Existing law establishes the Office of Information Security within the Department of Technology, under the supervision of the Chief of the Office of Information Security, and requires the chief to establish an information security program. Existing law authorizes the office to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.

This bill would require the office, on or before July 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. The bill would require the office, following the review, to develop a statewide plan to require the implementation by state agencies, during the next fiscal year, of any information security technology the office determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.

Existing law establishes the Office of Information Security within the Department of Technology, under the supervision of the Chief of the Office of Information Security, and requires the chief to establish an information security program. Existing law authorizes the office to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.

This bill would require the office, on or before January July 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. The bill would require the office, following the review, to develop a statewide plan to require the implementation by state agencies, during the next fiscal year, of any information security technology the office determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.

Existing law establishes the Office of Information Security within the Department of Technology, under the supervision of the Chief of the Office of Information Security, and requires the chief to establish an information security program. Existing law authorizes the office to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.

This bill would require the office, by April 1, 2018, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. The bill would require the office, following the review, to develop a plan to require the implementation by state agencies, within during the next fiscal year, of any information security technology the office determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.

Existing law establishes the Office of Information Security within the Department of Technology, under the supervision of the Chief of the Office of Information Security, and requires the chief to establish an information security program. Existing law authorizes the office to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.

This bill would require the office, by April 1, 2018, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies. The bill would require the office, following the review, to develop a plan to require the implementation by state agencies, within the fiscal year, of any information security technology the office determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.

GOVERNOR'S VETO

GV Bill Id:AB 531

Author:(Irwin)

As Enrolled Ver:September 15, 2017

2/3 vote

Original Committee Reference: P. & C.P.

SUMMARY: Requires the Office of Information Security (OIS) to review the technologies used by state agencies to protect sensitive information, and develop a statewide plan to require state agencies to implement any information security technology that OIS determines to be necessary to protect that sensitive information.

The Senate amendments

1. Delay the implementation date for when OIS is required to review information security technologies currently in place from January 1, 2019, to July 1, 2019.
2. Clarify that the plan to require state agencies implement necessary information security technologies apply statewide.
3. Make other technical or clarifying changes.

EXISTING LAW:

1. Provides for the creation of a chief information security officer (CISO) to lead OIS and who is tasked with providing direction for information security and privacy to state government agencies, departments, and officers. (Government Code Section (GC) 11549(a) to (c))
2. Requires the CISO to establish an information security program, which includes the creation, updating and publishing of policies and standards for information security in the State Administrative Manual, information technology risk management, tracking of security and privacy incidents, and disaster recovery, as well as statewide coordination with other agencies, promotion of state agency risk management programs, and generally representing the state on matters of information security and privacy. (GC 11549.3(a))
3. Requires state entities to implement the information security and privacy policies, standards and procedures issued by OIS. (GC 11549.3(b))

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. Significant costs of approximately $1.3 million to OIS for additional personnel to conduct the assessment over an 18 month period. (General Fund (GF))
2. Unknown, potentially significant costs to state agencies to identify and provide OIS with all information security technologies, policies, standards, and procedures currently in place. (GF/Special Fund)
3. Unknown, potentially significant cost pressures to state agencies to implement any plans OIS develops following review of an agency's information. (GF/Special Fund)

COMMENTS:

This bill is intended to drive OIS to evaluate the security practices of state agencies broadly, and develop an implementation plan for any new technologies to protect digital records specifically. This bill is author-sponsored.

According to the author:

With cyber threats increasing in frequency and complexity, and new technologies becoming available to state agencies and departments, California would be irresponsible to wait for our own OPM level breach to act. It is necessary to make a re-evaluation of data classification and security practices a priority and ensure updated standards are implemented by state agencies and departments."

AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for the Office of Information Security.

The State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility.

According to the author, state regulations that address data classification and security controls for sensitive data have not been updated in years. Oversight and enforcement of those regulations have also been problematic in recent years. In August of 2015, the Bureau of State Audits (BSA) released its "High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption" (Report 2015-611), which excoriated CDT for poor security and oversight practices.

For example, the 2015 BSA report found that, for information security program management specifically, nearly one-third of surveyed agencies were substantially noncompliant: 24% of entities reported full compliance, 24% reported that they were mostly compliant, 26% were partially compliant, and 3% reported that they were not at all compliant.

In practice, this bill would direct OIS to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by July 1, 2019. Once completed, OIS would be required to develop a statewide plan to require implementation by state agencies, during the next fiscal year (beginning July 1, 2019), of any technology determined to be necessary to protection of critical information and to prevent disclosure of sensitive digital content.

GOVERNOR'S VETO MESSAGE:

This bill requires the Department of Technology's Office of Information Security to review state departments' information security policies to determine if they are sufficient to protect critical government information. The bill also requires the Office to develop a statewide plan to address any deficiencies it sees in its review of departments' cybersecurity practices.

By June 30th, 2018 my administration will finish information security assessments of every state department as required by AB 670. These assessments identify and correct departments' network vulnerabilities. Going forward, each department will receive additional assessments every two years. The Department is also performing audits on departments that scrutinize how their information security practices measure up to the state's information security policies. This coordinated approach to the state's cybersecurity will improve each state department's policies, procedures, and networks so that the state's critical information is secure.

Informed by these assessments and audits, in early 2018 the Department will complete a strategic plan that outlines the state's information security priorities for departments to implement.

Because these efforts will fulfill many of this bill's objectives, I am reluctant to sign the bill at this time

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002498

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 531

Author:(Irwin)

As Amended Ver:September 6, 2017

Majority vote

Original Committee Reference: P. & C.P.

SUMMARY: Requires the Office of Information Security (OIS) to review the technologies used by state agencies to protect sensitive information, and develop a statewide plan to require state agencies to implement any information security technology that OIS determines to be necessary to protect that sensitive information.

The Senate amendments

1. Delay the implementation date for when OIS is required to review information security technologies currently in place from January 1, 2019 to July 1, 2019.
2. Clarify that the plan to require state agencies implement necessary information security technologies apply statewide.
3. Make other technical or clarifying changes.

EXISTING LAW:

1. Provides for the creation of a chief information security officer (CISO) to lead OIS and who is tasked with providing direction for information security and privacy to state government agencies, departments, and officers. (Government Code Section (GC) 11549(a)-(c))
2. Requires the CISO to establish an information security program, which includes the creation, updating and publishing of policies and standards for information security in the State Administrative Manual, information technology risk management, tracking of security and privacy incidents, and disaster recovery, as well as statewide coordination with other agencies, promotion of state agency risk management programs, and generally representing the state on matters of information security and privacy. (GC 11549.3(a))
3. Requires state entities to implement the information security and privacy policies, standards and procedures issued by OIS. (GC 11549.3(b))

FISCAL EFFECT: According to the Senate Appropriations Committee:

1. Significant costs of approximately $1.3 million to OIS for additional personnel to conduct the assessment over an 18 month period. (General Fund (GF))
2. Unknown, potentially significant costs to state agencies to identify and provide OIS with all information security technologies, policies, standards, and procedures currently in place. (GF / Special Fund)
3. Unknown, potentially significant cost pressures to state agencies to implement any plans OIS develops following review of an agency’s information. (GF / Special Fund)

COMMENTS:

This bill is intended to drive OIS to evaluate the security practices of state agencies broadly, and develop an implementation plan for any new technologies to protect digital records specifically. This bill is author-sponsored.

According to the author:

"With cyber threats increasing in frequency and complexity, and new technologies becoming available to state agencies and departments, California would be irresponsible to wait for our own OPM level breach to act. It is necessary to make a re-evaluation of data classification and security practices a priority and ensure updated standards are implemented by state agencies and departments."

"AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for the Office of Information Security.

"The State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility."

According to the author, state regulations that address data classification and security controls for sensitive data have not been updated in years. Oversight and enforcement of those regulations have also been problematic in recent years. In August of 2015, the Bureau of State Audits (BSA) released its "High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption" (Report 2015-611), which excoriated CDT for poor security and oversight practices.

For example, the 2015 BSA report found that, for information security program management specifically, nearly one-third of surveyed agencies were substantially noncompliant: 24% of entities reported full compliance, 24% reported that they were mostly compliant, 26% were partially compliant, and 3% reported that they were not at all compliant.

In practice, this bill would direct OIS to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by July 1, 2019. Once completed, OIS would be required to develop a statewide plan to require implementation by state agencies, during the next fiscal year (beginning July 1, 2019), of any technology determined to be necessary to protection of critical information and to prevent disclosure of sensitive digital content.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0002225

 THIRD READING  

Bill No: AB 531

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 6/27/17

AYES: Dodd, Berryhill, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Mendoza, Portantino, Vidak

SENATE APPROPRIATIONS COMMITTEE: 7-0, 9/1/17

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 77-0, 5/30/17 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill requires the Office of Information Security (OIS), on or before July 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.

Senate Floor Amendments of 9/6/17 delay the implementation of the bill from January 1, 2019 to July 1, 2019.

ANALYSIS:

Existing law:

1. Establishes OIS, within the California Department of Technology (CDT), which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
2. Requires the Chief Information Security Officer (CISO) to lead OIS and is tasked with providing direction for information security and privacy to state government agencies, departments, and officers.
3. Requires the CISO to establish an information security program, which includes the creation, updating, and publishing of policies and standards for information security in the State Administrative Manual (SAM), information technology (IT) risk management, tracking of security and privacy incidents, and disaster recovery, as well as statewide coordination with other agencies, promotion of state agency risk management programs, and generally representing the state on matters of information security and privacy.
4. Authorizes IOS to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.
5. Requires state entities to implement the information security and privacy policies, standards, and procedures issued by OIS.

This bill:

1. Requires OIS on or before July 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.
2. Requires OIS, following the review, to develop a statewide plan to require the implantation by state agencies during the next fiscal year, of any information security technology OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.
3. Clarifies that nothing in this bill shall be construed to affect the application of the California Public Records Act.
4. Provides that “digital content” may include, but is not limited to, any of the following:
   1. Common desktop applications, including word processing, presentations, and spreadsheets.
   2. Portable document format (PDF).
   3. Computer-aided design.
   4. Photographs.
   5. Videos.

Background

Purpose of the bill. According to the author’s office, “AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for OIS.”

The author’s office also argues that, “the State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility.”

Information security. Information security refers to the protection of physical and electronic data, and IT systems, hardware, and software, from a wide spectrum of threats and risks. Implementing appropriate security measures is critical to ensure continuity of state operations and protect information against unauthorized access, use, disclosure, disruption, modification, or destruction.

In the past several years, retailers, financial institutions, and governments have increasingly fallen victim to information security attacks. Given the extensive assortment of sensitive data that the state maintains, including Social Security numbers, health records, and income tax information, the state is a prime target for information security attacks. Not only can information security breaches impede the state’s ability to serve the public, but the costs to both the state and to the individuals affected could be substantial.

CDT/OIS. CDT is the central IT organization for the State of California and is responsible for the approval and oversight of all state IT projects. Among its various offices in OIS.

OIS is the primary state government authority for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. Its main duties include establishing an information security program, overseeing implementation of information policies and procedures across state agencies, and conducting independent security assessments and audits.

As part of its efforts to protect the State’s information assets, OIS requires reporting entities to comply with the information security and privacy policies, standards, and procedures, known as security standards, described in the SAM.

California State Auditor Report. On August 15, 2015, the California State Auditor released a report titled, “High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption." In the report, the auditor found that many state departments had poor security controls over their IT systems and that CDT had failed to provide effective oversight of departments’ information security. The auditor found that these security deficiencies could compromise the IT systems that departments use to perform their daily operations. Since then, CDT has made several changes to strengthen its oversight of information security.

For example, CDT has since prioritized and simplified some of the standards that departments are required to comply with in order to focus on the most important and relevant standards and to make them more easily understood by departments. In addition, CDT has recently begun performing independent security assessments of departments under its purview to determine their vulnerabilities in information security procedures or the identification of components of IT systems that could be exploited by a threat.

This bill requires OIS, an office within CDT, to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by January 1, 2019.

Once completed, OIS would be required to develop a plan to require implementation by state agencies, during the next fiscal year (which begins July 1, 2019), of any technology determined to be necessary to the protection of critical information and to prevent disclosure of sensitive digital content.

Related/Prior Legislation

AB 1022 (Irwin, 2017) requires state agencies to include within their Technology Recovery Plan an inventory of all critical infrastructure controls and associated assets.

AB 1306 (Obernolte, 2017) establishes in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California.

AB 670 (Irwin, Chapter 518, Statutes of 2015) required OIS, in consultation with OES, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

AB 2595 (Linder, 2016) would have established Cal-CSIC and required it to develop a cybersecurity strategy for California. (Held in Assembly Appropriations Committee Suspense File)

AB 1841 (Irwin Chapter 508, Statutes of 2016) required CDT, in conjunction with the OES to develop, by July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 1881 (Chang, 2016) would have required the Director of CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state’s progress towards compliance. (Held in the Assembly Appropriations Committee Suspense File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, there are significant costs of approximately $1.3 million to OIS for additional personnel to conduct the assessment over an 18-month period.

In addition, unknown, but potentially significant costs to state agencies to identify and provide OIS with all information security technologies, policies, standards, and procedures currently in place.

Finally, unknown, potentially significant cost pressures to state agencies to implement any plans OIS develops following review of an agency’s information.

SUPPORT: (Verified 9/8/17)

American Civil Liberties Union

CompTIA

OPPOSITION: (Verified 9/8/17)

None received

ARGUMENTS IN SUPPORT: According to CompTIA, “cybersecurity is a preeminent issue for state governments. However, many states are solely focused on one type of cybersecurity management: firewall type protection. States are forgetting the importance of securing documents or content management inside and outside the firewall. Security must also include content centric security solutions. Content focused security solutions are a must for states to consider when implementing a complete security plan.”

ASSEMBLY FLOOR: 77-0, 5/30/17

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bocanegra, Bonta, Brough, Burke, Caballero, Calderon, Cervantes, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dababneh, Dahle, Daly, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gomez, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Ridley-Thomas, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NO VOTE RECORDED: Chau, Choi, Eggman

Prepared by:

9/8/17 15:28:10

**** END ****

 THIRD READING  

Bill No: AB 531

Author:

:

Vote:

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 6/27/17

AYES: Dodd, Berryhill, Bradford, Cannella, Gaines, Galgiani, Glazer, Hill, Hueso, Lara, Mendoza, Portantino, Vidak

SENATE APPROPRIATIONS COMMITTEE: 7-0, 9/1/17

AYES: Lara, Bates, Beall, Bradford, Hill, Nielsen, Wiener

ASSEMBLY FLOOR: 77-0, 5/30/17 - See last page for vote

SUBJECT:

SOURCE: Author

DIGEST: This bill requires the Office of Information Security (OIS), on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.

ANALYSIS:

Existing law:

1. Establishes OIS, within the California Department of Technology (CDT), which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
2. Requires the Chief Information Security Officer (CISO) to lead OIS and is tasked with providing direction for information security and privacy to state government agencies, departments, and officers.
3. Requires the CISO to establish an information security program, which includes the creation, updating, and publishing of policies and standards for information security in the State Administrative Manual (SAM), information technology (IT) risk management, tracking of security and privacy incidents, and disaster recovery, as well as statewide coordination with other agencies, promotion of state agency risk management programs, and generally representing the state on matters of information security and privacy.
4. Authorizes IOS to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.
5. Requires state entities to implement the information security and privacy policies, standards, and procedures issued by OIS.

This bill:

1. Requires OIS on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.
2. Specifies that “digital content” may include, but is not limited to: common applications such as word processing, presentations, and spreadsheets; portable document format (PDF); computer-aided design (CAD); photographs; and videos.
3. Requires OIS, following the review, to develop a plan to require the implantation by state agencies during the next fiscal year, of any information security technology OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.
4. Clarifies that nothing in this bill shall be construed to affect the application of the California Public Records Act.

Background

Purpose of the bill. According to the author’s office, “AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for OIS.”

The author’s office also argues that, “the State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility.”

Information security. Information security refers to the protection of physical and electronic data, and IT systems, hardware, and software, from a wide spectrum of threats and risks. Implementing appropriate security measures is critical to ensure continuity of state operations and protect information against unauthorized access, use, disclosure, disruption, modification, or destruction.

In the past several years, retailers, financial institutions, and governments have increasingly fallen victim to information security attacks. Given the extensive assortment of sensitive data that the state maintains, including Social Security numbers, health records, and income tax information, the state is a prime target for information security attacks. Not only can information security breaches impede the state’s ability to serve the public, but the costs to both the state and to the individuals affected could be substantial.

CDT/OIS. CDT is the central IT organization for the State of California and is responsible for the approval and oversight of all state IT projects. Among its various offices in OIS.

OIS is the primary state government authority for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. Its main duties include establishing an information security program, overseeing implementation of information policies and procedures across state agencies, and conducting independent security assessments and audits.

As part of its efforts to protect the State’s information assets, OIS requires reporting entities to comply with the information security and privacy policies, standards, and procedures, known as security standards, described in the SAM.

California State Auditor Report. On August 15, 2015, the California State Auditor released a report titled, “High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption." In the report, the auditor found that many state departments had poor security controls over their IT systems and that CDT had failed to provide effective oversight of departments’ information security. The auditor found that these security deficiencies could compromise the IT systems that departments use to perform their daily operations. Since then, CDT has made several changes to strengthen its oversight of information security.

For example, CDT has since prioritized and simplified some of the standards that departments are required to comply with in order to focus on the most important and relevant standards and to make them more easily understood by departments. In addition, CDT has recently begun performing independent security assessments of departments under its purview to determine their vulnerabilities in information security procedures or the identification of components of IT systems that could be exploited by a threat.

This bill requires OIS, an office within CDT, to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by January 1, 2019.

Once completed, OIS would be required to develop a plan to require implementation by state agencies, during the next fiscal year (which begins July 1, 2019), of any technology determined to be necessary to the protection of critical information and to prevent disclosure of sensitive digital content.

Related/Prior Legislation

AB 1022 (Irwin, 2017) requires state agencies to include within their Technology Recovery Plan an inventory of all critical infrastructure controls and associated assets. (Pending on the Senate Floor)

AB 1306 (Obernolte, 2017) establishes in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California. (Pending on the Senate Floor)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required OIS, in consultation with OES, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

AB 2595 (Linder, 2016) would have established Cal-CSIC and required it to develop a cybersecurity strategy for California. (Held in Assembly Appropriations Committee Suspense File)

AB 1841 (Irwin Chapter 508, Statutes of 2016) required CDT, in conjunction with the OES to develop, by July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 1881 (Chang, 2016) would have required the Director of CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state’s progress towards compliance. (Held in the Assembly Appropriations Committee Suspense File)

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

According to the Senate Appropriations Committee, there are significant costs of approximately $1.3 million to OIS for additional personnel to conduct the assessment over an 18-month period.

In addition, unknown, but potentially significant costs to state agencies to identify and provide OIS with all information security technologies, policies, standards, and procedures currently in place.

Finally, unknown, potentially significant cost pressures to state agencies to implement any plans OIS develops following review of an agency’s information.

SUPPORT: (Verified 9/1/17)

CompTIA

American Civil Liberties Union

OPPOSITION: (Verified 9/1/17)

None received

ARGUMENTS IN SUPPORT: According to CompTIA, “cybersecurity is a preeminent issue for state governments. However, many states are solely focused on one type of cybersecurity management: firewall type protection. States are forgetting the importance of securing documents or content management inside and outside the firewall. Security must also include content centric security solutions. Content focused security solutions are a must for states to consider when implementing a complete security plan.”

ASSEMBLY FLOOR: 77-0, 5/30/17

AYES: Acosta, Aguiar-Curry, Travis Allen, Arambula, Baker, Berman, Bigelow, Bloom, Bocanegra, Bonta, Brough, Burke, Caballero, Calderon, Cervantes, Chávez, Chen, Chiu, Chu, Cooley, Cooper, Cunningham, Dababneh, Dahle, Daly, Flora, Fong, Frazier, Friedman, Gallagher, Cristina Garcia, Eduardo Garcia, Gipson, Gloria, Gomez, Gonzalez Fletcher, Gray, Grayson, Harper, Holden, Irwin, Jones-Sawyer, Kalra, Kiley, Lackey, Levine, Limón, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Muratsuchi, Nazarian, Obernolte, O'Donnell, Patterson, Quirk, Quirk-Silva, Reyes, Ridley-Thomas, Rodriguez, Rubio, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Voepel, Waldron, Weber, Wood, Rendon

NO VOTE RECORDED: Chau, Choi, Eggman

Prepared by:

9/4/17 12:19:16

**** END ****

SENATE COMMITTEE ON

Senator Ricardo Lara, Chair

2017 - 2018 Regular Session

AB 531 (Irwin) - Office of Information Security: information security technologies

This bill meets the criteria for referral to the Suspense File.

Bill Summary:

AB 531 would require the Office of Information Security (OIS), on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.

Fiscal Impact:

• Significant costs of approximately $1.3 million to OIS for additional personnel to conduct the assessment over an 18 month period. (GF)
• Unknown, potentially significant costs to state agencies to identify and provide OIS with all information security technologies, policies, standards, and procedures currently in place. (GF / Special Fund)
• Unknown, potentially significant cost pressures to state agencies to implement any plans OIS develops following review of an agency’s information. (GF / Special Fund)

Background:

Because the state maintains an assortment of sensitive data, including Social Security numbers, health records, and income tax information, the state is a prime target for information security attacks. These attacks have the potential to impede the state’s ability to serve the public and significantly cost the state and individuals. OIS, within the California Department of Technology (CDT), is the primary state government authority responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. Its main duties include establishing an information security program, overseeing implementation of information policies and procedures across state agencies, and conducting independent security assessments and audits.

On August 15, 2015, the California State Auditor released a report finding that many state departments had poor security controls over their IT systems and that CDT had failed to provide effective oversight of departments’ information security. CDT has since made several changes to strengthen its oversight of information security.

Proposed Law:

The bill would:

• Require OIS, on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies;
• Require OIS, following the review, to develop a plan to require the implementation by state agencies, during the next fiscal year, of any information security technology the office determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of the sensitive digital content of a state agency;
• Clarify that nothing in the bill shall be construed to affect the application of the California Public Records Act.

Related Legislation:

AB 1022 (Irwin, 2017) would require state agencies to include within their Technology Recovery Plan an inventory of all critical infrastructure controls and associated assets. This bill is pending in the Senate Judiciary Committee.

AB 1306 (Obernolte, 2017) would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California. This bill is pending in the Senate Governmental Organization Committee.

AB 2595 (Linder, 2016) would have established Cal-CSIC and required it to develop a cybersecurity strategy for California. This bill was held in the Assembly Appropriations Committee.

AB 1841 (Irwin Chapter 508, Statutes of 2016) requires CDT, in conjunction with OES, by July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 1881 (Chang, 2016) would have required the Director of CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state’s progress towards compliance. This bill was held in the Assembly Appropriations Committee.

AB 670 (Irwin, Chapter 518, Statutes of 2015) requires OIS, in consultation with OES, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2017 - 2018 Regular

Bill No: AB Hearing Date: 6/27/2017

SUBJECT:

DIGEST: This bill requires the Office of Information Security (OIS), on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.

ANALYSIS:

Existing law:

1. Establishes OIS, within the California Department of Technology (CDT), which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
2. Require the Chief Information Security Officer (CISO) to lead OIS and is tasked with providing direction for information security and privacy to state government agencies, departments, and officers.
3. Requires the CISO to establish an information security program, which includes the creation, updating, and publishing of policies and standards for information security in the State Administrative Manual (SAM), information technology (IT) risk management, tracking of security and privacy incidents, and disaster recovery, as well as statewide coordination with other agencies, promotion of state agency risk management programs, and generally representing the state on matters of information security and privacy.
4. Authorizes IOS to conduct, or require to be conducted, an independent security assessment of any state agency, department, or office, the cost of which is to be funded by the state agency, department, or office being assessed.
5. Requires state entities to implement the information security and privacy policies, standards, and procedures issued by OIS.

This bill:

1. Requires OIS on or before January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content, as defined, inside or outside the firewall of state agencies.
2. Specifies that “digital content” may include, but is not limited to: common applications such as word processing, presentations, and spreadsheets; portable document format (PDF); computer-aided design (CAD); photographs; and videos.
3. Requires OIS, following the review, to develop a plan to require the implantation by state agencies during the next fiscal year, of any information security technology OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content of a state agency.
4. Clarifies that nothing in this bill shall be construed to affect the application of the California Public Records Act.

Background

Purpose of the bill. According to the author’s office, “AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for OIS.”

The author’s office also argues that, “the State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility.”

Information security. Information security refers to the protection of physical and electronic data, and IT systems, hardware, and software, from a wide spectrum of threats and risks. Implementing appropriate security measures is critical to ensure continuity of state operations and protect information against unauthorized access, use, disclosure, disruption, modification, or destruction.

In the past several years, retailers, financial institutions, and governments have increasingly fallen victim to information security attacks. Given the extensive assortment of sensitive data that the state maintains, including Social Security numbers, health records, and income tax information, the state is a prime target for information security attacks. Not only can information security breaches impede the state’s ability to serve the public, but the costs to both the state and to the individuals affected could be substantial.

CDT/OIS. CDT is the central IT organization for the State of California and is responsible for the approval and oversight of all state IT projects. Among its various offices is OIS.

OIS is the primary state government authority for ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. Its main duties include establishing an information security program, overseeing implementation of information policies and procedures across state agencies, and conducting independent security assessments and audits.

As part of its efforts to protect the State’s information assets, OIS requires reporting entities to comply with the information security and privacy policies, standards, and procedures, known as security standards, described in the SAM.

California State Auditor Report. On August 15, 2015, the California State Auditor released a report titled, “High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption." In the report, the Auditor found that many state departments had poor security controls over their IT systems and that CDT had failed to provide effective oversight of departments’ information security. The auditor found that these security deficiencies could compromise the IT systems that departments use to perform their daily operations. Since then, CDT has made several changes to strengthen its oversight of information security.

For example, CDT has since prioritized and simplified some of the standards that departments are required to comply with in order to focus on the most important and relevant standards and to make them more easily understood by departments. In addition, CDT has recently begun performing independent security assessments of departments under its purview to determine their vulnerabilities in information security procedures or the identification of components of IT systems that could be exploited by a threat.

This bill would require OIS, an office within CDT, to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by January 1, 2019.

Once completed, OIS would be required to develop a plan to require implementation by state agencies, during the next fiscal year (which begins July 1, 2019), of any technology determined to be necessary to the protection of critical information and to prevent disclosure of sensitive digital content.

Prior/Related Legislation

AB 1022 (Irwin, 2017) would require state agencies to include within their Technology Recovery Plan an inventory of all critical infrastructure controls and associated assets. (Pending in Senate Governmental Organization Committee)

AB 1306 (Obernolte, 2017) would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services (OES) to develop a cybersecurity strategy for California. (Pending in Senate Governmental Organization Committee)

AB 670 (Irwin, Chapter 518, Statutes of 2015) required OIS, in consultation with OES, to require no fewer than 35 independent security assessments of state entities each year and determine basic standards of services to be performed as part of that assessment.

AB 2595 (Linder, 2016) would have established Cal-CSIC and required it to develop a cybersecurity strategy for California. (Held in Assembly Appropriations Committee Suspense File)

AB 1841 (Irwin Chapter 508, Statutes of 2016) requires CDT, in conjunction with the OES to develop, by July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency.

AB 1881 (Chang, 2016) would have required the Director of CDT to develop and update mandatory baseline security controls for state networks based on industry and national standards, and annually measure the state’s progress towards compliance. (Held in the Assembly Appropriations Committee Suspense File)

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT:

CompTIA

American Civil Liberties Union

OPPOSITION:

None received

ARGUMENTS IN SUPPORT: According to CompTIA, “cybersecurity is a preeminent issue for state governments. However, many states are solely focused on one type of cybersecurity management: firewall type protection. States are forgetting the importance of securing documents or content management inside and outside the firewall. Security must also include content centric security solutions. Content focused security solutions are a must for states to consider when implementing a complete security plan.”

ASSEMBLY THIRD READING

ATR Bill Id:AB 531

Author:(Irwin)

As Amended Ver:April 20, 2017

Majority vote

SUMMARY: Requires the Office of Information Security (OIS) to review the technologies used by state agencies to protect sensitive information, and develop a plan to require state agencies to implement any information security technology that OIS determines to be necessary to protect that sensitive information. Specifically, this bill:

1. Requires OIS, by January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content inside or outside the firewall of state agencies.
2. Requires OIS, upon completing the review, to develop a plan to require the implementation by state agencies, during the next fiscal year, of any information security technology that OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of the sensitive digital content of a state agency.
3. Clarifies that nothing in these provisions shall be construed to affect the application of the California Public Records Act.
4. Defines "digital content" to mean "include[s], but is not limited to: common desktop applications such as word processing, presentations, and spreadsheets; portable document format (PDF); computer-aided design (CAD); photographs; and videos."

FISCAL EFFECT: According to the Assembly Appropriations Committee:

1. Costs of about $1.3 million (GF) for 4.5 positions to conduct the assessment over an 18 month period.
2. Unknown cost pressures (GF and special funds) on state agencies, contingent on the results of the findings of the assessments.
3. Unknown potential savings as a result of improving the state's cybersecurity.

COMMENTS:

1. Purpose of this bill: This bill is intended to drive OIS to evaluate the security practices of state agencies broadly, and develop an implementation plan for any new technologies to protect digital records specifically. This bill is author-sponsored.
2. Author's statement: According to the author, "With cyber threats increasing in frequency and complexity, and new technologies becoming available to state agencies and departments, California would be irresponsible to wait for our own OPM level breach to act. It is necessary to make a re-evaluation of data classification and security practices a priority and ensure updated standards are implemented by state agencies and departments."

"AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for the Office of Information Security.

"The State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility."

1. Concerns about the currency of state regulations: According to the author, state regulations that address data classification and security controls for sensitive data have not been updated in years. Oversight and enforcement of those regulations have also been problematic in recent years. In August of 2015, the Bureau of State Audits (BSA) released its "High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption" (Report 2015-611), which excoriated CDT for poor security and oversight practices.

For example, the BSA report found that, for information security program management specifically, nearly one-third of surveyed agencies were substantially noncompliant: 24% of entities reported full compliance, 24% reported that they were mostly compliant, 26% were partially compliant, and 3% reported that they were not at all compliant.

In practice, this bill would direct OIS to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by January 1, 2019. Once completed, OIS would be required to develop a plan to require implementation by state agencies, during the next fiscal year (which begins July 1, 2019), of any technology determined to be necessary to protection of critical information and to prevent disclosure of sensitive digital content.

Analysis Prepared by: Hank Dempsey / P. & C.P. / (916) 319-2200 FN: 0000699

Date of Hearing: May 10, 2017

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 531

Author:(Irwin) – As Amended Ver:April 20, 2017

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires the Office of Information Security (OIS) within the California Department of Technology to review, by January 1, 2019, the technologies and procedures used by state agencies to protect sensitive information, and develop a plan to require state agencies to implement, during the following year, any information security technology that OIS determines to be necessary to protect that sensitive information.

FISCAL EFFECT:

1. Costs of about $1.3 million (GF) for 4.5 positions to conduct the assessment over an 18 month period.
2. Unknown cost pressures (GF and special funds) on state agencies, contingent on the results of the findings of the assessments.
3. Unknown potential savings as a result of improving the state’s cybersecurity.

COMMENTS:

Background and Purpose. Existing law establishes OIS, which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. This requires OIS to evaluate the security practices of state agencies broadly, and develop an implementation plan for any new technologies to protect digital records specifically.

According to the author, "AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for the Office of Information Security.” The author also states, “The State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility."

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 25, 2017

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 531 (

Author:Irwin) – As Amended Ver:April 20, 2017

SUBJECT: Office of Information Security: information security technologies

SUMMARY: Requires the Office of Information Security (OIS) to review the technologies used by state agencies to protect sensitive information, and develop a plan to require state agencies to implement any information security technology that OIS determines to be necessary to protect that sensitive information. Specifically, this bill:

1. Requires OIS, by January 1, 2019, to review information security technologies currently in place in state agencies to determine if there are sufficient policies, standards, and procedures in place to protect critical government information and prevent the compromise or unauthorized disclosure of sensitive digital content inside or outside the firewall of state agencies.
2. Requires OIS, upon completing the review, to develop a plan to require the implementation by state agencies, during the next fiscal year, of any information security technology that OIS determines to be necessary to protect critical government information and prevent the compromise or unauthorized disclosure of the sensitive digital content of a state agency.
3. Clarifies that nothing in these provisions shall be construed to affect the application of the California Public Records Act.
4. Defines “digital content” to mean "include[s], but is not limited to: common desktop applications such as word processing, presentations, and spreadsheets; portable document format (PDF); computer-aided design (CAD); photographs; and videos."

EXISTING LAW:

1. Establishes OIS within the California Department of Technology (CDT), which is responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. (Government Code Section (GC) 11549(a))
2. Provides for the creation of a chief information security officer (CISO) to lead OIS and who is tasked with providing direction for information security and privacy to state government agencies, departments, and officers. (GC 11549(a)-(c))
3. Requires the CISO to establish an information security program, which includes the creation, updating and publishing of policies and standards for information security in the State Administrative Manual (SAM), information technology risk management, tracking of security and privacy incidents, and disaster recovery, as well as statewide coordination with other agencies, promotion of state agency risk management programs, and generally representing the state on matters of information security and privacy. (GC 11549.3(a))
4. Requires state entities to implement the information security and privacy policies, standards and procedures issued by OIS. (GC 11549.3(b))

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill is intended to drive OIS to evaluate the security practices of state agencies broadly, and develop an implementation plan for any new technologies to protect digital records specifically. This bill is author-sponsored.
2. Author's statement: According to the author, "With cyber threats increasing in frequency and complexity, and new technologies becoming available to state agencies and departments, California would be irresponsible to wait for our own OPM level breach to act. It is necessary to make a re-evaluation of data classification and security practices a priority and ensure updated standards are implemented by state agencies and departments."

"AB 531 is an opportunity for California to be proactive about its cybersecurity and avoid the mistakes experienced by the federal government and by private companies. There are lessons to be learned and adapted to our own state networks which this re-evaluation will make a priority for the Office of Information Security.

"The State of California has a responsibility to understand the types of data it holds on behalf of the citizens of California. It also has a responsibility to make sure it has evaluated all new approaches, processes, software, and hardware to ensure our data is being adequately protected. AB 531 will reinforce and put into action this responsibility."

1. The Office of Information Security: OIS is located under CDT and is the primary state government authority in ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information. Its purpose is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
   
   OIS is run by the CISO, who is charged with providing direction for information security and privacy to state government agencies, departments, and offices. Those duties include establishing an information security program, overseeing implementation of information policies and procedures across state agencies, and conducting independent security assessments and audits. The CISO also oversees state agency compliance with the SAM and the State Information Management Manual (SIMM).
2. Concerns about the currency of state regulations: According to the author, state regulations that address data classification and security controls for sensitive data have not been updated in years (e.g., SAM 5305.5 – last updated June 2014; SIMM 5035-A – last updated September 2013).
   
   Oversight and enforcement of those regulations have been problematic in recent years. In August of 2015, the Bureau of State Audits (BSA) released its "High Risk Update-Information Security: Many State Entities' Information Assets Are Potentially Vulnerable to Attack or Disruption" (Report 2015-611), which excoriated CDT for poor security and oversight practices, finding in part that:
   

"[CDT] has not ensured that reporting entities comply with the State's information security standards. Many reporting entities do not have sufficient information security controls – we found deficiencies at each of the five reporting entities we reviewed, and most reporting entities that responded to our survey indicated that they had yet to achieve full compliance with the security standards. It [also] was unaware that many reporting entities had not complied with these standards – 37 of the 41 reporting entities that self-certified to the technology department that they were in compliance with the security standards in 2014 indicated in our survey that they had not actually achieved full compliance in 2014…More than half of the entities that responded to our survey indicated that the technology department's guidance for complying with security standards was insufficient."

Furthermore, the BSA report found that, for information security program management specifically, nearly one-third of surveyed agencies were substantially noncompliant: 24% of entities reported full compliance, 24% reported that they were mostly compliant, 26% were partially compliant, and 3% reported that they were not at all compliant.

In practice, this bill would direct OIS to review the current information security technologies used by state agencies, and determine if the policies in place are sufficient to protect critical information and prevent unauthorized disclosure of sensitive digital content. This review would need to be completed by January 1, 2019. Once completed, OIS would be required to develop a plan to require implementation by state agencies, during the next fiscal year (which begins July 1, 2019), of any technology determined to be necessary to protection of critical information and to prevent disclosure of sensitive digital content.

This bill defines digital content as documents, spreadsheets, computer drawings, photographs and videos – all of which are protected by digital rights management (DRM) solutions. DRM describes a family of access control technologies traditionally used to protect copyrighted works that are used to restrict the use, modification and distribution of a particular file or document, as well as the systems within devices that enforce those access policies.

1. Arguments in support: The Computing Technology Industry Association (CompTIA) states "Cybersecurity is a preeminent issue for state governments. However, many states are solely focused on one type of cybersecurity management: firewall type protection. States are forgetting the importance of securing documents or content management inside and outside the firewall. Security must also include content centric security solutions such as DRM. Content focused security solutions are a must for states to consider when implementing a complete cybersecurity plan. DRM is an important tool to combat cybersecurity threats and protect government information."

"AB 531 asks state agencies to review their content security solutions to determine if the proper tools are in place. If lacking, new policies should be established by state agencies to adopt information security technology solutions. We believe protecting information at the source, the document itself, is an absolute must for any sensitive information in today’s environment."

1. Related legislation: AB 1022 (Irwin) would require state agencies to include within their Technology Recovery Plan an inventory of all critical infrastructure controls and associated assets. AB 1022 is currently pending in the Assembly Governmental Organization Committee.
   
   AB 1306 (Obernolte) would establish in statute the California Cybersecurity Integration Center (Cal-CSIC) within the Office of Emergency Services to develop a cybersecurity strategy for California, which currently operates under the authority of Executive Order B-34-15 (August 31, 2015). AB 1306 is currently pending in the Assembly Appropriations Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

Computing Technology Industry Association (CompTIA)

Opposition

None on file

Analysis Prepared by: Hank Dempsey / P. & C.P. /