Bills

AB 2777: Office of Information Security: Baseline Information Security Score.

Session Year: 2023-2024
House: Assembly
Latest Version Date: 2024-04-25

Current Status:

Failed

(2024-08-15: In committee: Held under submission.)

Introduced

In Committee

First Chamber

In Committee

Second Chamber

Enacted

Version:

Existing law establishes the Office of Information Security, within the Department of Technology, to, among other things, ensure the confidentiality, integrity, and availability of state systems and applications. Existing law requires the Chief of the Office of Information Security to establish an information security program that includes, among other things, creating, updating, and publishing information security and privacy policies, standards, and procedures for state agencies, and requires state agencies, as described, to certify to the office that the agency is in compliance with those policies, standards, and procedures. Existing law authorizes the office to, among other things, conduct or require to be conducted an independent security assessment of every state agency, department, or office, as specified.

This bill would require the office, on or before January 1, 2026, to develop a Baseline Information Security Score metric to estimate the information security status of applicable state agencies, departments, and offices, and would require the metric to utilize readily available information, including, among other things, compliance certifications submitted to the office and results of relevant independent security assessments completed as described above. The bill would also require the office, beginning January 1, 2027, and annually on or before January 1 thereafter, to calculate a Baseline Information Security Score based on the above-described metric for each applicable state agency, department, and office. The bill would make related findings and declarations.

Existing law tasks the Director of Technology, who supervises the Department of Technology and is also the State Chief Information Officer, with, among other things, providing technology direction to agency and department chief information officers to ensure compliance with information technology policies and standards and establishing performance management and improvement processes to ensure state information technology systems and services are efficient and effective. Existing law requires the Chief of the Office of Information Security to establish an information security program that includes creating, updating, and publishing information security and privacy policies, standards, and procedures for state agencies. Existing law requires all state entities, as specified, to implement the policies and procedures issued by the Office of Information Security and authorizes the office to conduct an independent security assessment of every state agency, department, or office.This bill would require the Department of Technology to make changes to the California Cybersecurity Maturity Metric, including the Maturity Metric Score criteria, to accomplish specified goals, including to achieve a score for all state agencies every 3 years. The bill would require a Maturity Metric Score to be comprised of information from the 2 most recent independent security assessments performed by, or at the direction of, the Office of Information Security that measured the agencys network and any other relevant and available information. The bill would define terms for these purposes, and make related findings and declarations.

This bill would require the Department of Technology to make changes to the California Cybersecurity Maturity Metric, including the Maturity Metric Score criteria, to accomplish specified goals, including to achieve a score for all state agencies every 3 years. The bill would require a Maturity Metric Score to be comprised of information from the 2 most recent independent security assessments performed by, or at the direction of, the Office of Information Security that measured the agencys network and any other relevant and available information. The bill would define terms for these purposes, and make related findings and declarations.

Existing law establishes the California Youth Leadership Project for the purpose of promoting youth civic engagement by awarding scholarships to youth between 14 and 18 years of age in accordance with specified criteria. Existing law creates the California Youth Leadership Project Committee to oversee the California Youth Leadership Project. Existing law authorizes the California Youth Leadership Project Committee to accept gifts and grants from any source to help perform its functions. Existing law also authorizes the California Youth Leadership Project Committee to define its program and use its funds in any way necessary to carry out its duties, as specified.This bill would make nonsubstantive changes to those provisions.

Version:

The people of the State of California do enact as follows:SECTION 1.

The Legislature finds and declares all of the following:

(a)Californians are often required to provide personally identifiable information to state agencies. Protecting that information is critical to maintaining public trust and safety.

(b)Knowledge of the security status of state agencies is critical to identifying vulnerabilities, managing cybersecurity threats, and avoiding costly disruptions to state services.

(c)Simplifying the existing process for evaluating the cybersecurity of state agencies is critical to ensuring timely reports.

SEC. 2.Section 11549.3 of the Government Code is amended to read:11549.3.

(a)The chief shall establish an information security program. The program responsibilities include, but are not limited to, all of the following:

(1)The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.

(2)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:

(A)Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.

(B)Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the office.

(3)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.

(4)The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each state agencys disaster recovery plan.

(5)Coordination of the activities of state agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.

(6)Promotion and enhancement of the state agencies risk management and privacy programs through education, awareness, collaboration, and consultation.

(7)Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.

(b)All state entities defined in Section 11546.1 shall implement the policies and procedures issued by the office, including, but not limited to, performing both of the following duties:

(1)Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the office.

(2)Comply with filing requirements and incident notification by providing timely information and reports as required by the office.

(c)(1)The office may conduct, or require to be conducted, an independent security assessment of every state agency, department, or office. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed.

(2)In addition to the independent security assessments authorized by paragraph (1), the office, in consultation with the Office of Emergency Services, shall perform all the following duties:

(A)Annually require no fewer than 35 state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.

(B)Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, analysis of the relative amount of the following factors within state agencies:

(i)Personally identifiable information protected by law.

(ii)Health information protected by law.

(iii)Confidential financial data.

(iv)Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:

(I)Information asset management.

(II)Risk management.

(III)Information security program management.

(IV)Information security incident management.

(V)Technology recovery planning.

(C)Determine the basic standards of services to be performed as part of independent security assessments required by this subdivision.

(3)The Military Department may perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.

(d)State agencies and entities required to conduct or receive an independent security assessment pursuant to subdivision (c) shall transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the office and the Office of Emergency Services.

(e)(1)On or before January 1, 2026, the office shall develop a Baseline Information Security Score metric to estimate the information security status of applicable state agencies, departments, and offices. The metric shall utilize readily available information, including, but not limited to, all of the following information:

(A)Results of relevant independent security assessments completed pursuant to subdivision (c).

(B)Information that state entities annually self-report to the federal government as part of the federal Nationwide Cybersecurity Review.

(C)Custom reports provided by the federal government to state entities as part of the federal Nationwide Cybersecurity Review.

(D)Compliance certifications and other required supplementary materials submitted by state agencies pursuant to paragraph (4) of subdivision (g).

(E)Any relevant incidents reported through the California Compliance and Security Incident Reporting System.

(F)Any relevant compliance audits completed by the Department of Technology pursuant to subdivision (i).

(G)Any other relevant information that the office has in its possession or is able to quickly and easily obtain.

(2)Beginning January 1, 2027, and annually on or before January 1 thereafter, the office shall calculate a Baseline Information Security Score based on the metric described in paragraph (1) for each applicable state agency, department, and office.

(e)

(f)The office shall report to the Department of Technology and the Office of Emergency Services any state entity found to be noncompliant with information security program requirements.

(f)

(g)(1)Every state agency, as defined in Section 11000, that is not subject to subdivision (b) shall do all of the following:

(A)Adopt and implement information security and privacy policies, standards, and procedures that adhere to the following standards:

(i)The National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 5, Security and Privacy Controls for Federal Information Systems and Organizations, and its successor publications.

(ii)Federal Information Processing Standards (FIPS) 199 Standards for Security Categorization of Federal Information and Information Systems, and its successor publications.

(iii)Federal Information Processing Standards (FIPS) 200 Minimum Security Requirements for Federal Information and Information Systems, and its successor publications.

(B)Perform a comprehensive, independent security assessment every two years. The independent assessment shall assess all policies, standards, and procedures adopted pursuant to subparagraph (A) and paragraph (2), if applicable.

(2)A state agency described in paragraph (1) may adopt and implement information security and privacy policies, standards, and procedures following Chapter 5300 - Information Technology - Office of Information Security of the State Administrative Manual. A state agency described in paragraph (1) may discontinue a policy, standard, or procedure adopted pursuant to this paragraph at any time.

(3)A state agency described in paragraph (1) may contract with the Military Department, or with a qualified responsible vendor, to perform an independent security assessment of the state agency pursuant to subparagraph (B) of paragraph (1), the cost of which shall be funded by the state agency being assessed.

(4)(A)Every state agency described in paragraph (1) shall certify, on a form developed pursuant to subparagraph (C), by February 1 annually, to the office that the agency is in compliance with all policies, standards, and procedures adopted pursuant to this subdivision. The certification shall include a plan of action and milestones.

(B)Notwithstanding any other law, the certification made to the office shall be kept confidential and shall not be disclosed, except as provided in subparagraph (E). The office shall ensure the transferring, receiving, possessing, or disclosing of certifications is done in a manner that ensures the confidentiality and security of the certification, including restricting transfer and storage methods to electronic means and ensuring that certification data is encrypted in transport and at rest. The office shall only provide access to certifications to employees who have submitted to a criminal background check as a condition of employment.

(C)The office shall develop a form for certification based on the Statewide Information Management Manual (SIMM) 5330-B, making modifications as necessary to encompass the requirements on state agencies under paragraphs (1) to (4), inclusive.

(D)The office may make recommendations and offer assistance to any state agency described in paragraph (1) on completing the plan of action and milestones required under paragraph (A). However, the office shall not have the authority to require any recommendation be followed or to compel acceptance of any assistance.

(E)The office shall review the certifications and make an annual summary report available, by May 1, 2024, and by March 1 every year thereafter, to the appropriate legislative committees and the Legislative Analysts Office to further their oversight and budgetary responsibilities.

(5)As an alternative to complying with the requirements of paragraphs (1) to (4), inclusive, a state agency described in paragraph (1) may annually submit, by January 15, a declaration to the chief confirming that the state agency voluntarily and fully complies with subdivisions (b) and (c).

(6)This subdivision shall apply to the University of California only to the extent that the Regents of the University of California, by resolution, make any of these provisions applicable to the University.

(g)

(h)(1)Notwithstanding any other law, during the process of conducting an independent security assessment pursuant to subdivision (c) or (f), (g), information and records concerning the independent security assessment are confidential and shall not be disclosed, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity.

(2)The results of a completed independent security assessment performed pursuant to subdivision (c), (f), or (j), (g), or (k), and any related information shall be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1), but not limited to Section 7929.210.

(h)

(i)The office may conduct or require to be conducted an audit of information security to ensure program compliance.

(i)

(j)The office shall notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.

(j)

(k)(1)At the request of a local educational agency, and in consultation with the California Cybersecurity Integration Center, the Military Department may perform an independent security assessment of the local educational agency, or an individual schoolsite under its jurisdiction, the cost of which shall be funded by the local educational agency.

(2)The criteria for the independent security assessment shall be established by the Military Department in coordination with the local educational agency.

(3)The Military Department shall disclose the results of an independent security assessment only to the local educational agency and the California Cybersecurity Integration Center.

(4)For purposes of this subdivision, local educational agency means a school district, county office of education, charter school, or state special school.

SECTION 1.The Legislature finds and declares all of the following:(a)Californians are often required to provide personally identifiable information to state agencies. Protecting that information is critical to maintaining public trust and safety.(b)Knowledge of the security status of state agencies is critical to identifying vulnerabilities, managing cybersecurity threats, and avoiding costly disruptions to state services.(c)Simplifying the existing process for evaluating the cybersecurity of state agencies is critical to ensuring timely reports.SEC. 2.Section 11547.65 is added to the Government Code, to read:11547.65.(a)For purposes of this section, the following definitions apply:(1)California Cybersecurity Maturity Metric means the Statewide Information Management Manual Section 5300-C, or any successor Statewide Information Management Manual section that describes a metric that objectively measures the effective implementation of cybersecurity policies, standards, and procedures by every state agency.(2)Maturity Metric Score means the Statewide Information Management Manual Section 5300-C, or any successor Statewide Information Management Manual section that describes a single score a state agency received following the completion of the calculation that reflects an agencys information security status.(3)(A)State agency has the same meaning as in Section 11000.(B)State agency does not include the State Compensation Insurance Fund, the Legislature, or the Legislative Data Center in the Legislative Counsel Bureau pursuant to Section 11548.(b)The Department of Technology shall make changes to the California Cybersecurity Maturity Metric, including the Maturity Metric Score criteria, to accomplish the following goals:(1)Improve reliability, efficiency, and timeliness of reporting Maturity Metric Scores.(2)Achieve a Maturity Metric Score for all state agencies every three years.(c)A Maturity Metric Score shall be comprised of information from the two most recent independent security assessments performed pursuant to subdivision (c) of Section 11549.3 that measured the agencys network and any other relevant and available information.

The people of the State of California do enact as follows:SECTION 1.

The Legislature finds and declares all of the following:

(a)Californians are often required to provide personally identifiable information to state agencies. Protecting that information is critical to maintaining public trust and safety.

(b)Knowledge of the security status of state agencies is critical to identifying vulnerabilities, managing cybersecurity threats, and avoiding costly disruptions to state services.

(c)Simplifying the existing process for evaluating the cybersecurity of state agencies is critical to ensuring timely reports.

SEC. 2.Section 11547.65 is added to the Government Code, to read:11547.65.

(a)For purposes of this section, the following definitions apply:

(1)California Cybersecurity Maturity Metric means the Statewide Information Management Manual Section 5300-C, or any successor Statewide Information Management Manual section that describes a metric that objectively measures the effective implementation of cybersecurity policies, standards, and procedures by every state agency.

(2)Maturity Metric Score means the Statewide Information Management Manual Section 5300-C, or any successor Statewide Information Management Manual section that describes a single score a state agency received following the completion of the calculation that reflects an agencys information security status.

(3)(A)State agency has the same meaning as in Section 11000.

(B)State agency does not include the State Compensation Insurance Fund, the Legislature, or the Legislative Data Center in the Legislative Counsel Bureau pursuant to Section 11548.

(b)The Department of Technology shall make changes to the California Cybersecurity Maturity Metric, including the Maturity Metric Score criteria, to accomplish the following goals:

(1)Improve reliability, efficiency, and timeliness of reporting Maturity Metric Scores.

(2)Achieve a Maturity Metric Score for all state agencies every three years.

(c)A Maturity Metric Score shall be comprised of information from the two most recent independent security assessments performed pursuant to subdivision (c) of Section 11549.3 that measured the agencys network and any other relevant and available information.

SECTION 1.Section 33428 of the Education Code is amended to read:33428.(a)The funds for the California Youth Leadership Project shall be allocated from the California Youth Leadership Fund pursuant to Article 4.5 (commencing with Section 18736) of Chapter 3 of Part 10.2 of Division 2 of the Revenue and Taxation Code, as added by Chapter 379 of the Statutes of 2012, as that article read on January 1, 2013, or from private funds directed to the department and allocated to the California Youth Leadership Project Committee for the purpose of funding activities of the California Youth Leadership Project.(b)The California Youth Leadership Project may accept gifts and grants from any source, public or private, to help perform its functions pursuant to this article.(c)The California Youth Leadership Project Committee shall have the authority to define its program and use its funds in any way necessary to carry out the duties of this article, including, but not limited to, partnering with nonprofit groups or state agencies to perform various duties required by this article, as long as the program or activity is not in violation of a state law or regulation.

Date	Status
Aug 15, 2024	In committee: Held under submission.
Aug 5, 2024	In committee: Referred to APPR suspense file.
Jun 25, 2024	From committee: Do pass and re-refer to Com. on APPR with recommendation: To Consent Calendar. (Ayes 14. Noes 0.) (June 25). Re-referred to Com. on APPR.
Jun 5, 2024	Referred to Com. on G.O.
May 24, 2024	In Senate. Read first time. To Com. on RLS. for assignment.
May 23, 2024	Read third time. Passed. Ordered to the Senate. (Ayes 72. Noes 0. Page 5633.)
May 20, 2024	Read second time. Ordered to third reading.
May 16, 2024	From committee: Do pass. (Ayes 15. Noes 0.) (May 16).
May 8, 2024	In committee: Set, first hearing. Referred to APPR. suspense file.
Apr 29, 2024	Re-referred to Com. on APPR.
Apr 25, 2024	Read second time and amended.
Apr 24, 2024	From committee: Amend, and do pass as amended and re-refer to Com. on APPR. with recommendation: To Consent Calendar. (Ayes 11. Noes 0.) (April 23).
Apr 1, 2024	In committee: Hearing postponed by committee.
Mar 20, 2024	Re-referred to Com. on P. & C.P.
Mar 19, 2024	From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended.
Mar 18, 2024	Referred to Com. on P. & C.P.
Feb 16, 2024	From printer. May be heard in committee March 17.
Feb 15, 2024	Read first time. To print.

Date	Description	Location	Votes
Aug 5, 2024	Placed on suspense file	Senate Standing Committee on Appropriations	7 0 0 Passed
Jun 25, 2024	Do pass, but first be re-referred to the Committee on [Appropriations] with the recommendation: To Consent Calendar	Senate Standing Committee on Governmental Organization	14 0 2 Passed
May 23, 2024	AB 2777 Calderon Assembly Third Reading	Assembly Floor	72 0 8 Passed
May 16, 2024	Do pass.	Assembly Standing Committee on Appropriations	15 0 0 Passed
Apr 23, 2024	Do pass as amended, and be re-referred to the Committee on [Appropriations] with recommendation: To Consent Calendar	Assembly Standing Committee on Privacy and Consumer Protection	11 0 0 Passed

Key

Pro

Against

Did Not Vote

SENATE COMMITTEE ON

Senator Anna Caballero, Chair

2023 - 2024 Regular Session

AB 2777 (Calderon) - Office of Information Security: Baseline Information Security Score


Version:	Policy Vote:
Urgency:	Mandate:
Hearing Date:	Consultant:

Bill Summary:

AB 2777 requires, by January 1, 2026, the Office of Information Security (OIS) within the California Department of Technology (CDT) to develop a Baseline Information Security Score metric to estimate the information security status of applicable state agencies, departments, and offices and requires OIS to score these state entities’ information security annually beginning January 1, 2027, as specified.

Fiscal Impact:

CDT estimates total annual costs of approximately $805,000 for workload to establish the metric and for ongoing workload to evaluate each state entity subject to the metric (General Fund).

Background:

The OIS is an office within CDT and is the primary state government authority charged with ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information assets. The OIS is involved in a broad range of activities within the state and collaborates with federal, state, and local security professionals, higher education, private industry, and others on security related matters.

The OIS has responsibility and authority to: create, issue, maintain, and ensure compliance of information technology (IT) security and privacy policies, standards, and procedures; advise and consult with state entities to effectively manage risks; and, conduct, or require to be conducted, independent security assessments or audits of any state entity.

Nationwide Cybersecurity Review. The Nationwide Cybersecurity Review (NCSR) is an annual, no-cost, and anonymous self-assessment designed to help state, local, tribal, and territorial governments evaluate their cybersecurity programs. The NCSR was established by the U.S. Congress in 2009, which tasked the Department of Homeland Security (DHS) with creating a comprehensive cybersecurity assessment to evaluate the gaps and capabilities in the cybersecurity programs of those governments. The first NCSR was conducted in 2011, and in 2013 DHS partnered with the Multi-State Information Sharing and Analysis Center to enhance and manage the assessment. The NCSR is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

Participants in the NCSR benefit from receiving specific metrics that help identify areas needing improvement, access to resources and guidance for next steps, and the ability to measure their results against peer organizations. The assessment also helps organizations fulfill certain requirements for the Homeland Security Grant Program, which the Office of Emergency Services manages for the state.

Proposed Law:

By January 1, 2026, requires OIS to develop a Baseline Information Security Score metric to estimate the information security status of applicable state agencies, departments, and offices. Requires the metric to utilize readily available information, including but not limited to, all of the following information:
- Results of relevant independent security assessments, as specified.
- Information that state entities annually self-report to the federal government as part of the NCSR.
- Custom reports provided by the federal government to state entities as part of the federal NCSR.
- Compliance certifications and other required supplementary materials submitted by state agencies, as specified.
- Any relevant incidents reported through the California Compliance and Security Incident Reporting System.
- Any relevant compliance audits completed by CDT, as specified.
- Any other relevant information that OIS has in its possession or is able to quickly and easily obtain.
Requires, beginning January 1, 2027 and by January 1 annually thereafter, OIS to calculate a Baseline Information Security Score based on the metric described above for each applicable state agency, department, and office.
States legislative findings and declarations.
Makes other conforming and technical changes.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2023 - 2024 Regular

Bill No: 2777 Hearing Date: 6/25/2024

Author:
Version:	4/25/2024 Amended
Urgency:	No	Fiscal:	Yes
Consultant:	Brian Duke

SUBJECT: Office of Information Security: Baseline Information Security Score

DIGEST: This bill requires the Office of Information Security (OIS) to develop and calculate a Baseline Information Security Score metric to estimate the information security status of applicable state agencies, departments, and offices, as specified.

ANALYSIS:

Existing law:

Establishes the OIS, within the California Department of Technology (CDT), to among other things, ensure the confidentiality, integrity, and availability of state systems and applications.
Requires the Chief of OIS to establish an information security program that includes, among other things, creating, updating, and publishing information security and privacy policies, standards, and procedures for state agencies, and requires state agencies to certify to the OIS that the agency is in compliance with those policies, standards, and procedures.
Authorizes the OIS to, among other things, conduct or require to be conducted an independent security assessment or an audit of information security to ensure program compliance of every state agency, department, or office, as specified.
Defines “state agency,” for the purposes described above, to mean the Transportation Agency; Department of Corrections and Rehabilitation; Department of Veterans Affairs, Business, Consumer Services, and Housing Agency; Natural Resources Agency; California Health and Human Services Agency; California Environmental Protection Agency; Labor and Workforce Development Agency; and Department of Food and Agriculture.
Defines “state entity,” for the purposes described above, to mean an entity within the executive branch that is under the direct authority of the Governor, including, but not limited to, all departments, boards, bureaus, commissions, councils, and offices that are not defined as a “state agency.”
Establishes the Office of Emergency Services (OES), within the office of the Governor, and sets forth its powers and duties relating to addressing natural, technological, or manmade disasters and emergencies, including responsibility for activities necessary to prevent, respond to, recover from, and mitigate the effects of emergencies and disasters to people and property, as specified.

This bill:

Requires the OIS, on or before January 1, 2026, to develop a Baseline Information Security Score metric to estimate the information security status of applicable state agencies, departments, and offices.
Requires the metric to utilize readily available information, including, but not limited to, all of the following information:
1. Results of relevant independent security assessments, as specified.
2. Information that state entities annually self-report to the federal government as part of the federal Nationwide Cybersecurity Review.
3. Custom reports provided by the federal government to state entities as part of the federal Nationwide Cybersecurity Review.
4. Compliance certifications and other required supplementary materials submitted by state agencies, as specified.
5. Any relevant incidents reported through the California Compliance and Security Incident Reporting System (Cal-CSIRS).
6. Any relevant compliance audits completed by CDT, as specified.
7. Any other relevant information that the OIS has in its possession or is able to quickly and easily obtain.
Requires the OIS, beginning January 1, 2027, and annually thereafter, to calculate a Baseline Information Security Score based on the metric described above for each applicable state agency, department, and office.
Includes related Legislative findings and declarations.

Background

Author Statement. According to the author’s office, “there have been several state agency and department cybersecurity breaches recently, exposing Californians to identity theft, financial fraud, and delays in access to essential state services. To help prevent this from happening, Assembly Bill 2777 requires the California Department of Technology to develop a Baseline Information Security Score metric to annually assess the security status of state agencies and departments. We have a responsibility to ensure that the personal information of our constituents is kept safe and this bill advances state efforts to meet this duty.”

Office of Information Security. The OIS is an office within CDT and is the primary state government authority charged with ensuring the confidentiality, integrity, and availability of state systems and applications, and ensuring the protection of state information assets. The OIS is involved in a broad range of activities within the state and collaborates with federal, state, and local security professionals, higher education, private industry, and others on security related matters. According to the OIS’s internet website, it “is committed to securing the state’s information assets to build and maintain the trust of Californians.”

Independent security assessments are performed by the Cyber Network Defense (CND) Team of the California Military Department (CMD). An independent security assessment is a technical analysis of identified controls designed to measure cybersecurity maturity. Areas within independent security assessments include host vulnerability assessments, firewall analysis, host hardening analysis, phishing susceptibility, network penetration testing, and snap-shot analysis of network traffic for signs of threat actor compromise.

Additionally, CDT’s Information Security Program Audit Team provides expertise to evaluate compliance with state security and privacy policies, by validating security programs, procedures, and practices are in place and working as intended. The audits are organized into domains that have been compiled using adopted industry and state standards, as specified. These standards align with current state policy requirements.

Nationwide Cybersecurity Review. The Nationwide Cybersecurity Review (NCSR) is an annual, no-cost, and anonymous self-assessment designed to help state, local, tribal, and territorial governments evaluate their cybersecurity programs. The NCSR was established by the U.S. Congress in 2009, which tasked the Department of Homeland Security (DHS) with creating a comprehensive cybersecurity assessment to evaluate the gaps and capabilities in the cybersecurity programs of those governments. The first NCSR was conducted in 2011, and in 2013 DHS partnered with the Multi-State Information Sharing and Analysis Center to enhance and manage the assessment. The NCSR is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

California Compliance and Security Incident Reporting System. The Cal-CSIRS report provides documentation and accountability in response to incidents. It helps the state entity identify and correct problems and control deficiencies within the state entity, and ensures that the head of the state entity is aware of the incident and its cause, so that they can direct the state entity’s response and corrective action plan to prevent similar occurrences in the future. It also helps the OIS monitor and mitigate statewide problems or trends.

2023 California Department of Technology Audit Report. In April of 2023, the California State Auditor (Auditor) released an audit of CDT titled “Weaknesses in Strategic Planning, Information Security, and Project Oversight Limit the State’s Management of Information Technology.” CDT has broad responsibility and authority over nearly all aspects of IT in the State, including providing strategic direction, assessing IT security, and performing project oversight. However, the audit found that “it has not fulfilled important responsibilities in these areas, resulting in significant consequences for the State. CDT has not provided the State with sufficient strategic direction to ensure that critical IT systems are modernized, secure, and that the systems effectively provide important services. For example, CDT has yet to identify the systems statewide that are outdated or obsolete and require modernization, leaving the State at risk of outage or failure.”

In addition to its leadership and oversight roles, CDT offers various IT services to other state agencies. These services include infrastructure, platform, network, telecommunications, software, professional, and security services, as well as IT support. State agencies also employ their own IT staff, including department chief information officers (CIOs), who are overseen by agency information officers. Agency information officers manage the agency’s IT assets, projects, data systems, infrastructure, and services through their CIOs. The Director of CDT provides technology direction to agency information officers and CIOs to ensure alignment with State IT policy.

Baseline Information Security Score. This bill requires OIS to develop a Baseline Information Security Score metric to estimate the information security status of state agencies, departments, and offices by January 1, 2026. The metric will utilize readily available information, including: results of relevant independent security assessments; information that state entities annually self-report to the federal government; custom reports provided by the federal government to state entities; compliance certifications and other required supplementary materials; any relevant incidents and relevant compliance audits; and any other relevant information that OIS has in its possession or is able to quickly and easily obtain.

This bill requires, by January 1, 2027, and annually thereafter, OIS to calculate a Baseline Security Score based on the metric described above for each state agency, department, and office.

Prior/Related Legislation

SB 74 (Dodd, 2023) would have required state agencies to adopt risk mitigation strategies when implementing social media and cybersecurity policies, and would have prohibited the use of specified social media applications on state owned or state controlled electronic devices. (Gutted and Amended Into an Unrelated Issue)

SB 265 (Hurtado, 2023) directs Cal-CSIC to assist each critical infrastructure sector in California by preparing an outreach plan to help improve their cybersecurity measures and by evaluating funding options or actions that do not require funds that improves their cybersecurity preparedness, as specified. (Pending in the Assembly Appropriations Committee)

AB 749 (Irwin, 2023) would have required state agencies to implement a “Zero Trust” cybersecurity architecture, as specified, which includes multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices, as specified. (Held on the Senate Appropriations Committee Suspense File)

AB 1667 (Irwin, 2023) would have created the California Cybersecurity Awareness and Education Council, as specified. (Held on the Assembly Appropriations Committee Suspense File)

AB 2813 (Irwin, Chapter 168, Statutes of 2018) codified the Cal-CSIC and requires center to develop a cybersecurity strategy for California, as specified.

AB 531 (Irwin, 2017) would have required OIS to review the technologies used by state agencies to protect sensitive information, and develop a statewide plan to require state agencies to implement any information security technology that OIS determines to be necessary to protect that sensitive information. (Vetoed by Governor Brown)

AB 1022 (Irwin, Chapter 790, Statutes of 2017) requires state agencies to include within their Technology Recovery Plan an inventory of all critical infrastructure controls and associated assets, as specified.

AB 670 (Irwin, Chapter 518, Statutes of 2015) requires CDT to conduct, or require to be conducted, no fewer than 35 independent security assessments of state agencies, departments, or offices annually, as specified.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

None received

OPPOSITION:

None received

ASSEMBLY THIRD READING

ATR Bill Id:AB 2777

Author:(Calderon)

As Amended Ver:April 25, 2024

Majority vote

SUMMARY

Requires the California Department of Technology (CDT) to develop a Baseline Information Security Score (BISS) metric to estimate the information security status of applicable state agencies, departments, and offices.

Major Provisions

On or before January 1, 2026, requires CDT's Office of Information Security to develop a BISS metric to estimate the information security status of applicable state agencies, departments, and offices. Requires the metric to utilize readily available information, including, but not limited to, all of the following:
Results of relevant independent security assessments.
Information that state entities annually self-report to the federal government as part of the federal Nationwide Cybersecurity Review.
Custom reports provided by the federal government to state entities as part of the federal Nationwide Cybersecurity Review.
Compliance certifications and other required supplementary materials submitted by state agencies.
Any relevant incidents reported through the California Compliance and Security Incident Reporting System.
Any relevant compliance audits completed by the Department of Technology.
Any other relevant information that the office has in its possession or is able to quickly and easily obtain.
Beginning January 1, 2027, and annually thereafter, requires the office to calculate a Baseline Information Security Score for each applicable state agency, department, and office.

COMMENTS

Background. California state government maintains a vast wealth of personal information related to its 39 million residents. The potential value of this information makes California a ripe target for cybersecurity attacks. CDT, and especially the Office of Information Security within CDT, are responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, especially as they relate to cybersecurity.

A series of audits conducted by the California State Auditor have revealed that CDT is not adequately hardening California against, nor sufficiently monitoring for, cybersecurity threats. CDT utilizes what it calls a "cybersecurity maturity metric" to calculate the relative vulnerability of various state agencies, offices, and departments (hereafter referred to as "reporting entities"). The calculation of this metric requires a lengthy compliance audit, and as a result, CDT is unable to regularly apply the metric to all reporting entities.

What this bill would do. This bill would require CDT to develop a new metric, the BISS, which would take advantage of readily-available information and allow CDT to quickly estimate the security status of all reporting entities. Entities found to be especially vulnerable or out of compliance could then be targeted for more resource-intensive compliance audits. The 2023 State Auditor’s report on CDT revealed that CDT is already working to develop this metric.

Analysis. CDT is, in its own words, "tasked with securing statewide information assets by providing oversight and infrastructure for many state departments and [serving] as the custodian of information for mission-critical and essential business applications."^[1] Despite this charge, CDT was recently designated a high-risk state agency by the California State Auditor.^[2] In a January 2022 audit of CDT, the State Auditor found that CDT had yet to establish an overall statewide information security status for the State’s 108 reporting entities.^[3] The State Auditor performed a follow-up audit in March 2023, and found that the issues it had flagged in its 2022 report had not been addressed.^[4]

If CDT cannot accurately assess the cybersecurity status of California’s reporting entities, it cannot effectively intervene when these entities fall out of compliance, or harden California against cybersecurity threats. The longer an undetected vulnerability remains unaddressed, the greater the risk to Californians’ privacy and security. By generating and tracking BISS scores over time, CDT could appropriately target its expensive, lengthy compliance audits at reporting entities found by the BISS to be particularly vulnerable.

According to the Author

There have been several state agency and department cybersecurity breaches recently, exposing Californians to identity theft, financial fraud, and delays in access to essential state services…We have a responsibility to ensure that the personal information of our constituents is kept safe and this bill advances state efforts to meet this duty.

Arguments in Support

None.

Arguments in Opposition

None.

FISCAL COMMENTS

According to the Assembly Appropriations Committee analysis:

Costs (General Fund) to CDT of an unknown but potentially significant amount, possibly in the hundreds of thousands of dollars annually in additional staffing. CDT will incur upfront workload costs in establishing the BISS metric and ongoing workload costs to evaluate each agency subject to the metric, beginning in 2027.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-0

YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta, Villapudua

UPDATED

VERSION: April 25, 2024

CONSULTANT: Slater Sharp / P. & C.P. / (916) 319-2200 FN: 0003328

California Department of Technology, https://cdt.ca.gov/about/ ↑
Grant Parks, "The California State Auditor's Updated Assessment of Issues and Agencies That Pose a High Risk to the State," California State Auditor, Aug. 24, 2023, https://www.auditor.ca.gov/reports/2023-601/index.html ↑
Tilden, "The California Department of Technology’s Inadequate Oversight Limits the State’s Ability to Ensure Information Security," supra. ↑
Grant Parks, “Weaknesses in Strategic Planning, Information Security, and Project Oversight Limit the State's Management of Information Technology," California State Auditor, Apr. 20, 2023, https://www.auditor.ca.gov/reports/2022-114/index.html ↑

Date of Hearing: May 8, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 2777

Author:(Calderon) – As Amended Ver:April 25, 2024

Policy Committee:	Privacy and Consumer Protection	Vote:	11 - 0

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires the California Department of Technology (CDT) to develop a Baseline Information Security Score (BISS) metric to estimate the information security status of applicable state agencies, departments, and offices.

FISCAL EFFECT:

According to the Legislative Analyst’s Office, the General Fund faces a structural deficit in the tens of billions of dollars over the next several fiscal years.

COMMENTS:

Purpose. According to the author:

There have been several state agency and department cybersecurity breaches recently, exposing Californians to identity theft, financial fraud, and delays in access to essential state services…We have a responsibility to ensure that the personal information of our constituents is kept safe and this bill advances state efforts to meet this duty.

Background. CDT has broad authority over the state’s IT operation. In 2022, the State Auditor released a report identifying a number of ways in which CDT has failed to adequately fulfill its responsibilities. According to that report:

To ensure IT systems’ effectiveness and security, CDT must implement a comprehensive statewide strategic plan that clearly sets priorities for addressing the State’s IT needs and demonstrates urgency in preparing for and responding to cybersecurity threats.

According to the analysis of this bill by the Assembly Committee on Privacy and Consumer Protection, CDT has taken steps to address some of the problems identified by the State Auditor. CDT has begun to develop a BISS metric to gauge the security status of state agencies. This bill codifies the BISS metric and requires CDT to calculate the BISS score for each applicable state agency annually beginning in 2027. Updates to the State Auditor’s 2022 report indicate that achieving adequate staffing is a significant issue for CDT. Because this bill adds additional ongoing workload to CDT, the department may need additional resources for staffing to handle these duties.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 23, 2024

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 2777 (

Author:Calderon) – As Amended Ver:March 19, 2024

AS PROPOSED TO BE AMENDED

SUBJECT: Department of Technology: state agencies: California Cybersecurity Maturity Metric

SYNOPSIS

California state government maintains a vast wealth of personal information related to its 39 million residents. The potential value of this information makes California a ripe target for cybersecurity attacks. The Department of Technology (CDT), and especially the Office of Information Security (OIS) within CDT, are responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, especially as they relate to cybersecurity.

A series of audits conducted by the California State Auditor have revealed that CDT is not adequately hardening California against, nor sufficiently monitoring for, cybersecurity threats. CDT utilizes what it calls a “cybersecurity maturity metric” to calculate the relative vulnerability of various state agencies, offices, and departments (hereafter referred to as “reporting entities”). The calculation of this metric requires a lengthy compliance audit, and as a result, CDT is unable to regularly apply the metric to all reporting entities.

This bill would require CDT to adjust its cybersecurity maturity metric such that it could be calculated for all reporting entities every three years. Committee amendments rework this bill to instead require the development of a new metric, the Baseline Information Security Score (BISS), which would take advantage of readily-available information and allow CDT to quickly estimate the security status of all reporting entities. Entities found to be especially vulnerable or out of compliance could then be targeted for more resource-intensive compliance audits. The 2023 State Auditor’s report on CDT revealed that CDT is already working to develop this metric.

This bill is author-sponsored and has no support or opposition.

SUMMARY: Requires CDT to update its Cybersecurity Maturity Metrics such that they can be conducted every three years for each reporting entity in California. Specifically, this bill:

Requires the Department of Technology to make changes to the California Cybersecurity Maturity Metric, including the Maturity Metric Score criteria, in order to:
Improve reliability, efficiency, and timeliness of reporting.
Achieve a Maturity metric Score for all reporting entities every three years.
Defines “California Cybersecurity Maturity Metric” to mean the Statewide Information Management Manual Section 5300-C, or any successor Statewide Information Management Manual section that describes a metric that objectively measures the effective implementation of cybersecurity policies, standards, and procedures by every state agency.
Defines “Maturity Metric Score” to mean the Statewide Information Management Manual Section 5300-C, or any successor Statewide Information Management Manual section that describes a single score a state agency received following the completion of the calculation that reflects an agency’s information security status.
Requires a Maturity Metric Score to be comprised of information from the two most recent independent security assessments performed on a reporting entity.

EXISTING LAW:

Establishes CDT in the Government Operations Agency. (Gov. Code § 11545.)
Requires the Director of Technology to produce an annual information technology performance report that describes, among other things, the state’s progress towards enhancing the security, reliability, and quality of its information technology networks, services, and systems.
Requires CDT to establish procedures and policies required to improve the performance of the state’s information technology program.
Requires reporting entities to take all necessary steps to achieve the targets set forth by CDT, and requires them to report their progress to the department on a quarterly basis.
Requires reporting entities to submit annual summaries of their actual and projected information security costs for the preceding and current fiscal year, including federal grant funds for information security purposes. (Gov. Code § 11546.2.)
Establishes the Office of Information Security (OIS) in CDT. (Gov. Code § 11549.)
Describes the purpose of the OIS to be “ensuring the confidentiality, integrity, and availability of state systems and applications...”
Describes the duty of the OIS to be to “provide direction for information security and privacy for state government agencies, departments, and offices.”
Requires the Chief of OIS to establish an information security program that is tasked with, among other things, coordinating the activities of state agency information security officers for the purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards. (Gov. Code § 11549.3.)
Requires OIS to conduct, or require to be conducted, independent security assessments of at least 35 reporting entities each year, the cost of which is to be funded by the entities being assessed.
Requires OIS to determine criteria and rank state entities based on an information security risk index.
Permits OIS to conduct or require to be conducted an audit of information security to ensure program compliance.
Requires many state entities to implement the policies and procedures issued by the office, including complying with filing requirements and incident notification by providing timely information and reports as required by the office.
Requires state entities not covered by (d) to annually certify to the office that the entity is in compliance with relevant policies, standards, and procedures. Requires the certification to include a plan of action and milestones.

FISCAL EFFECT: As currently in print, this bill is keyed fiscal.

COMMENTS:

1) The importance of cybersecurity. According to the California State Auditor, information security measures are critical to safeguarding the State’s data processing capabilities, information technology (IT) infrastructure, and data, all of which are essential public resources.^[1] Without adequate information security, cyberattacks such as phishing and malware intrusions can result in the disclosure of confidential information or the shutdown of critical information systems.

Effective cybersecurity protects organizations against data breaches, helping to preserve the integrity, confidentiality, and availability of information. The downsides of inadequate cybersecurity can be severe, especially when the systems in question contain the personal information of millions of people. Data breaches can have devastating consequences ranging from identity theft to financial fraud to extortion.

Organizations that suffer from cybersecurity failures face not only immediate financial losses due to theft, but also long-term reputational damage. A breach can erode public trust, leading to a loss of partners and participants. Cybersecurity is particularly critical for government entities, especially in a significant and densely populated state like California, where state government holds the personal information of millions of its residents. From tax records and social security details to health information and immigration status, the state’s databases are treasure troves of sensitive data. Protecting these data not only safeguards the privacy of individuals, but also helps maintain trust in government.

2) The Department of Technology. CDT is, in its own words, “tasked with securing statewide information assets by providing oversight and infrastructure for many state departments and [serving] as the custodian of information for mission-critical and essential business applications.”^[2] Despite this charge, CDT was recently designated a high-risk state agency by the California State Auditor.^[3] In a January 2022 audit of CDT, the State Auditor found that CDT had yet to establish an overall statewide information security status for the State’s 108 reporting entities:

CDT relies on compliance audits and technical security assessments to summarize each reporting entity’s information security development into a single score, called a maturity metric. However, because CDT was slow to complete compliance audits, it only calculated 18 of the 39 maturity metric scores it should have determined by June 2021. Despite being aware of shortcomings with its approach, CDT failed to expand its capacity to perform compliance audits.

Moreover, even though CDT requires reporting entities to complete various self-assessments of their information security each year, it does not use this information to inform the statewide security status. Nonetheless, the information CDT does have shows that reporting entities continue to perform below recommended standards, and have not improved over the last several years. However, CDT has not taken critical steps to help reporting entities improve, such as holding them accountable for identifying potential risks to their critical information systems.^[4]

The State Auditor performed a follow-up audit in March 2023, and found that the issues it had flagged in its 2022 report had not been addressed:

CDT has not ensured that the State’s IT systems are adequately protected from cyberattacks that can compromise individuals’ identities, shut down critical government functions, and cost the State millions of dollars to remedy. For example, CDT has stated that to improve the State’s information security programs, it must be able to effectively determine the status of information security across the State as a whole and within each state agency individually. However, it has yet to determine the effectiveness of the State’s information security programs. Further, in those instances when it has assessed state agencies’ information security, those agencies’ security statuses have tended to decline subsequently rather than improve. Moreover, CDT has not taken adequate steps to educate state agencies on the cybersecurity threat monitoring service that it provides at no cost . . . Over the past 10 years, our multiple audits of CDT have identified the same or similar problems. Nevertheless, CDT has continued to struggle to demonstrate critical aspects of leadership, such as ensuring accountability, setting priorities, demonstrating urgency, and maintaining independence. ^[5]

If CDT cannot accurately assess the cybersecurity status of California’s reporting entities, it cannot effectively intervene when these entities fall out of compliance, or harden California against cybersecurity threats. The longer an undetected vulnerability remains unaddressed, the greater the risk to Californians’ privacy and security. How can these issues be resolved? The core of CDT’s cybersecurity strategy lies with its “cybersecurity maturity metrics” – however, while these metrics are informative, the in-depth audits they require make them slow and clunky. It is not feasible for CDT to calculate a maturity metric score for each reporting entity every three years.

3) Author’s statement. According to the author:

There have been several state agency and department cybersecurity breaches recently, exposing Californians to identity theft, financial fraud, and delays in access to essential state services. Assembly Bill 2777 would require the California Department of Technology to revise its existing Cybersecurity Maturity Metrics to improve the reliability, efficiency, and timeliness when assessing the state entities’ IT systems. This bill requires the department to make these revisions with a goal of completing these assessments every three years. We have a responsibility to ensure that the personal information of our constituents is kept safe and this bill advances state efforts to meet this duty.

4) What this bill would do. This bill would require CDT to update its cybersecurity maturity metric such that a score could be calculated for all reporting entities every three years. At present, “cybersecurity maturity metrics” are not specifically required in state law. This bill would codify them by referencing a manual published by CDT: the Statewide Information Management Manual Section 5300-C. This bill does not provide much specific direction as to how these metrics should be adjusted to improve timeliness, but it does require the new metrics to include information from the two most recent independent security assessments performed on a state agency.

Analysis. The approach this bill outlines – requiring CDT to change the process of deriving cybersecurity maturity metrics – may not be the most preferable solution to the current problem. While slow, cybersecurity metrics play a vital role in maintaining California’s cybersecurity status, as explained by CDT in the State Auditor’s 2022 report:

CDT designed the maturity metrics to be repeatable and consistent so that it can gauge each entity’s progress moving forward and compare information security development across entities. For those reasons, the statewide cybersecurity metrics program manager (metrics manager) explained that CDT does not intend to change the methodology for calculating maturity metric scores during the four‑year oversight life cycle. In addition to using the maturity metrics to identify gaps in a specific entity’s information security, CDT uses the maturity metrics to track statewide trends that can inform the control categories for which it offers additional guidance, training, and support.

However, there may be an alternative. According to the 2022 State Auditor report, CDT requires reporting entities to meet certain self-reporting standards with respect to their information security:

CDT requires reporting entities to complete the federal Nationwide Cybersecurity Review (nationwide review) every year because it is a condition for receiving information security grant funding from the U.S. Department of Homeland Security. The nationwide review is a self‑assessment questionnaire that reporting entities submit to the federal government. It allows entities to rate on a scale of 1 to 7 how well they are addressing different information security activities within NIST, thus providing an entity-wide information security assessment.
CDT also requires reporting entities to perform a security controls self‑assessment based on NIST 800‑53 for each of their critical IT systems to identify security risks related to that system and establish a plan to resolve those risks . . . The security controls self‑assessment culminates with a high‑risk findings report, which entities must submit to CDT as part of their annual Information Security and Privacy Program Compliance Certifications (compliance certifications).
CDT requires reporting entities to develop and maintain a Plan of Action and Milestones document (plan of action), which they must use to provide, at a minimum, quarterly updates to CDT on their progress toward remediating any known information security weaknesses . . . the plan of action is a document that reporting entities regularly update with information security deficiencies identified through the compliance activities we describe previously. CDT expects reporting entities to also track in their plans of action any information security weaknesses that they identify through other sources, such as security incidents or third‑party oversight reviews. For each deficiency in the plan of action, reporting entities must briefly describe the high‑level steps they will take to address the risk and whether they have identified any constraints to remediating the risk, among other things.^[6]

In addition to these items, OIS maintains and monitors the California Compliance and Security Incident Reporting System (Cal-CSIRS). Cybersecurity incidents are reported by state entities to OIS through this system, granting OIS an up-to-date understanding of where and when attacks occur.

Taken together, CDT has access to a wealth of information reflecting the cybersecurity status of its reporting entities even in the absence of lengthy and expensive compliance audits. The State Auditor’s 2022 report recommended CDT use this readily available information to more regularly estimate the security status of reporting entities:

To ensure that it understands the statewide security status of reporting entities, CDT should do the following: . . . Utilize the information from the entities’ self‑assessments of their systems, as well as from the nationwide review, to annually help identify common areas that require improvement across multiple reporting entities.^[7]

CDT appears to have taken this suggestion to heart. The State Auditor’s 2023 report revealed that CDT has begun to develop a new “baseline information security score”:

Further, the security risk manager explained that CDT is currently developing a new priority risk ranking process that will allow it to quickly develop a baseline information security score for all reporting entities without having to complete compliance audits for each. This score will summarize readily available information, including the results of the reporting entities’ independent security assessments as well as information that the reporting entities self-report annually to the federal government.^[8]

The proposed committee amendments would codify the development of this baseline information security score (BISS) and require CDT to calculate a BISS for each reporting entity annually. By generating and tracking these scores over time, CDT could appropriately target its expensive, lengthy compliance audits at reporting entities found by the BISS to be particularly vulnerable.

Ultimately, adopting the BISS may be more cost effective than requiring CDT to adjust its existing maturity metric process. There are two reasons for this: first, the BISS would only involve information that is already provided to or easily accessed by CDT. Second, CDT has conveyed that they are already working on developing the BISS.

6) Proposed committee amendments.

Section 11549.3 of the Government Code is amended to read:

(e) Before January 1, 2026, the office shall develop a Baseline Information Security Score (BISS) metric that can be used to estimate the information security status of state agencies, departments, and offices. The BISS shall utilize readily available information, including, but not limited to:

(1) Results of recent independent security assessments performed by state entities pursuant to subdivision (c).

(2) Information that state entities self-report annually to the federal government as part of the Nationwide Cybersecurity Review (NCSR).

(3) Custom reports provided to state entities by the federal government as part of NCSR.

(4) State entities’ Compliance Certification and required supplementary materials, submitted pursuant to subdivision (h) paragraph (4).

(5) Any relevant incidents reported through the California Compliance and Security Incident Reporting System (Cal-CSIRS).

(6) Any recent compliance audits conducted by the Department of Technology.

(7) Any other relevant information the office possesses or is able to quickly and easily obtain.

(f) Beginning on January 1, 2027, and annually thereafter, the office shall calculate a Baseline Information Security Score for each eligible state agency, department, and office.

7) Related legislation. AB 1667 (Irwin, 2023) would have established the California Cybersecurity Awareness and Education Council within the Department of Technology. This bill was held on suspense in Assembly Appropriations Committee.

AB 749 (Irwin, 2023) would have required state agencies to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software in order to achieve prescribed levels of maturity based on a Cybersecurity and Infrastructure Security Agency Maturity Model. This bill was held on suspense in Senate Appropriations Committee.

AB 302 (Ward, 2023) required the Department of Technology to conduct a comprehensive inventory of all high-risk automated decision systems proposed for use or procured by state agencies.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition