and Escalation Framework’ that are intended in part to constitute the Emergency Support Function 18 ‘Cybersecurity’ of the State Emergency Plan. These documents place the Cal-CSIC in important roles in planning for, and responding to cyber incidents. All other partners under the Response Guide and Communication Framework have statutory mandates to participate to some degree in state information security and are all allocated budget funds (CDT, CMD, CHP), leaving Cal-CSIC as the component with the most near and long-term uncertainty in addressing the state’s long term cybersecurity goals.

Testimony from the recent Joint Oversight Hearing, from CDT’s annual report, and other briefings provided by the Executive Branch to Legislature makes clear that cyber threats to the state government network, both private and public critical infrastructure, and other Cal-CSIC partners is on the rise. These threats are becoming more sophisticated and require large amounts of information-sharing to detect trends and allocated response resources. This is a core service of the Cal-CSIC and [it] would be difficult if not impossible in the short-term for any one of the other core four partners to take on the service offerings of the Cal-CSIC if it were to be discontinued by a future Governor.”

Background: In 2009, the California Legislature merged the powers, purposes, and responsibilities of the former Cal OES with those of the Office of Homeland Security (OHS) into the newly- created California Emergency Management Agency (CalEMA).On July 1, 2013, Governor Edmund G. Brown Jr.’s Reorganization Plan #2 eliminated CalEMA and restored it to the Governor’s Office, renaming it the California Governor’s Office of Emergency Services (Cal OES), and merging it with the Office of Public Safety Communications. Today, Cal OES is responsible for overseeing and coordinating emergency preparedness, response, recovery and homeland security activities within the state.

Additionally, CESA authorizes the Governor to take actions to prepare for, respond to, and prevent natural or human-caused emergencies that endanger life, property, and the state's resources, and further authorizes Cal OES and its Director to take actions to coordinate emergency planning, preparedness, and response activities. On August 31, 2015, Governor Brown, under the authority of CESA, signed Executive Order B-34-15.

Executive Order B-34-15 (EO): Governor Brown signed Executive Order B-34-15 (EO) which noted the increasing number and complexity of cyberattacks against public and private networks, and in response announced the establishment of the California Cybersecurity Integration Center (Cal-CISC).

Cal-CISC is charged with reducing the likelihood and severity of a damaging cyber incident in California, and would serve as the "central organizing hub" of state government's cybersecurity activities and coordinate information sharing" with a variety of government agencies. It would be comprised of representatives from 15 different state and federal public entities.

Its main purposes would be threat information sharing, risk assessment, threat prioritization, supporting governmental audits and accountability measures, enabling cross-sector coordination and sharing of best practices. Cal-CISC would be responsible for developing a statewide cybersecurity strategy. It would also be charged with establishing a Cyber Incident Response Team (CIRT) to serve as California's primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. CIRT would also provide assistance to law enforcement agencies with primary jurisdiction over cyber-crimes and state government cybersecurity. The team would be populated with staff from the agencies, departments and organizations represented on Cal-CISC.

Cal-CSIC: In April 2016, CalOES placed the Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System, California’s intelligence community.

According to Cal OES, since April of 2016, "Cal-CSIC representatives from Cal OES, the California Department of Technology, the California Military Department, and the California Highway Patrol [have been] pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them. The Cal-CSIC endeavors to provide useful information that will help protect California’s residents and infrastructure."

"Furthermore, Cal-CSIC personnel are working to identify best and cost-effective technological solutions to augment the state’s cybersecurity mission and protect the privacy and civil liberties of California’s residents. The Cal-CSIC seeks to instill trust and confidence by promoting transparency of internal processes and protocols, and maintaining confidentiality and integrity while exchanging cybersecurity information with its partners."

Try again: This bill is very similar to a prior bill, AB 1306 (Obernolte, 2017), which also sought to codify the Cal-CSIC. AB 1306 was ultimately vetoed by Governor Brown with the following message:

“Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center's flexibility as it pursues its mission to protect the state against cyberattacks.”

AB 1306, however, did not include substantial portions of the Executive Order that are contained in this bill, including the right of the Cal OES Director to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; provisions related to the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.

Another key difference between this bill and AB 1306 is that this bill does not contain any of the AB 1306 provisions that would have provided specific direction to Cal OES regarding the expenditure of federal grant money for cybersecurity purposes. That AB 1306 language essentially sought to formally authorize the Cal OES Director to administer, authorize and allocate federal homeland security grant funding, and to require the Director to prioritize the use of that grant funding (except in state emergencies) for preventive measures taken by OIS to ensure compliance by state departments and agencies with existing information security standards and policies, including the performance of risk assessments. That being said, there was no obvious reason to believe that the Director of Cal OES lacks the authority to administer and allocate such federal grants, as the Director has presumably been administering such grants for years.

Double Referral: AB 2813 will be first heard in Assembly Committee on Privacy and Consumer Protection on April 17, 2018.

Related legislation: AB 1306 (Obernolte) of 2017/2018 Session. Would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by OES. (Vetoed by Governor)

AB 2595 (Linder) of 2015/2016 Session. Would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by OES. (Held in the Assembly Appropriations Committee.).

AB 1841 (Irwin) Chapter 508, Statutes of 2016. Requires CalOES to develop, by July 1, 2017, a statewide emergency services response plan for cybersecurity attacks against critical infrastructure, and further requires OES to develop a comprehensive cybersecurity strategy by July 1, 2018, with which all state agencies must report compliance by January 1, 2019.

AB 1881 (Chang) of 2015/2016 Session. Would have required the Director of the California Department of Technology to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state's progress towards compliance. (Held in the Assembly Appropriations Committee.).

SB 949 (Jackson) of 2015/2016 Session. Would have authorized the Governor to require owners and operators of critical infrastructure to submit critical infrastructure information to OES or any other designee for the purposes of gathering, analyzing, communicating, or disclosing critical infrastructure information. (Died in Senate Governmental Organizations Committee)

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Kenton Stanhope / G.O. / (916) 319-2531

Date of Hearing: April 17, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2813 (

Author:Irwin) – As Amended Ver:March 23, 2018

SUBJECT: California Cybersecurity Integration Center

SUMMARY: This bill would establish the California Cybersecurity Integration Center (Cal-CSIC), as specified, and require it to develop a cybersecurity strategy for California. Specifically, this bill would:

1. Require the Office of Emergency Services (Cal OES) to establish and lead the Cal-CSIC, and require the Cal-CSIC to develop a cybersecurity strategy for California informed by recommendations by the Cybersecurity Task Force, as specified, and requires Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the U.S. Department of Homeland Security—National Cybersecurity and Communications Integration Center, as specified.
2. Specify that the primary mission of the Cal-CSIC is to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.
3. Specify that the membership of the Cal-CSIC shall include representatives of Cal OES, the Office of Information Security (OIS); the State Threat Assessment Center; the Department of the California Highway Patrol (CHP); the California Military Department (CMD); the Office of the Attorney General; the California Health and Human Services Agency; the California Utilities Emergency Association; the California State University; the University of California; the California Community Colleges; the U.S. Department of Homeland Security; the U.S. Federal Bureau of Investigation; the U.S. Secret Service; the U.S. Coast Guard; and other members as designated by the Director of Cal OES.
4. Specify that the cybersecurity strategy developed by Cal-CSIC shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers. The strategy would also be required to strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among California’s workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
5. Requires Cal-CSIC to establish a Cyber Incident Response Team, as specified, to serve as California’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, as well as assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government.

EXISTING LAW:

1. Authorizes the Governor to make, amend, and rescind orders and regulations to implement the California Emergency Services Act. (Gov. Code Sec. 8550 et seq.) The Act requires the Governor to coordinate the State Emergency Plan and those programs necessary for the mitigation of the effects of an emergency in this state. (Gov. Code Sec. 8569.) The Act creates within the office of the Governor the Cal OES, which is responsible for the state’s emergency and disaster response services, as specified. (Gov. Code Sec. 8585.)
2. Requires, by Executive order in 2015, Cal OES to establish and lead the Cal-CSIC, with its primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state. (Executive Order B-34-15.)
3. Requires, by Executive order, that the Cal-CSIC be comprised of representatives from various entities, and that it develop a statewide cybersecurity strategy informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. (Executive Order B-34-15.)
4. Establishes the California Department of Technology (CDT) within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Gov. Code Sec. 11545(a).) Establishes within CDT the OIS, the duties of which shall be to provide direction for information security and privacy to state government agencies, departments, and offices, as specified. (Gov. Code Sec. 11549.)
5. Requires state entities to implement the information security and privacy policies, standards and procedures issued by the OIS. (Gov. Code Sec. 11549.3(b).) Authorizes OIS to conduct, or require to be conducted, an independent security assessment (ISA) of every state agency, department, or office, as specified. State agencies and entities required to conduct or receive an ISA pursuant to those provisions are required to transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to OIS and Cal OES. (Gov. Code Sec. 11549.3(c), (d).) Further requires OIS to report to CDT and Cal OES any state entity found to be noncompliant with information security program requirements, and also requires OIS to notify Cal OES, CHP, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government. (Gov. Code Sec. 11549.3(e), (h).)
6. Authorizes the CMD to perform an ISA of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed. (Gov. Code Sec. 11549.3(c)(3).)
7. Requires OIS to consult with the Director of Technology, the Cal OES, the Director of General Services, the Director of Finance, and any other relevant agencies concerning policies, standards, and procedures related to information security and privacy. (Gov. Code Sec. 11549.4.)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill represents a second attempt to codify a state CSIC created by way of a 2015 Executive order to ensure the preservation of that entity into any future administrations. This bill is author-sponsored.
2. Author’s statement: According to the author: “This bill is needed because the importance and need for the Cal-CSIC, and in general a coordinated state response structure for cybersecurity, is only increasing. Over the course of the past six months since the Governor’s veto [of AB 1306 (Obernolte, 2016)], the Cal-CSIC has made significant strides in developing its capabilities and mission. With the Cal-CSIC’s continued existence directly connected to the pleasure of the sitting Governor, and Gov. Brown’s tenure soon coming to a close, [this bill represents an attempt to] re-engage in a discussion with the Executive Branch about the benefits of placing core provisions providing for the Cal-CSIC into statute before a new administration comes into office.

Additionally Cal OES has published both the ‘Cyber Incident Response Guide for the State of California’ and ‘California Joint Cyber Incident Communications and Escalation Framework’ that are intended in part to constitute the Emergency Support Function 18 ‘Cybersecurity’ of the State Emergency Plan. These documents place the Cal-CSIC in important roles in planning for, and responding to cyber incidents. All other partners under the Response Guide and Communication Framework have statutory mandates to participate to some degree in state information security and are all allocated budget funds (CDT, CMD, CHP), leaving Cal-CSIC as the component with the most near and long-term uncertainty in addressing the state’s long term cybersecurity goals.

Testimony from the recent Joint Oversight Hearing, from CDT’s annual report, and other briefings provided by the Executive Branch to Legislature makes clear that cyber threats to the state government network, both private and public critical infrastructure, and other Cal-CSIC partners is on the rise. These threats are becoming more sophisticated and require large amounts of information-sharing to detect trends and allocated response resources. This is a core service of the Cal-CSIC and [it] would be difficult if not impossible in the short-term for any one of the other core four partners to take on the service offerings of the Cal-CSIC if it were to be discontinued by a future Governor.”

1. What Executive Order B-34-15 does: On August 31, 2015, Governor Brown issued Executive Order B-34-15, which directed Cal OES to establish the California Cyber Security Integration Center (Cal-CSIC). In the accompanying press release, the Cal-CSIC is described as “responsible for strengthening the state’s cybersecurity strategy and improving inter-agency, cross-sector coordination to reduce the likelihood and severity of cyber-attacks. Cal-CSIC will work closely with the California State Threat Assessment System and the U.S. Department of Homeland Security and will facilitate more integrated information sharing and communication with local, state and federal agencies, tribal governments, utilities and other service providers, academic institutions and non-governmental organizations.” The underlying Executive Order has five main elements:

• First, it specifies the creation of the Cal-CSIC by OES, as well as its mission and membership.
• Second, it specifies the functions of the Cal-CSIC as facilitating the sharing of cyber threat information, providing warnings of cyber attacks to public and private sector entities, assessment of risks to critical infrastructure and computer networks, prioritization of threats and supporting public and private-sector partners, sharing of best practices, and supporting cybersecurity assessments, audits and accountability programs.
• Third, the Cal-CSIC is directed to develop a statewide cybersecurity strategy to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses and consumers. The strategy should also strengthen preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber-investigative capabilities, deepen state workforce expertise on cybersecurity, and expand cybersecurity awareness and public education.
• Fourth, the Cal-CSIC must establish a Cyber Incident Response Team (CIRT) to serve as the state’s primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state, as well as assist law enforcement agencies with cyber-related criminal investigations.
• Finally, the Executive order makes clear that information sharing must be conducted in a manner that protects privacy and civil liberties, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyber-attacks.

1. The creation of the Cal-CSIC: In April 2016, OES stood up the Cal-CSIC alongside the State Threat Assessment Center (STAC), California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting. This co-location ensured immediate collaboration across the State Threat Assessment System, California’s intelligence community. According to Cal OES:

Cal-CSIC representatives from Cal OES, the California Department of Technology, the California Military Department, and the California Highway Patrol [have been] pooling resources to implement cyber vulnerability assessments and develop intuitive cyber threat alerts for the end-user. California receives a great deal of cyber threat information from other local, state, and national partners, but rarely receive a strategic look at the motivations behind these threats and the techniques to prevent, mitigate, or respond to them. The Cal-CSIC endeavors to provide useful information that will help protect California’s residents and infrastructure.

In September 2017, the Cal-OES and the Cal-CSIC hosted the Governor’s Cybersecurity Task Force quarterly meeting. Nearly eighty cybersecurity professionals attended, including 44 members that make up the Task Force’s six subcommittees: Workforce Development and Education, Cyber Risk Management and Emergency Preparedness, Critical Infrastructure, Information Sharing, Economic Development, and High Tech and Digital Forensics. (Cal OES, Cal-CSIC <http://www.caloes.ca.gov/cal-oes-divisions/law-enforcement/california-cybersecurity-integration-center> [as of Mar. 29. 2018].)

1. The practical effect of codifying the Executive order: Codifying the Executive order has little practical effect other than preventing the current or any future Governor from modifying or deleting its provisions. That being said, as reported at a February 28, 2018 cybersecurity oversight hearing of this Committee and the Select Committee on Cybersecurity, this partnership has made a critical difference in better addressing cybersecurity concerns in state government. As described in a Techwire article:

Bolstered IT systems, stepped-up education and training, and new partnerships have improved California’s ability to defend against cyberattacks, state officials charged with preventing and responding to such threats told lawmakers Wednesday. [. . .] The report, delivered to a joint hearing of the Privacy and Consumer Protection Committee and the Select Committee on Cybersecurity, showed a transformed government from the last time lawmakers heard from the Brown administration about its cyber-readiness. Two years ago, lawmakers expressed frustration at the state’s disjointed efforts and inability to identify its weakest links. Today, a team of four “core departments” have created a centralized strategy and are working together to combat what the governor’s homeland security adviser describes as one of the top five threats to California. [. . .]

Key to the effort is the [Cal-CSIC], an entity embedded at the State Threat Assessment Center where representatives from OES, the Department of Technology, the California Highway Patrol and the California Military Department (the four core partners) sit side-by-side to share classified information and oversee and coordinate the response to cybersecurity threats — and not just against state government.

Since June 2017, the center has responded to more than 325 cyberincidents against educational institutions, state and local government agencies, and private-sector organizations. The attacks have ranged in severity from website defacements to botnet activity, email attacks, ransomware, compromised accounts and stolen network credentials, Keith Tresh, commander of CAL-CSIC, told lawmakers.

California’s process of communicating and reporting cyberincidents is now in a published document for state, local and tribal governments to follow in the event of a cyberincident, known as the California Joint Cyber Incident Communications and Escalation Framework. It has also created a guide to help both private and public entities identify and report cyberattacks, as well as understand the state’s recovery procedures.

“The efforts of the CAL-CSIC are truly making a difference,” Tresh said. “California continues to mature in the area of cybersecurity, and we are taking a more proactive approach to cybersecurity than we ever have before. We have come a long way, but we still have work to do.” (Young, Techwire, State’s Cybersecurity Chiefs Report “Rapid Improvement.” (Mar. 1, 2018).)

1. Key difference from last year’s AB 1306 attempt to codify Cal-CSIC: By and large, this bill is very similar to a prior bill, AB 1306 (Obernolte, 2017) which also sought to codify the Cal-CSIC. AB 1306 was ultimately vetoed by Governor Brown with the following message:

Two years ago I established the California Cybersecurity Integration Center when I signed Executive Order B-34-15. Cybersecurity threats against the state are constantly changing and the Center continues to mature in response to these threats. I am concerned that placing the Center in statute as this bill proposes to do, will unduly limit the Center's flexibility as it pursues its mission to protect the state against cyberattacks. 

AB 1306, however, did not include substantial portions of the Executive Order that are contained in this bill, including the right of the Cal OES Director to designate additional members; provisions directing Cal-CSIC to assist in threat information sharing, provide attack warnings to stakeholders, assess risks to critical infrastructure, prioritize cyber threats, and support security assessments and audits; provisions related to the establishment of a CIRT unit; and the requirement that information sharing be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, and preserve business confidentiality.

Another key difference between this bill and AB 1306 is that this bill does not contain any of the AB 1306 provisions that would have provided specific direction to Cal OES regarding the expenditure of federal grant money for cybersecurity purposes. That AB 1306 language essentially sought to formally authorize the Cal OES Director to administer, authorize and allocate federal homeland security grant funding, and to require the Director to prioritize the use of that grant funding (except in state emergencies) for preventive measures taken by OIS to ensure compliance by state departments and agencies with existing information security standards and policies, including the performance of risk assessments. That being said, there was no obvious reason to believe that the Director of Cal OES lacks the authority to administer and allocate such federal grants, as the Director has presumably been administering such grants for years.

Arguably, given the differences between this bill and AB 1306, and in particular, the absence of any language prioritizing how the Director of OES would manage federal homeland security grant funding, as well as the ability of the Director to add new members to Cal-CSIC as time goes on, this bill may provide the flexibility necessary to encourage the Governor to now consider codifying the Cal-CSIC into statute.

1. Prior legislation: AB 1306 (Obernolte, 2017) See Comment 6.

AB 2595 (Linder, 2016) would have established the Cal-CSIC, require it to develop a cybersecurity strategy for California, and authorize the administration of federal homeland security grant funding by Cal OES. AB 2595 was held on the Suspense File in the Assembly Appropriations Committee.

1. Double-referral: This bill is double-referred to the Assembly Governmental Organization Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

None on file

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200