SB 844: California Cybersecurity Integration Center: cybersecurity improvement: reports.
- Session Year: 2021-2022
- House: Senate
- Latest Version Date: 2022-09-23
Existing federal law, the State and Local Cybersecurity Improvement Act, establishes, within the United States Department of Homeland Security, a program to award grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of, state, local, or tribal governments.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would require the center to create four reports, to be delivered to the Legislature, as specified, for the 202122, 202223, 202324, and 202425 fiscal years that describe all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act.
Existing federal law, the State and Local Cybersecurity Improvement Act, establishes, within the United States Department of Homeland Security, a program to award grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of, state, local, or tribal governments.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would require the center to create four reports, to be delivered to the Legislature, as specified, for the 202122, 202223, 202324, and 202425 fiscal years that describe all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act.
Existing federal law, the State and Local Cybersecurity Improvement Act, establishes, within the United States Department of Homeland Security, a program to award grants to eligible entities to address cybersecurity risks and cybersecurity threats to information systems owned or operated by, or on behalf of, state, local, or tribal governments.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would make a nonsubstantive change to these provisions. require the center to create four reports, to be delivered to the Legislature, as specified, for the 202122, 202223, 202324, and 202425 fiscal years that describe all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act.
Existing law establishes the California Cybersecurity Integration Center within the Office of Emergency Services, the primary mission of which is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or computer networks in the state. Existing law requires the center to serve as the central organizing hub of state governments cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
This bill would make a nonsubstantive change to these provisions.
(a)The Office of Emergency Services shall establish and lead the California Cybersecurity Integration Center. The California Cybersecurity Integration Centers primary mission is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. The California Cybersecurity Integration Center shall serve as the central organizing hub of state governments cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. The California Cybersecurity Integration Center shall be comprised of representatives from the following organizations:
(1)The Office of Emergency Services.
(2)The Office of Information Security.
(3)The State Threat Assessment Center.
(4)The Department of the California Highway Patrol.
(5)The Military Department.
(6)The Office of the Attorney General.
(7)The California Health and Human Services Agency.
(8)The California Utilities Emergency Association.
(9)The California State University.
(10)The University of California.
(11)The California Community Colleges.
(12)The United States Department of Homeland Security.
(13)The United States Federal Bureau of Investigation.
(14)The United States Secret Service.
(15)The United States Coast Guard.
(16)Other members as designated by the Director of Emergency Services.
(b)The California Cybersecurity Integration Center shall operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources. The California Cybersecurity Integration Center shall provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of Californias agencies and departments.
(c)The California Cybersecurity Integration Center shall develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. The cybersecurity strategy shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers. The strategy shall also strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among Californias workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
(d)The California Cybersecurity Integration Center shall establish a Cyber Incident Response Team to serve as Californias primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team shall also assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government. This team shall be comprised of personnel from agencies, departments, and organizations represented in the California Cybersecurity Integration Center.
(e)Information sharing by the California Cybersecurity Integration Center shall be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyberattacks that threaten public health and safety, economic stability, and national security.
(f)(1)Notwithstanding Section 10231.5, the California Cybersecurity Integration Center shall create four reports that describe all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act (Subtitle B of Title VI of the Infrastructure Investment and Jobs Act (Public Law 117-58), as specified in Section 665g of Title 6 of the United States Code). The reports shall be delivered to the Legislature according to the following:
(A)The first report for the 202122 fiscal year shall be delivered no later than December 31, 2023.
(B)The second report for the 202223 fiscal year shall be delivered no later than December 31, 2024.
(C)The third report for the 202324 fiscal year shall be delivered no later than December 31, 2025.
(D)The fourth report for the 202425 fiscal year shall be delivered no later than December 31, 2026.
(2)Reports to be submitted pursuant to this subdivision shall be submitted in compliance with Section 9795.
(a)The Office of Emergency Services shall establish and lead the California Cybersecurity Integration Center. The California Cybersecurity Integration Centers primary mission is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. The California Cybersecurity Integration Center shall serve as the central organizing hub of state governments cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. The California Cybersecurity Integration Center shall be comprised of representatives from the following organizations:
(1)The Office of Emergency Services.
(2)The Office of Information Security.
(3)The State Threat Assessment Center.
(4)The Department of the California Highway Patrol.
(5)The Military Department.
(6)The Office of the Attorney General.
(7)The California Health and Human Services Agency.
(8)The California Utilities Emergency Association.
(9)The California State University.
(10)The University of California.
(11)The California Community Colleges.
(12)The United States Department of Homeland Security.
(13)The United States Federal Bureau of Investigation.
(14)The United States Secret Service.
(15)The United States Coast Guard.
(16)Other members as designated by the Director of Emergency Services.
(b)The California Cybersecurity Integration Center shall operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources. The California Cybersecurity Integration Center shall provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of Californias agencies and departments.
(c)The California Cybersecurity Integration Center shall develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. The cybersecurity strategy shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers. The strategy shall also strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among Californias workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
(d)The California Cybersecurity Integration Center shall establish a Cyber Incident Response Team to serve as Californias primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team shall also assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government. This team shall be comprised of personnel from agencies, departments, and organizations represented in the California Cybersecurity Integration Center.
(e)Information sharing by the California Cybersecurity Integration Center shall be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyberattacks that threaten public health and safety, economic stability, and national security.
(f)(1)Notwithstanding Section 10231.5, the California Cybersecurity Integration Center shall create four reports that describe all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act (Subtitle B of Title VI of the Infrastructure Investment and Jobs Act (Public Law 117-58), as specified in Section 665g of Title 6 of the United States Code). The reports shall be delivered to the Legislature according to the following:
(A)The first report for the 202122 fiscal year shall be delivered no later than December 31, 2023.
(B)The second report for the 202223 fiscal year shall be delivered no later than December 31, 2024.
(C)The third report for the 202324 fiscal year shall be delivered no later than December 31, 2025.
(D)The fourth report for the 202425 fiscal year shall be delivered no later than December 31, 2026.
(2)Reports to be submitted pursuant to this subdivision shall be submitted in compliance with Section 9795.
(a)The Office of Emergency Services shall establish and lead the California Cybersecurity Integration Center. The California Cybersecurity Integration Centers primary mission is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. The California Cybersecurity Integration Center shall serve as the central organizing hub of state governments cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. The California Cybersecurity Integration Center shall be comprised of representatives from the following organizations:
(1)The Office of Emergency Services.
(2)The Office of Information Security.
(3)The State Threat Assessment Center.
(4)The Department of the California Highway Patrol.
(5)The Military Department.
(6)The Office of the Attorney General.
(7)The California Health and Human Services Agency.
(8)The California Utilities Emergency Association.
(9)The California State University.
(10)The University of California.
(11)The California Community Colleges.
(12)The United States Department of Homeland Security.
(13)The United States Federal Bureau of Investigation.
(14)The United States Secret Service.
(15)The United States Coast Guard.
(16)Other members as designated by the Director of Emergency Services.
(b)The California Cybersecurity Integration Center shall operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources. The California Cybersecurity Integration Center shall provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of Californias agencies and departments.
(c)The California Cybersecurity Integration Center shall develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. The cybersecurity strategy shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers. The strategy shall also strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among Californias workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
(d)The California Cybersecurity Integration Center shall establish a Cyber Incident Response Team to serve as Californias primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team shall also assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government. This team shall be comprised of personnel from agencies, departments, and organizations represented in the California Cybersecurity Integration Center.
(e)Information sharing by the California Cybersecurity Integration Center shall be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyberattacks that threaten public health and safety, economic stability, and national security.
(f)(1)Notwithstanding Section 10231.5, the California Cybersecurity Integration Center shall create four reports that describe all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act (Subtitle B of Title VI of the Infrastructure Investment and Jobs Act (Public Law 117-58), as specified in Section 665g of Title 6 of the United States Code). The reports shall be delivered to the Legislature according to the following:
(A)The first report for the 202122 fiscal year shall be delivered no later than December 31, 2023.
(B)The second report for the 202223 fiscal year shall be delivered no later than December 31, 2024.
(C)The third report for the 202324 fiscal year shall be delivered no later than December 31, 2025.
(D)The fourth report for the 202425 fiscal year shall be delivered no later than December 31, 2026.
(2)Reports to be submitted pursuant to this subdivision shall be submitted in compliance with Section 9795.
(a)The Office of Emergency Services shall establish and lead the California Cybersecurity Integration Center. The California Cybersecurity Integration Centers primary mission is to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in our the state. The California Cybersecurity Integration Center shall serve as the central organizing hub of state governments cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. The California Cybersecurity Integration Center shall be comprised of representatives from the following organizations:
(1)The Office of Emergency Services.
(2)The Office of Information Security.
(3)The State Threat Assessment Center.
(4)The Department of the California Highway Patrol.
(5)The Military Department.
(6)The Office of the Attorney General.
(7)The California Health and Human Services Agency.
(8)The California Utilities Emergency Association.
(9)The California State University.
(10)The University of California.
(11)The California Community Colleges.
(12)The United States Department of Homeland Security.
(13)The United States Federal Bureau of Investigation.
(14)The United States Secret Service.
(15)The United States Coast Guard.
(16)Other members as designated by the Director of Emergency Services.
(b)The California Cybersecurity Integration Center shall operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, private companies, and other appropriate sources. The California Cybersecurity Integration Center shall provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of Californias agencies and departments.
(c)The California Cybersecurity Integration Center shall develop a statewide cybersecurity strategy, informed by recommendations from the California Task Force on Cybersecurity and in accordance with state and federal requirements, standards, and best practices. The cybersecurity strategy shall be developed to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers. The strategy shall also strengthen cyber emergency preparedness and response, standardize implementation of data protection measures, enhance digital forensics and cyber investigative capabilities, deepen expertise among Californias workforce of cybersecurity professionals, and expand cybersecurity awareness and public education.
(d)The California Cybersecurity Integration Center shall establish a Cyber Incident Response Team to serve as Californias primary unit to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team shall also assist law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government. This team shall be comprised of personnel from agencies, departments, and organizations represented in the California Cybersecurity Integration Center.
(e)Information sharing by the California Cybersecurity Integration Center shall be conducted in a manner that protects the privacy and civil liberties of individuals, safeguards sensitive information, preserves business confidentiality, and enables public officials to detect, investigate, respond to, and prevent cyberattacks that threaten public health and safety, economic stability, and national security.
|
Date
|
Status
|
|---|---|
| Sep 23, 2022 | Chaptered by Secretary of State. Chapter 505, Statutes of 2022. |
| Sep 23, 2022 | Approved by the Governor. |
| Sep 9, 2022 | Enrolled and presented to the Governor at 3 p.m. |
| Aug 31, 2022 | In Senate. Ordered to engrossing and enrolling. |
| Aug 31, 2022 | Read third time. Passed. Ordered to the Senate. |
| Aug 15, 2022 | Read second time. Ordered to third reading. |
| Aug 11, 2022 | From committee: Do pass. (Ayes 16. Noes 0.) (August 11). |
| Aug 3, 2022 | August 3 set for first hearing. Placed on suspense file. |
| Jun 28, 2022 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 7. Noes 0.) (June 27). Re-referred to Com. on APPR. |
| May 19, 2022 | Referred to Com. on E.M. |
| May 12, 2022 | In Assembly. Read first time. Held at Desk. |
| May 12, 2022 | Read third time. Passed. (Ayes 35. Noes 0. Page 3671.) Ordered to the Assembly. |
| May 10, 2022 | Read second time. Ordered to consent calendar. |
| May 9, 2022 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8 and ordered to consent calendar. |
| Apr 29, 2022 | Set for hearing May 9. |
| Apr 26, 2022 | From committee: Do pass and re-refer to Com. on APPR with recommendation: To consent calendar. (Ayes 13. Noes 0. Page 3510.) (April 26). Re-referred to Com. on APPR. |
| Apr 6, 2022 | Set for hearing April 26. |
| Mar 23, 2022 | Re-referred to Com. on G.O. |
| Mar 16, 2022 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on RLS. |
| Feb 7, 2022 | Art. IV. Sec. 8(a) of the Constitution dispensed with. |
| Jan 19, 2022 | Referred to Com. on RLS. |
| Jan 13, 2022 | From printer. May be acted upon on or after February 12. |
| Jan 12, 2022 | Introduced. Read first time. To Com. on RLS. for assignment. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 31, 2022 | SB 844 Min Senate Third Reading By Aguiar-Curry | Assembly Floor |
Passed |
|
| May 12, 2022 | Consent Calendar SB844 | Senate Floor |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
Bill Author
Bill Co-Author(s):