This bill would require Cal-CSIC to include representatives from the State Department of Education.

Existing law requires Cal-CSIC to serve as the central organizing hub of the state governments cybersecurity activities and coordinate information sharing with, and share cyber threat information received from, specified public and private entities. Existing law also requires a school district, county office of education, or charter school to report any cyberattack, as defined, impacting more than 500 pupils or personnel to Cal-CSIC.

This bill would explicitly include school districts, county offices of education, and charter schools among the specified entities with which Cal-CSIC coordinates information sharing, including cyber threat information.

This bill would require Cal-CSIC to include representatives from the State Department of Education.

Existing law requires Cal-CSIC to serve as the central organizing hub of the state governments cybersecurity activities and coordinate information sharing with, and share cyber threat information received from, specified public and private entities. Existing law also requires a school district, county office of education, or charter school to report any cyberattack, as defined, impacting more than 500 pupils or personnel to Cal-CSIC.

This bill would explicitly include school districts, county offices of education, and charter schools among the specified entities with which Cal-CSIC coordinates information sharing, including cyber threat information.

Existing law requires Cal-CSIC to serve as the central organizing hub of the state governments cybersecurity activities and coordinate information sharing with, and share cyber threat information received from, specified public and private entities. Existing law also requires a school district, county office of education, or charter school to report any cyberattack, as defined, impacting more than 500 pupils or personnel to the California Cybersecurity Integration Center. Cal-CSIC.

This bill would state the intent of the Legislature to enact future legislation that would provide additional support and funding to local educational agencies to improve and expand protections against cybersecurity threats. explicitly include school districts, county offices of education, and charter schools among the specified entities with which Cal-CSIC coordinates information sharing, including cyber threat information.

Existing law requires the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center with a primary mission to reduce the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in our state. Existing law requires a school district, county office of education, or charter school to report any cyberattack, as defined, impacting more than 500 pupils or personnel to the California Cybersecurity Integration Center.

This bill would state the intent of the Legislature to enact future legislation that would provide additional support and funding to local educational agencies to improve and expand protections against cybersecurity threats.

 THIRD READING  

Bill No: AB 1023

Author: Papan (D)

Amended: 3/23/23 in Assembly

Vote: 21

SENATE GOVERNMENTAL ORG. COMMITTEE: 15-0, 6/27/23

AYES: Dodd, Wilk, Alvarado-Gil, Archuleta, Ashby, Bradford, Glazer, Jones, Nguyen, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Seyarto

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 74-0, 5/18/23 (Consent) - See last page for vote

SUBJECT: California Cybersecurity Integration Center: school cybersecurity

SOURCE: Author

DIGEST:

This bill expands the scope of the California Cybersecurity Integration Center (Cal-CSIC), within the California Office of Emergency Services (OES), by explicitly requiring Cal-CSIC to coordinate cyber threat information sharing with school districts, county offices of education, and charter schools, and adds the California State Department of Education (CDE) to Cal-CSIC, as specified.

ANALYSIS:

Existing law:

1. Establishes Cal-CSIC, within OES, with a primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
2. Requires Cal-CSIC to serve as the central organizing hub of state government’s cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
3. Provides that Cal-CSIC be composed of representatives from the following organizations: OES; the Office of Information Security (OIS); the State Treat Assessment Center (STAC); the Department of California Highway Patrol (CHP); the Military Department (CMD); the Office of the Attorney General (AG); the California Health and Human Services Agency (HHS); the California Utilities Emergency Association (UEA); the California State University (CSU); the University of California (UC); the California Community Colleges (CCCs); the United States Department of Homeland Security; the United States Federal Bureau of Investigation (FBI); the United States Secret Service; the United States Coast Guard, and other members as designated by the Director of OES.

This bill:

1. Requires Cal-CSIC to additionally coordinate information sharing with school districts, county offices of education, and charter schools, as specified.
2. Adds a representative from CDE to Cal-CSIC.
3. Includes related legislative findings and declarations.

Background

Author Statement. According to the author’s office, “The California Cybersecurity Integration Center coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations. With the rise of cyber threats, this group is imperative to protect sensitive, personal data in public and private networks and databases. Unfortunately, our K-12 schools are not involved with this group, yet have recently been the target of cyberattacks. Our school districts maintain sensitive medical and financial data on staff and students and their families. AB 1023 will include local education agencies (LEAs) in Cal-CSIC and allow them to become informed and prepared for cyber threats.”

California Cybersecurity Integration Center. Created by executive order in 2015, and gaining full statutory authority in 2018, Cal-CSIC is a unique, interdisciplinary and inter-department organization poised to become a leader in cybersecurity innovation. As envisioned by the Legislature, Cal-CSIC’s responsibilities are broad, and include: developing a statewide cybersecurity strategy; overseeing a Cyber Incident Response Team, which serves as California’s primary unit in cyber threat detection, reporting, and response for the public and private sectors; assisting law enforcement partners in criminal investigations of cyber-related incidents; collecting and sharing cyber threat information among state agencies, utilities, academic institutions, private companies, and other throughout the state; providing warnings of cyberattacks to government agencies and nongovernmental partners; supporting public and private sector partners in protecting their vulnerable infrastructure and information technology networks; and, assessing risks to those institutions.

Cal-CSIC's mission is to reduce the number of cyber threats and attacks in California by focusing on responding to those that could harm the economy, critical infrastructure, or computer networks in the state. Its focus is to respond to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state. Cal-CSIC is the hub of state government’s cybersecurity events, and coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

Cal-CSIC’s statewide cybersecurity strategy takes recommendations from the California Task Force on Cybersecurity and follows state and federal requirements. The cybersecurity strategy is intended to improve how cyber threats are found, understood, and shared. The strategy strengthens cyber emergency preparedness and response, standardize data protection measures, enhance digital forensics, and increase cyber investigative capabilities, supply lessons learned to California’s workforce of cybersecurity professionals, and expands cybersecurity awareness.

The Cyber Incident Response Team aids law enforcement agencies with jurisdiction for cyber-related criminal investigations and work with agencies responsible for advancing information security within state government, while Cal-CSIC’s information sharing practices aim to protect individual privacy, civil liberties, and business confidentiality. Cal-CSIC publishes Cyber Threat Alerts and Advisories, which supply cybersecurity threat information between federal, state, local, and Tribal government entities. Advisories and Alerts are shared with private sector partners.

State Threat Assessment Center. The STAC serves as California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting to statewide leadership and the public safety community in support of efforts to prevent, prepare for, mitigate, and respond to all crimes and all hazards impacting California citizens and critical infrastructure, while preserving civil liberties, individual privacy, and constitutional rights. The STAC is California’s primary fusion center, as designated by the Governor of California, and is operated by the CHP, OES, and the California Department of Justice (DOJ).

The STAC was opened as a direct result of the events of 9/11 with the goal of helping to fix issues with information sharing across the nation, and serves as the state-level partner to regional and urban fusion centers in Sacramento, San Francisco, Los Angeles, Orange County, and San Diego which are locally organized and directed.

Education and Technology. Cyberattacks on schools are particularly harmful, as they have the potential to interfere with a school’s educational mission by prohibiting normal instruction, and can also result in the unauthorized disclosure of highly sensitive pupil records. Both state and federal law recognize the unique sensitivity of pupil records and place stringent limitations on conditions in which such information can be disclosed. The federal Family Educational Rights and Privacy Act (FERPA) provides parents and eligible students with the right to inspect and review the student’s education records, and to request corrections to records they believe to be inaccurate, but generally prohibits disclosure of the student’s education record without the consent of the parent or student, except under specified conditions.

California law similarly considers pupil records worthy of additional protection and specifies several conditions and limitations on the use, maintenance, and disclosure of pupil records, including prohibiting a school district from permitting access to pupil records to a person without written parental consent or a lawfully issued subpoena or court order to do so. But these comprehensive privacy laws do not appear to protect such sensitive records against unauthorized access to and disclosure of student records that can result from a breach of cybersecurity.

California Department of Education. The CDE oversees the state’s diverse and dynamic public school system, which is responsible for the education of more than seven million children and young adults in more than 9,000 schools. The CDE and the State Superintendent of Public Instruction (SPI) are responsible for enforcing education law and regulations; and for continuing to reform and improve public elementary school programs, secondary school programs, adult education, some preschool programs, and child care programs.

As CDE collects and protects student data – to protect and maintain sensitive information and awareness throughout the year – the Educational Data Governance Program hosts presentations by cybersecurity and privacy experts from federal partner agencies such as the FBI and the U.S. Department of Education. Additionally, CDE staff are tasked to network and learn from privacy professionals and share privacy resources with schools and districts at conferences and symposia.

Expanding Cal-CSIC. This bill aims to enhance cybersecurity collaboration and information sharing between Cal-CSIC and school districts, county offices of education, and charter schools. Additionally, this bill requires a representative from the CDE to join Cal-CSIC and includes related legislative findings and declarations emphasizing the increasing cyber threats faced by educational institutions and the need for strengthened cybersecurity measures.

Related/Prior Legislation

SB 74 (Dodd, 2023) requires state entities to prohibit high-risk applications for social media platforms from being downloaded or installed on those entities’ state-owned or state-issued devices, as specified. (Pending in the Assembly Accountability and Administrative Review Committee)

SB 265 (Hurtado, 2023) requires Cal-CSIC to prepare a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified. (Pending in the Assembly Appropriations Committee)

AB 569 (E. Garcia, Chapter 117, Statutes of 2023) required the Chancellor of the California State University (CSU) to report to the Legislature, on or before July 1, 2028, on the Cybersecurity Regional Alliances and Multistakeholder Partnerships Pilot Program, as specified.

AB 749 (Irwin, 2023) requires every state agency to implement Zero Trust architecture by January 1, 2026, as specified. (Pending in the Senate Appropriations Committee)

SB 892 (Hurtado, Chapter 820, Statutes of 2022) required OES to direct Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity, as specified.

AB 2135 (Irwin, Chapter 773, Statutes of 2022) required state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, required those agencies to perform a comprehensive independent security assessment every two years, as specified.

AB 2355 (Salas, Chapter 498, Statutes of 2022) required a Local Educational Agency (LEA) to report a cyberattack impacting 500 or more pupils or personnel to report to Cal-CSIC and required the Cal-CSIC to annually report to the Governor and relevant policy committees of the Legislature with specified information related to the cyberattack.

AB 2813 (Irwin, Chapter 768, Statutes of 2018) established Cal-CSIC to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state, as specified.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 8/14/23)

Alameda County Office of Education

California Federation of Teachers

California School Boards Association

Los Angeles County Office of Education

Los Angeles Unified School District

Protection of the Educational Rights of Kids

OPPOSITION: (Verified 8/14/23)

None received

ARGUMENTS IN SUPPORT: In support of the bill, the California School Boards Association writes that, “[i]n most instances the term ‘academic institution’ is used in reference to institutions of higher education. AB 1023 would specifically include K-12 school districts, county offices of education and charter schools under the umbrella of academic institutions with regard to Cal-CSIC.”

Further, “there are over 1,000 local education agencies (LEAs) in California representing almost 6 million students, over 500,000 staff and 10,000 school sites. Over the last few years, ransomware attacks on California’s LEAs have increased. For many districts it is not a matter of if, but when they will be subject to a cybersecurity attack which can render the entire school district unable to conduct the business of educating students. By specifically including LEAs as an academic institution under Cal-CSIC, it will ensure that LEAs receive information and guidance to address issues of cybersecurity and protecting student data and privacy.”

ASSEMBLY FLOOR: 74-0, 5/18/23

AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Chen, Connolly, Megan Dahle, Davies, Dixon, Essayli, Flora, Mike Fong, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lackey, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Wallis, Ward, Weber, Wicks, Wood, Zbur, Rendon

NO VOTE RECORDED: Cervantes, Vince Fong, Friedman, Villapudua, Waldron, Wilson

Prepared by: Brian Duke / G.O. / (916) 651-1530

8/16/23 14:02:19

**** END ****

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2023 - 2024 Regular

Bill No: 1023 Hearing Date: 6/27/2023

SUBJECT: California Cybersecurity Integration Center: school cybersecurity

DIGEST: This bill expands the scope of the California Cybersecurity Integration Center (Cal-CSIC), within the California Office of Emergency Services (OES), by explicitly requiring Cal-CSIC to coordinate cyber threat information sharing with school districts, county offices of education, and charter schools, and adds the California State Department of Education (CDE) to Cal-CSIC, as specified.

ANALYSIS:

Existing law:

1. Establishes Cal-CSIC, within OES, with a primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
2. Requires Cal-CSIC to serve as the central organizing hub of state government’s cybersecurity activities and to coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations.
3. Provides that Cal-CSIC be composed of representatives from the following organizations: OES; the Office of Information Security (OIS); the State Treat Assessment Center (STAC); the Department of California Highway Patrol (CHP); the Military Department (CMD); the Office of the Attorney General (AG); the California Health and Human Services Agency (HHS); the California Utilities Emergency Association (UEA); the California State University (CSU); the University of California (UC); the California Community Colleges (CCCs); the United States Department of Homeland Security; the United States Federal Bureau of Investigation (FBI); the United States Secret Service; the United States Coast Guard, and other members as designated by the Director of OES.

This bill:

1. Requires Cal-CSIC to additionally coordinate information sharing with school districts, county offices of education, and charter schools, as specified.
2. Adds a representative from CDE to Cal-CSIC.
3. Includes related legislative findings and declarations.

Background

Author Statement. According to the author’s office, “the California Cybersecurity Integration Center coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations. With the rise of cyber threats, this group is imperative to protect sensitive, personal data in public and private networks and databases. Unfortunately, our K-12 schools are not involved with this group, yet have recently been the target of cyberattacks. Our school districts maintain sensitive medical and financial data on staff and students and their families. AB 1023 will include local education agencies (LEAs) in Cal-CSIC and allow them to become informed and prepared for cyber threats.”

California Cybersecurity Integration Center. Created by executive order in 2015, and gaining full statutory authority in 2018, Cal-CSIC is a unique, interdisciplinary and inter-department organization poised to become a leader in cybersecurity innovation. As envisioned by the Legislature, Cal-CSIC’s responsibilities are broad, and include: developing a statewide cybersecurity strategy; overseeing a Cyber Incident Response Team, which serves as California’s primary unit in cyber threat detection, reporting, and response for the public and private sectors; assisting law enforcement partners in criminal investigations of cyber-related incidents; collecting and sharing cyber threat information among state agencies, utilities, academic institutions, private companies, and other throughout the state; providing warnings of cyberattacks to government agencies and nongovernmental partners; supporting public and private sector partners in protecting their vulnerable infrastructure and information technology networks; and, assessing risks to those institutions.

Cal-CSIC's mission is to reduce the number of cyber threats and attacks in California by focusing on responding to those that could harm the economy, critical infrastructure, or computer networks in the state. Its focus is to respond to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state. Cal-CSIC is the hub of state government’s cybersecurity events, and coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

Cal-CSIC’s statewide cybersecurity strategy takes recommendations from the California Task Force on Cybersecurity and follows state and federal requirements. The cybersecurity strategy is intended to improve how cyber threats are found, understood, and shared. The strategy strengthens cyber emergency preparedness and response, standardize data protection measures, enhance digital forensics, and increase cyber investigative capabilities, supply lessons learned to California’s workforce of cybersecurity professionals, and expands cybersecurity awareness.

The Cyber Incident Response Team aids law enforcement agencies with jurisdiction for cyber-related criminal investigations and work with agencies responsible for advancing information security within state government, while Cal-CSIC’s information sharing practices aim to protect individual privacy, civil liberties, and business confidentiality. Cal-CSIC publishes Cyber Threat Alerts and Advisories, which supply cybersecurity threat information between federal, state, local, and Tribal government entities. Advisories and Alerts are shared with private sector partners.

State Threat Assessment Center. The STAC serves as California’s information sharing clearinghouse of strategic threat analysis and situational awareness reporting to statewide leadership and the public safety community in support of efforts to prevent, prepare for, mitigate, and respond to all crimes and all hazards impacting California citizens and critical infrastructure, while preserving civil liberties, individual privacy, and constitutional rights. The STAC is California’s primary fusion center, as designated by the Governor of California, and is operated by the CHP, OES, and the California Department of Justice (DOJ).

The STAC was opened as a direct result of the events of 9/11 with the goal of helping to fix issues with information sharing across the nation, and serves as the state-level partner to regional and urban fusion centers in Sacramento, San Francisco, Los Angeles, Orange County, and San Diego which are locally organized and directed.

Education and Technology. Cyberattacks on schools are particularly harmful, as they have the potential to interfere with a school’s educational mission by prohibiting normal instruction, and can also result in the unauthorized disclosure of highly sensitive pupil records. Both state and federal law recognize the unique sensitivity of pupil records and place stringent limitations on conditions in which such information can be disclosed. The federal Family Educational Rights and Privacy Act (FERPA) provides parents and eligible students with the right to inspect and review the student’s education records, and to request corrections to records they believe to be inaccurate, but generally prohibits disclosure of the student’s education record without the consent of the parent or student, except under specified conditions.

California law similarly considers pupil records worthy of additional protection and specifies several conditions and limitations on the use, maintenance, and disclosure of pupil records, including prohibiting a school district from permitting access to pupil records to a person without written parental consent or a lawfully issued subpoena or court order to do so. But these comprehensive privacy laws do not appear to protect such sensitive records against unauthorized access to and disclosure of student records that can result from a breach of cybersecurity.

California Department of Education. The CDE oversees the state’s diverse and dynamic public school system, which is responsible for the education of more than seven million children and young adults in more than 9,000 schools. The CDE and the State Superintendent of Public Instruction (SPI) are responsible for enforcing education law and regulations; and for continuing to reform and improve public elementary school programs, secondary school programs, adult education, some preschool programs, and child care programs.

As CDE collects and protects student data – to protect and maintain sensitive information and awareness throughout the year – the Educational Data Governance Program hosts presentations by cybersecurity and privacy experts from federal partner agencies such as the FBI and the U.S. Department of Education. Additionally, CDE staff are tasked to network and learn from privacy professionals and share privacy resources with schools and districts at conferences and symposia.

Expanding Cal-CSIC. This bill aims to enhance cybersecurity collaboration and information sharing between Cal-CSIC and school districts, county offices of education, and charter schools. Additionally, this bill requires a representative from the CDE to join Cal-CSIC and includes related legislative findings and declarations emphasizing the increasing cyber threats faced by educational institutions and the need for strengthened cybersecurity measures.

Prior/Related Legislation

SB 74 (Dodd, 2023) requires state entities to prohibit high-risk applications for social media platforms from being downloaded or installed on those entities’ state-owned or state-issued devices, as specified. (Pending in the Assembly Accountability and Administrative Review Committee)

SB 265 (Hurtado, 2023) requires Cal-CSIC to prepare a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified. (Pending in the Assembly Emergency Management Committee)

AB 569 (E. Garcia, 2023) requires the Chancellor of the California State University (CSU) to report to the Legislature, on or before July 1, 2028, on the Cybersecurity Regional Alliances and Multistakeholder Partnerships Pilot Program, as specified. (Pending in the Senate Education Committee)

AB 749 (Irwin, 2023) requires every state agency to implement Zero Trust architecture by January 1, 2026, as specified. (Pending in the Senate Governmental Organization Committee)

SB 892 (Hurtado, Chapter 820, Statutes of 2022) requires OES to direct Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity, as specified.

AB 2135 (Irwin, Chapter 773, Statutes of 2022) requires state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, requires those agencies to perform a comprehensive independent security assessment every two years, as specified.

AB 2355 (Salas, Chapter 498, Statutes of 2022) requires a Local Educational Agency (LEA) to report a cyberattack impacting 500 or more pupils or personnel to report to Cal-CSIC and requires the Cal-CSIC to annually report to the Governor and relevant policy committees of the Legislature with specified information related to the cyberattack.

AB 2813 (Irwin, Chapter 768, Statutes of 2018) establishes Cal-CSIC to reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state, as specified.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

Alameda County Office of Education

California Federation of Teachers

California School Boards Association

Los Angeles County Office of Education

Los Angeles Unified School District

OPPOSITION:

None received

ARGUMENTS IN SUPPORT: In support of the bill, the California School Boards Association writes that, “[i]n most instances the term ‘academic institution’ is used in reference to institutions of higher education. AB 1023 would specifically include K-12 school districts, county offices of education and charter schools under the umbrella of academic institutions with regard to Cal-CSIC.”

Further, “there are over 1,000 local education agencies (LEAs) in California representing almost 6 million students, over 500,000 staff and 10,000 school sites. Over the last few years, ransomware attacks on California’s LEAs have increased. For many districts it is not a matter of if, but when they will be subject to a cybersecurity attack which can render the entire school district unable to conduct the business of educating students. By specifically including LEAs as an academic institution under Cal-CSIC, it will ensure that LEAs receive information and guidance to address issues of cybersecurity and protecting student data and privacy.”

Date of Hearing: May 10, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 1023

Author:(Papan) – As Amended Ver:March 23, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires the California Cybersecurity Integration Center (Cal-CSIC) at the Office of Emergency Services (OES) to include representatives from the California Department of Education (CDE) and explicitly lists school districts, county offices of education, and charter schools among the specified entities with which Cal-CSIC is to coordinate information sharing.

FISCAL EFFECT:

1. Minor and absorbable costs to OES to include CDE in Cal-CSIC. OES is already tasked with coordinating information sharing with academic institutions.
2. Minor and absorbable costs to CDE to participate in Cal-CSIC.

COMMENTS:

1. Purpose. According to the author:

With the rise of cyber threats, [Cal-CSIC] is imperative to protect sensitive, personal data in public and private networks and databases. Unfortunately, our K-12 schools are not involved with this group, yet have recently been the target of cyberattacks. Our school districts maintain sensitive medical and financial data on staff and students and their families. AB 1023 will include [local education agencies (LEAs)] in Cal-CSIC and allow them to become informed and prepared for cyber threats.

This bill is sponsored by the California School Boards Association (CSBA) and supported by the California Federation of Teachers and Los Angeles Unified School District (LAUSD).

1. Increasing Frequency of Cyberattacks on LEAs. A variety of LEAs, from a rural northern California county office of education to LAUSD, have experienced significant cyberattacks in the last several years. Each attack is different, but generally causes disruptions in email access, financial software, and internet capabilities. Under the umbrella of OES, Cal-CSIC serves as the central organizing hub of state government’s cybersecurity activities and coordinates information sharing amongst stakeholders, including local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. However, CSBA notes “In most instances the term ‘academic institution’ is used in reference to institutions of higher education. Nowhere in the authorizing language of Cal-CSIC is there a mention of entities that serve K-12 education.” This bill explicitly includes school districts, county offices of education, and charter schools in Cal-CSIC information sharing efforts and requires CDE involvement in Cal-CSIC.

Analysis Prepared by: Irene Ho / APPR. / (916) 319-2081

Date of Hearing: April 26, 2023

ASSEMBLY COMMITTEE ON EDUCATION

Al Muratsuchi, Chair

ABPCA Bill Id:AB 1023 (

Author:Papan) – As Amended Ver:March 23, 2023

[Note: This bill is double referred to the Assembly Emergency Management Committee and was heard by that Committee as it relates to issues under its jurisdiction.]

SUBJECT: California Cybersecurity Integration Center: school cybersecurity

SUMMARY: Requires the California Cybersecurity Integration Center (Cal-CSIC) to serve as the central organizing hub of state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, nongovernmental organizations, and academic institutions, including school districts, county offices of education (COEs), and charter schools. Specifically, this bill:

1. Requires the Cal-CSIC to serve as the central organizing hub of state government’s cybersecurity activities and coordinate information sharing with local, state, and federal agencies, tribal governments, utilities and other service providers, nongovernmental organizations, and academic institutions, including school districts, COEs, and charter schools.
2. Requires the Cal-CSIC to be composed of representatives from the following organizations:
   1. The Office of Emergency Services (Cal OES);
   2. The Office of Information Security;
   3. The State Threat Assessment Center;
   4. The Department of the California Highway Patrol;
   5. The Military Department;
   6. The Office of the Attorney General;
   7. The California Health and Human Services Agency;
   8. The California Utilities Emergency Association;
   9. The California State University;
   10. The University of California;
   11. The California Community Colleges;
   12. The California Department of Education (CDE);
   13. The United States Department of Homeland Security;
   14. The United States Federal Bureau of Investigation (FBI);
   15. The United States Secret Service;
   16. The United States Coast Guard; and
   17. Other members as designated by the Director of Emergency Services.
3. Requires the Cal-CSIC to operate in close coordination with the California State Threat Assessment System and the United States Department of Homeland Security — National Cybersecurity and Communications Integration Center, including sharing cyber threat information that is received from utilities, academic institutions, including school districts, COEs, and charter schools, private companies, and other appropriate sources. Requires the Cal-CSIC to provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure and information technology networks, prioritize cyber threats and support public and private sector partners in protecting their vulnerable infrastructure and information technology networks, enable cross-sector coordination and sharing of recommended best practices and security measures, and support cybersecurity assessments, audits, and accountability programs that are required by state law to protect the information technology networks of California’s agencies and departments.

EXISTING LAW:

1. Establishes, within the Government Operations Agency, the Department of Technology (DOT), and generally tasks the department with the approval and oversight of information technology (IT) projects, and with improving the governance and implementation of IT by standardizing reporting relationships, roles, and responsibilities for setting IT priorities. (Government Code (GC) 11545, et seq.)
2. Establishes, within the DOT, the Office of Information Security (OIS), with the purpose of ensuring the confidentiality, integrity, and availability of state IT systems and promoting and protecting privacy as part of the development and operations of state IT systems, and tasks OIS with the duty to provide direction for information security and privacy to state government agencies, departments, and offices. (GC 11549(a) and (c))
3. Requires the chief of the OIS to establish an information security program with responsibilities including, among others, the creation, updating, maintenance, and issuing of information security and privacy policies, standards, and procedures for state agencies, and of policies, standards, and procedures directing state agencies to effectively manage security and risk for IT, and for mission critical, confidential, sensitive, or personal information. (GC 11549.3(a))
4. Authorizes the OIS to conduct, or require to be conducted, an Independent Security Assessment (ISA) of every state agency, department, or office, and requires the cost of the ISA to be funded by the state agency, department, or office being assessed, and specifies that OIS must, in consultation with the Cal OES, annually require no fewer than 35 state entities to perform an ISA. (GC 11549.3(c)(1) and (2))
5. Authorizes the Military Department to perform an ISA of any state agency, department, or office, and requires the cost of the ISA to be funded by the agency, department, or office being assessed. (GC 11549.3(c)(3))
6. Authorizes the Military Department to perform an ISA of an LEA defined as a school district, COE, charter school, or state special school. (GC 11549.3(i))
7. Requires that, notwithstanding any other law, during the process of conducting an ISA, information and records concerning the ISA are confidential and not be disclosed, except to state employees or contractors who have been approved as necessary to receive the information and records to perform the ISA or subsequent remediation activity, and that the results of a completed ISA are subject to all applicable laws relating to disclosure and confidentiality including the California Public Records Act (PRA). (GC 11549.3(f))
8. Requires that nothing in the California PRA be construed to require the disclosure of an information security record of a public agency, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency. (GC 6254.19)
9. Authorizes a local educational agency (LEA) to enter into a contract with a third party to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, or to provide digital educational software that authorizes a third-party provider to access, store, and use pupil records. (Education Code (EC) 49073.1(a))
10. Specifies numerous conditions and limitations on the use, maintenance, and disclosure or release of pupil records and information by an LEA, including prohibiting a school district from permitting access to pupil records to a person without written parental consent or a lawfully issued subpoena or court order to do so. (EC 49073)
11. Establishes the Cal-CSIC under the Cal OES. (GC 8586.5)
12. Requires the disclosure of any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or, whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person and the agency that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. (Civil Code (CC) 1798.29)

FISCAL EFFECT: Unknown

COMMENTS:

Need for the bill. According to the author, “The California Cybersecurity Integration Center coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations. With the rise of cyber threats, this group is imperative to protect sensitive, personal data in public and private networks and databases. Unfortunately, our K-12 schools are not involved with this group, yet have recently been the target of cyberattacks. Our school districts maintain sensitive medical and financial data on staff and students and their families. AB 1023 will include LEAs in Cal-CSIC and allow them to become informed and prepared for cyber threats.”

California Cybersecurity Integration Center (Cal-CSIC). According to the Cal OES, Cal-CSIC is a Cal OES division with the primary mission to “reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in our state.” In 2018, the Governor signed AB 2813 (Chapter 768, Statutes of 2018) further defining the structure and mission of Cal-CSIC. Cal-CSIC is structured to have the following:

• A Cyber Incident Response Coordination Team to lead cyber threat detection, reporting, and response in coordination with public and private entities across the state. This team assists law enforcement agencies with primary jurisdiction for cyber-related criminal investigations and agencies responsible for advancing information security within state government;
• The Cal-CSIC serves as a conduit for cybersecurity threat information between federal, state, local, and tribal government entities. Advisories and Alerts are also shared with private sector partners;
• Provides the exchange of intelligence-driven cyber threat indicators between the Cal-CSIC cyber threat feeds and partner entities at machine speed, resulting in the distribution of relevant and timely cyber threat and trend information; and
• Cal-CSIC Analysts collect and analyze phishing emails to extrapolate relevant information about the attacker and their respective tactics, called Indicators of Compromise (IOC). These IOCs are added to the California Automated Indicator Exchange to ensure timely distribution to partner entities.

Increasing frequency of cyberattacks on LEAs. According to a 2021 article by CalMatters, Under Attack: California Schools Face Ransomware Threat, more than two dozen California school systems have been targets of cyberattacks. Since 2016, Seculore Solutions, a software company, has recorded over 122 cyberattacks in California across the public safety, government, medical, and education sectors with at least 26 cyberattacks targeting school districts and universities. In the 2021 CalMatters article, a UC Berkeley cybersecurity researcher stated, “If the data on cyberattacks seems sketchy and incomplete, that’s because it is.” With many schools adopting distance learning in the 2019-20 and 2020-21 school years, technological vulnerabilities increase yet little information is collected regarding the nature of the attacks, and the resulting impact on agencies.

A variety of LEAs, from a rural northern California COE to the Los Angeles Unified School District, have experienced significant cyberattacks in the last several years. Each attack is different, but may cause disruptions in e-mail access, financial software, and internet capabilities. Without internet access, LEAs operations come to a halt, and may disrupt activities such as administering standardized testing during a critical time of assessing students’ academic progress. The security of confidential student and personnel records may also be threatened.

According to the FBI, ransomware is a type of malicious software, or malware, which prevents a user from accessing computer files, systems or networks and demands the user pay a ransom for their return. Once a user unknowingly downloads the ransomware onto a computer by, for example, opening an e-mail attachment, the malware is then loaded into the user’s computer and locks access to data and files stored in the system. In some cases, the FBI works with the impacted LEA and their cybersecurity team to aid in the situation.

California Department of Education’s cybersecurity response. The CDE collects and protects student data. To protect and maintain sensitive information and awareness throughout the year, the Educational Data Governance Program hosts presentations by cybersecurity and privacy experts from federal partner agencies such as the FBI and the U.S. Department of Education. Additionally, CDE staff network and learn from privacy professionals and share privacy resources with schools and districts at conferences and symposia. Schools are currently not required to report cyberattacks to the CDE.

Federal response to cyberattacks on K-12 education. In 2020, a joint cybersecurity advisory authored by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC), Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data, the advisory report documents the common types of attacks used by cybercriminals that can lead to theft of data and disruption of distance learning services, and a loss of basic school operational functions. The common attacks identified in the report are ransomware, malware, distributed denial-of-service attacks (DDoS), and video conference disruptions. The report suggests that “cyber actors likely view schools as targets of opportunity and that these types of attacks are expected to continue through the 2020-2021 academic year.” These issues are particularly challenging for K-12 schools that face resource limitations; therefore, educational leadership, information technology personnel, and security personnel will need to balance this risk when determining their cybersecurity investments.

To mitigate these attacks, the FBI encourages education providers to review, update, and maintain best IT practices like patching plans, security policies, and user agreements. The report lists best practices for both school IT networks, in general, and tips on how to defend against the common attacks. The report also provides an example of code that has been used to detect and defend against related attacks. Finally, it offers a list of online resources that schools may use to help strengthen their cybersecurity system. The CISA started a campaign to bring attention to the recent increase in cyberattacks at schools and healthcare institutions. CISA’s initiative, “Reduce the Risk of Ransomware Campaign,” will include education by CISA through its website and social media pages on how entities can best protect themselves from attacks. CISA has also launched an online resource center that includes best practice guides for network administrators. Schools are particularly vulnerable to these attacks and risk the exposure of personal information of minors when facing a cyberattack.

Data breach reporting. According to the Attorney General (AG) of California, California law requires a business, state agency, or local agency to notify any California resident whose unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person, and requires a breach notification to the AG when more than 500 California residents are believed to be impacted. “Local agency” includes a county; city, whether general law or chartered; city and county; school district; municipal corporation; district; political subdivision; or any board, commission or agency thereof; other local public agency; or entities that are legislative bodies of a local agency. The eCrime Unit, a division in the Office of the AG, is tasked with investigating and prosecuting criminal organizations that commit identity theft crimes, use an electronic device or network to facilitate a crime, or commit a crime targeting an electronic device, network or intellectual property in excess of $50,000. Any agency or entity can voluntarily report data breaches to the AG. However, the data breach reports are only for notification purposes; the AG does not provide funding or services for affected entities.

COVID-19 impact on cybersecurity. According to a 2020 report by Interpol, Cybercrime: COVID-19 impact, the COVID-19 pandemic has severely affected the global cyber threat landscape. The sharp increase in cybercriminal activities related to COVID-19 has put significant strain on law enforcement communities worldwide. To maximize damage and financial gain, cybercriminals have shifted their targets from individuals to larger entities like major corporations, governments, and institutions. Due to the sudden shift to teleworking, organizations have had to rapidly deploy remote systems, networks, and applications resulting in increased security vulnerabilities to steal data, generate profits and cause disruption. The FBI’s Internet Crime Complaint Center reported over two million complaints of internet crime over the past five years, totaling over $13 billion dollars in resulting losses. The number of reported internet crimes has increased every year since 2016, as have the associated costs, and the margin by which these rates increase year-over-year continues to grow. Between 2019 and 2020 alone, the number of complaints received by the FBI Internet Crime Complaint Center increased by nearly 70%, from 467,361 in 2019 to 791,790 in 2020, likely as a result of unprecedented demand for virtual technologies resulting from the COVID-19 pandemic. According to the FBI Internet Crime Complaint Center’s 2020 report, California leads the nation in both the number of complaints relating to internet crime, and in the estimated costs experienced by the victims. In 2020, the FBI Internet Crime Complaint Center received 69,541 cybercrime complaints from Californians, costing victims over $620 million – over $200 million more than New York, the next closest state.

Arguments in support. The California School Boards Association writes, “Currently, there are over 1,000 local education agencies (LEAs) in California representing almost 6 million students, over 500,000 staff and 10,000 school sites. Over the last few years, ransomware attacks on California’s LEAs have increased. For many districts it is not a matter of if, but when they will be subject to a cybersecurity attack which can render the entire school district unable to conduct the business of educating students. By specifically including LEAs as an academic institution under Cal-CSIC, it will ensure that LEAs receive information and guidance to address issues of cybersecurity and protecting student data and privacy.”

Related legislation. AB 2355 (Salas), Chapter 498, Statutes of 2022, requires an LEA to report a cyberattack impacting 500 or more pupils or personnel to report to the Cal-CSIC and requires the Cal-CSIC to annually report to the Governor and relevant policy committees of the Legislature with specified information related to the cyberattack.

AB 1352 (Chau), Chapter 593, Statutes of 2021, authorizes the Military Department, at the request of an LEA, and in consultation with the Cal-CSIC, to perform an independent security assessment of the LEA, or an individual schoolsite under its jurisdiction, the cost of which is to be funded by the LEA, as specified.

AB 2326 (Salas) of the 2019-20 Session would have required an LEA to report any cyberattack to the Cal-CSIC and to designate a cybersecurity coordinator to serve as a liaison in cybersecurity matters between the LEA and the Cal-CSIC. The bill would have required the Cal-CSIC to establish a database that tracks reports of cyberattacks submitted by LEAs and required the Cal-CSIC to annually report to the Legislature on the state of cybersecurity in the state’s LEAs. This bill was held in the Assembly Education Committee.

AB 3276 (Chau) of the 2019-20 Session would have expressed the intent of the Legislature to enact subsequent legislation that would require every school district in the state to conduct an IT cybersecurity assessment. This bill was held in the Rules Committee.

AB 1566 (Chau) of the 2019-20 Session would have established the California Cyber Range Pilot Project, under the administration of the Cal-CSIC, to test the overall feasibility of the pilot project through a yearlong effort. The bill would have required the pilot project to produce a scalable model for a permanent California Cyber Range Program. This bill was held in the Assembly Higher Education Committee.

AB 2564 (Chau) of the 2019-2020 Session would have stated the intent of the Legislature to enact legislation to improve the security of IT systems and connected devices by requiring public agencies and businesses to develop security vulnerability disclosure policies. This bill was held in the Rules Committee.

AB 2813 (Irwin), Chapter 768, Statutes of 2018, establishes the Cal-CSIC within the Cal OES, the primary mission of which is the same as Cal-CSIC as created by Executive order. The bill requires Cal-CSIC to include representatives from the Cal OES, the Office of Information Security, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the AG, the California Health and Human Services Agency, and others. Required the Cal-CSIC to coordinate with the California State Threat Assessment System and the U.S. Department of Homeland Security, establish a cyber incident response team, and safeguard the privacy of individuals’ sensitive information.

REGISTERED SUPPORT / OPPOSITION:

Support

California Federation of Teachers
California School Boards Association
Los Angeles Unified School District

Opposition

None on file

Analysis Prepared by: Marguerite Ries / ED. / (916) 319-2087

Date of Hearing: April 17, 2023

ASSEMBLY COMMITTEE ON EMERGENCY MANAGEMENT

Freddie Rodriguez, Chair

ABPCA Bill Id:AB 1023 (

Author:Papan) – As Amended Ver:March 23, 2023

SUBJECT: California Cybersecurity Integration Center: school cybersecurity

SUMMARY: This bill requires the California Cybersecurity Integration Center (Cal-CSIC) to include representatives from the State Department of Education and clarifies the academic institutions with which Cal-CSIC coordinates information sharing. Specifically, this bill:

1. Requires Cal-CSIC to have a representative from the State Department of Education
2. Specifies that academic institutions that Cal-CSIC coordinate information sharing include school districts, county offices of education, and charter schools.
3. Makes legislative findings and declarations and states the intent of the legislature is for Cal-CSIC to provide guidance on issues of cybersecurity and preparedness to school districts, county offices of education, and charter schools.

EXISTING LAW:

1. Establishes the California Office of Emergency Services (Cal OES) within the office of the Governor and makes Cal OES responsible for the state’s emergency and disaster response services for natural, technological, or manmade disasters and emergencies. (Government (Gov) Code 8550)
2. Authorizes the Governor to proclaim a state of emergency and local officials and local governments to proclaim a local emergency when specified conditions of disaster or extreme peril to the safety of persons and property exist, and authorizes the Governor or the appropriate local government to exercise certain powers in response to that emergency. (Gov. Code 8558)
3. Establishes Cal-CSIC within Cal OES to, among other things, reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or computer networks in the state; serve as the central organizing hub of state government’s cybersecurity activities; and to coordinate information sharing with relevant stakeholders. (Gov. Code 8586.5)
4. Requires Cal-CSIC to create an annual report for four years on all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act. (Gov. Code 8586.5)

FISCAL EFFECT: Unknown. A fiscal committee has not heard this bill.

COMMENTS:

Double Referred: This bill is also referred to the Assembly Committee on Education, where it will be heard if the bill passes this committee.

Bill Purpose: According to the author, “The California Cybersecurity Integration Center coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations. With the rise of cyber threats, this group is imperative to protect sensitive, personal data in public and private networks and databases. Unfortunately, our K-12 schools are not involved with this group, yet have recently been the target of cyberattacks. Our school districts maintain sensitive medical and financial data on staff and students and their families. AB 1023 will include LEAs in Cal-CSIC and allow them to become informed and prepared for cyber threats.”

Equity Impact: According to the author’s staff, “Of California’s 1,000 districts, over half have a student population of 2,500 students or less. These smaller districts are at even greater risk of cyberattacks in that they do not have the expertise and resources (up-to-date equipment and staffing) to fully address cybersecurity. Further, LEAs are currently required to report cyberattacks to Cal-CSIC if they have over 500 pupils. This bill would ensure that all LEAs receive up-to-date information and guidance to they can better address cyber issues.”

Emergency Preparedness and Response: Cal OES is responsible for addressing natural, technological, or manmade disasters and emergencies, and preparing the state to prevent, respond to, quickly recover from, and mitigate the effects of both intentional and natural disasters. As part of its overall preparedness mission, Cal OES is required to develop a State Emergency Plan (SEP), State Hazard Mitigation Plan (SHMP), and maintains the Standardized Emergency Management System (SEMS) and the Emergency Management Mutual Aid System (EMMA). Cal OES, in coordination with FEMA and local partners, has developed four Catastrophic Plans to augment the State Emergency Plan.

California Cybersecurity Integration Center: In 2015, a Governor Brown Executive Order created the Cal-CSIC, and in 2018, Cal-CSIC was established in statute by AB 2813 (Irwin, Chapter 768, Statutes of 2018).  

Under the umbrella of Cal OES, the California Cybersecurity Integration Center serves as the central organizing hub of state government’s cybersecurity activities and coordinates information sharing among stakeholders that include local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. It is co-located at the California State Threat Assessment Center with the primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, critical infrastructure, or public and private sector computer networks.

To foster statutorily mandated coordination, Cal-CSIC is required to have representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and more. Cal-CSIC coordinates directly with the California State Threat Assessment Center and the United States Department of Homeland Security.

Cal-CSIC is also tasked with developing a statewide cybersecurity strategy, in accordance with state and federal standards, to improve how cyber threats are identified, understood, and shared in order to reduce threats to the California government, businesses, and consumers; providing warnings of cyberattacks to government agencies and nongovernmental partners; establishing a cyber-incident response team; safeguarding the privacy of individual’s sensitive information; assessing risks to critical infrastructure and information technology networks; supporting cybersecurity assessments, audits, and accountability programs; and collecting and sharing cyber threat information with relevant parties. 

State and Local Cybersecurity Improvement Act: By November 2021, Congress passed, and President Biden signed the $1 trillion Infrastructure Investment and Jobs Act bill package, which included the State and Local Cybersecurity Improvement Act. The State and Local Cybersecurity Improvement Act authorized a new $1 billion grant program to improve cybersecurity at the state, territorial, local, and tribal levels. Administered by the Federal Emergency Management Agency (FEMA), the $1 billion will be allocated over four years:

$200 million in FY 2022,

$400 million in FY 2023,

$300 million in FY 2024, and

$100 million in FY 2025.

With specific exceptions, awardees must match a percentage of funds, and the funding match percentages gradually increase each year. At a minimum, states must distribute 80 percent of awarded funds to local governments, with 25 percent designated to rural areas. Furthermore, this act requires states and tribes to submit a cybersecurity plan, which outlines how the state or tribe will improve its cybersecurity, to the Cybersecurity and Infrastructure Security Agency (CISA).

Arguments in support: According to the California School Boards Association (CSBA), “In most instances the term “academic institution” is used in reference to institutions of higher education. No where in the authorizing language of Cal-CSIC is there a mention of entities that serve K-12 education. AB 1023 would specifically include K-12 school districts, county offices of education and charter schools under the umbrella of academic institutions with regard to Cal-CSIC.”

They continue, “Currently, there are over 1,000 local education agencies (LEAs) in California representing almost 6 million students, over 500,000 staff and 10,000 school sites. Over the last few years, ransomware attacks on California’s LEAs have increased. For many districts it is not a matter of if, but when they will be subject to a cybersecurity attack which can render the entire school district unable to conduct the business of educating students. By specifically including LEAs as an academic institution under Cal-CSIC, it will ensure that LEAs receive information and guidance to address issues of cybersecurity and protecting student data and privacy.”

Related Legislation: SB 1001 (Min, 2022) requires Cal-CSIC to submit a report to the Legislature on the feasibility and benefits of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, as specified. (Vetoed by the Governor)

AB 2190 (Irwin, 2022) requires the Office of Information Security chief to submit an annual statewide information security status report to the Assembly Committee on Privacy and Consumer Protection and Senate Governmental Organization Committee, as specified. (Died in the Senate Appropriations Committee)

AB 2355 (Salas) Chapter 498, Statutes of 2022 requires a school district, county office of education, or charter school to report any cyberattack to Cal-CSIC, as specified.  

AB 2813 (Irwin, Chapter 768, Statutes of 2018) established Cal-CSIC in statute, as specified.

SB 844 (Min) Chapter 505, Statutes of 2022. This bill requires the Cal-CSIC to create an annual report for four years on all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act.

SB 591 (Min, 2023) would require CSIC, by December 31, 2025, to submit a report to the Legislature on the feasibility of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, as specified. (Pending in the Senate Committee on Governmental Organization).

SB 265 (Hurtado, 2023) would require the Office of Emergency Services (Cal OES) to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature, a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified. (Pending in Senate Committee on Appropriations)

AB 1667 (Irwin, 2023) would establish the California Cybersecurity Awareness and Education Council within the Department of Technology, as specified, and require the council to (1) research ways to increase cybersecurity awareness and education, (2) create a larger and more diverse cybersecurity-trained workforce, (3) propose a strategy to engage Californians in the effort to improve cybersecurity practices and strengthen cyber infrastructure, and (4) submit a report to the Legislature, as specified. (Pending in the Assembly Committee on Privacy and Consumer Protection)

REGISTERED SUPPORT / OPPOSITION:

Support

California School Boards Association (CSBA) - SPONSOR

Opposition

None on file.

Analysis Prepared by: Ryan Fleming / E.M. / (916) 319-3802