Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires state entities, as specified, to implement the policies and procedures issued by the office. The law additionally authorizes the office, under direction of the chief, to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. State agencies must certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill would require every state agency, as defined, defined and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the offices chief, no later than January 1, 2025, to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislatures intent that the bills provisions be implemented in a manner consistent with the states timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires state entities, as specified, to implement the policies and procedures issued by the office. The law additionally authorizes the office, under direction of the chief, to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. State agencies must certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill would require, by January 1, 2026, require every state agency, as defined, to implement specified actions relating to Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency. The for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to implement Zero Trust architecture, as defined, and prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks. This frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the offices chief, no later than January 1, 2025, to develop or revise uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture, including multifactor authentication, as defined, architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill requires would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislatures intent that the bills provisions be implemented in a manner consistent with the states timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires state entities, as specified, to implement the policies and procedures issued by the office. The law additionally authorizes the office, under direction of the chief, to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. State agencies must certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill would require, by January 1, 2026, every state agency, as defined, to implement specified actions relating to data, hardware, software, internal systems, and essential third-party software, including multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency. The bill would require state agencies to implement Zero Trust architecture, as defined, and prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks. This bill would require the offices chief, no later than January 1, 2025, to develop uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture, including multifactor authentication, as defined, on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill requires the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislatures intent that the bills provisions be implemented in a manner consistent with the states timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires state entities, as specified, to implement the policies and procedures issued by the office. The law additionally authorizes the office, under direction of the chief, to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. State agencies must certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill would require, by January 1, 2025, 2026, every state agency, as defined, to implement specified actions relating to data, hardware, software, internal systems, and essential third-party software, including multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency. The bill would require state agencies to implement Zero Trust architecture, as defined, and prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks. This bill would require the offices chief, no later than January 1, 2024, 2025, to develop uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture, including multifactor authentication, as defined, on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill requires the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also make related legislative findings and declarations.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires state entities, as specified, to implement the policies and procedures issued by the office. The law additionally authorizes the office, under direction of the chief, to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. State agencies must certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill would require, by January 1, 2025, every state agency, as defined, to implement specified actions relating to data, hardware, software, internal systems, and essential third-party software, including multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency. The bill would require state agencies to implement a Zero Trust architecture, as defined, and prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks. This bill would require the offices chief, no later than January 1, 2024, to develop uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture and architecture, including multifactor authentication, as defined, on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill requires the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also make related legislative findings and declarations.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires state entities, as specified, to implement the policies and procedures issued by the office. The law additionally authorizes the office, under direction of the chief, to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. State agencies must certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill would require, by January 1, 2025, every state agency, as defined, to implement specified actions relating to data, hardware, software, internal systems, and essential third-party software, including multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency. The bill would require state agencies to implement a Zero Trust architecture, as defined, and prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks. This bill would require the offices chief, no later than January 1, 2024, to develop uniform technology policies, standards, and procedures for use by all state agencies in Zero Trust architecture and multifactor authentication, as defined, on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill requires the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also make related legislative findings and declarations.

SENATE COMMITTEE ON

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

AB 749 (Irwin) - State agencies: information security: uniform standards

Bill Summary:

AB 749 requires state agencies to implement a “Zero Trust” cybersecurity architecture, as specified, which includes multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices, as specified.

Fiscal Impact:

Significant one-time and ongoing costs totaling into the hundreds of millions of dollars for all state entities covered in the bill to implement a Zero Trust architecture as prescribed (General Fund and various special funds). See Staff Comments for additional detail.

Background:

Recently it has become accepted that across both public and private sector networks, legacy approaches to cybersecurity are failing to address new threat vectors. These include “perimeter” focused approaches like firewalls, and “implicit trust” designed systems that do not require a user or device re-authenticate itself once it has been granted access to a network. This understanding has generated a new approach to cybersecurity referred to as “zero trust” whose application to developing and deploying cybersecurity solutions is referred to as “zero trust architecture” (ZTA). The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207 provides the following operative definition of zero trust and ZTA:

Zero trust provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.

ZTA is an enterprise’s cybersecurity plan that uses zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a ZTA plan.

Proposed Law:

• Requires every state agency to implement ZTA for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, according to the following levels of maturity based upon the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model:
  • Achieve “Initial” maturity by June 1, 2024.
  • Achieve “Advanced” maturity by June 1, 2026.
  • Achieve “Optimal” maturity by June 1, 2030.
• Requires, in implementing ZTA, state agencies to prioritize the use of solutions that comply with, are authorized by, or align to applicable federal guidelines, programs, and frameworks, including the Federal Risk and Authorization Management Program, the Continuous Diagnostics and Mitigation Program, and guidance and frameworks from the NIST.
• Requires implementation to, at a minimum, prioritize the following:
  • Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.
  • Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.
  • Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.
• Requires, no later than January 1, 2025, the Chief of the Office of Information Security (OIS) to develop or revise uniform technology policies, standards, and procedures for use by each state agency in implementing ZTA to achieve the “Advanced” and “Optimal” maturity levels stated in the State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM). A state agency may, but is not required to, use the policies, standards, and procedures developed by the chief.
• Requires, no later than January 1, 2025, the Chief of OIS to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to collect information relating to a state agency’s progress in increasing internal defenses of agency systems, including:
  • A description of any steps the state agency has completed, including advancements towards achieving ZTA maturity levels.
  • Following an independent security assessment, an identification of activities that have not yet been completed and that would have the most immediate security impact.
  • A schedule to implement any planned activities.
• Authorizes the Chief of OIS to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to also include information on how a state agency is progressing with respect to the following:
  • Shifting away from trusted networks to implement security controls based on a presumption of compromise.
  • Implementing principles of least privilege in administering information security programs.
  • Limiting the ability of entities that cause cyberattacks to move laterally through or between a state agency’s systems.
  • Identifying cyber threats quickly.
  • Isolating and removing unauthorized entities from state agencies’ systems as quickly as practicable, accounting for cyber threat intelligence or law enforcement purposes.
• Provides that the above requirements apply to the University of California (UC) only to the extent that the Regents of the UC, by resolution, make these requirements applicable to the university.
• Defines “Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model” to mean the Zero Trust Maturity Model published by the Cybersecurity and Infrastructure Security Agency.
• Defines “endpoint detection and response” to mean a cybersecurity solution that continuously monitors end-user devices to detect and respond to cyber threats.
• Defines “multifactor authentication” to mean using two or more different types of identification factors to authenticate a user’s identity for the purpose of accessing systems and data.
• Defines “Zero Trust architecture” to mean a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy that employs continuous monitoring, risk-based access controls, secure identity and access management practices, and system security automation techniques to address the cybersecurity risk from threats inside and outside traditional network boundaries.
• States Legislative findings and declarations related to cybersecurity and states the intent of the Legislature that this bill be implemented in a manner that is consistent with the state’s timely compliance with requirements that are conditions to receipt of federal funds, including, but not limited to, funding from the Infrastructure Investment and Jobs Act.

Staff Comments:

While the total fiscal impact of the bill is unknown at this time, it will be significant and will likely total into the high hundreds of millions of dollars. While not all state agencies would require the same level of resources, costs are anticipated to be generally significant for all impacted entities. For context, below is a sample of various state entities and their reported fiscal impacts.

• The Department of Technology reports the need for 5.0 permanent positions and costs of $1.6 million in year one and $1.2 million ongoing to develop policy and technical standards, assist entities through advisory service engagements as necessary, and conduct rapid assessments and validations (General Fund).
• The Environmental Protection Agency reports the following fiscal impacts for entities under its purview:
  • The State Water Resources Control Board—ongoing annual costs of approximately $5.4 million for additional staff resources; $9.0 million annually for the first three fiscal years (FYs) and $1.4 million annually thereafter to maintain and update IT contracts and software. The State Water Board notes that absent a General Fund appropriation, these costs will impact every fund account it administers (Safe Drinking Water Account, Water Rights Fund, Waste Discharge Permit Fund, Environmental Laboratory Improvement Fund, and Underground Storage Cleanup Fund).
  • Department of Pesticide Regulation—one-time cost of approximately $1.1 million for equipment and to contract with a limited-term staff to implement new controls for ZTA and $391,000 ongoing for additional IT staff workload.
  • Air Resources Board—costs of approximately $10.8 million in FY 2023-24, $9.7 million in FY 2024-25, and $8.5 million in FY 2025-26 and ongoing for 7.0 permanent staff and IT-related equipment and workload (various funds).
• The Business, Consumer Services and Housing (BCSH) Agency reports agency-wide costs of approximately $17.6 million in the first year and $3.5 million annually ongoing. BCSH notes many of the special fund entities under its purview would not have sufficient resources to cover the increased costs to comply with the mandates of this bill, and would need either General Fund allocations or fee increases to cover these costs. Additionally, the following entities under BCSH reported a breakdown of their fiscal impacts:
  • Department of Alcoholic Beverage Control—ongoing costs ranging in the hundreds of thousands to low millions of dollars.
  • Department of Cannabis Control—approximately $1.7 million in the first year and annual ongoing costs of over $1 million.
• The Health and Human Services (HHS) Agency estimates ongoing costs ranging in the high hundreds of thousands to low millions of dollars (General Fund). Additionally, the following entities under HHS reported a breakdown of their fiscal impacts:
  • Department of Health Care Services—costs over the first three FYs of approximately $67 million and annual ongoing costs of $8.2 million thereafter (General Fund and federal funds).
  • Department of Social Services—one-time local assistance contractor and services costs of approximately $40.8 million and ongoing local assistance hardware costs of approximately $650,000; ongoing state operations costs of approximately $3.3 million for 33.0 permanent staff.
• The Natural Resources Agency reports the need for 4.0 permanent positions and $1.6 million annually. Agency also reports the following fiscal impacts for some of the entities under its purview:
  • State Lands Commission—one-time cost ranging between $525,000 and $2.4 million and annual ongoing costs ranging between $120,000 and $200,000.
  • California Coastal Commission—one-time cost of approximately $1.5 million and ongoing annual costs of approximately $500,000.
  • Department of Water Resources—ongoing cost in the low millions of dollars annually.
  • Native American Heritage Commission—annual ongoing costs of $200,000.
  • Department of Forestry and Fire Protection—approximately $12 million in years one and two, $2 million in year three, and $7 million annually thereafter in addition to 10.0 permanent staff.
• The Department of Insurance reports the need for 9.0 permanent staff and costs of $946,000 in FY 2023-24, $2.8 million in FY 2024-25, $1.7 million in FY 2025-26 and ongoing (Insurance Fund – Fees and License sub-account). The department notes that these costs would put additional pressure on the Fees and License sub-account, which may accelerate the need for a future fee increase.
• The Department of Veterans Affairs reports costs of approximately $2.7 million in year one and $1.4 million ongoing (General Fund).
• The Employment Development Department reports a total one-time cost of approximately $53 million and annual ongoing costs of approximately $30 million.
• The Office of the State Controller reports a total fiscal estimate of $15 million for implementation, which does not include any potential staff augmentation that would be necessary for ongoing implementation and other support activities.

As noted by several state entities that are special funded and generally do not receive General Fund support, this bill will likely create significant new cost pressures that impact these entities’ operating costs and may necessitate or accelerate the need for future regulatory or license fee increases.

Additionally, given current priorities and existing capabilities and resources, it is unlikely that many state agencies would be able to meet the mandates of this bill in the timeline established.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2023 - 2024 Regular

Bill No: 749 Hearing Date: 7/11/2023

SUBJECT: State agencies: information security: uniform standards

DIGEST: This bill requires state agencies to implement a “Zero Trust” cybersecurity architecture, as specified, which includes multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices, as specified.

ANALYSIS:

Existing law:

1. Establishes the Office of Information Security (OIS) within the Department of Technology (CDT) for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.
2. Requires state entities, as specified, to implement the policies and procedures issued by OIS and authorizes OIS to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified.
3. Requires state agencies to certify, by February 1 annually, to the President pro Tempore of the Senate and the Speaker of the Assembly that the agency is in compliance will all adopted policies, standards, and procedures and to include a plan of action and milestones, as specified.

This bill:

1. Requires every state agency to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, according to the following levels of maturity based upon the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model:
   1. Achieve “Initial” maturity by June 1, 2024.
   2. Achieve “Advanced” maturity by June 1, 2026.
   3. Achieve “Optimal” maturity by June 1, 2030.
2. Requires, in implementing Zero Trust architecture, state agencies to prioritize the use of solutions that comply with, are authorized by, or align to applicable federal guidelines, programs, and frameworks, including the Federal Risk and Authorization Management Program, the Continuous Diagnostics and Mitigation Program, and guidance and frameworks from the National Institute of Standards and Technology (NIST).
3. Requires implementation to, at a minimum, prioritize the following:
   1. Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.
   2. Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.
   3. Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.
4. Requires, no later than January 1, 2025, the Chief of OIS to develop or revise uniform technology policies, standards, and procedures for use by each state agency in implementing Zero Trust architecture to achieve the “Advanced” and “Optimal” maturity levels stated in the State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM). A state agency may, but is not required to, use the policies, standards, and procedures developed by the chief.
5. Requires, no later than January 1, 2025, the Chief of OIS to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to collect information relating to a state agency’s progress in increasing internal defenses of agency systems, including:
   1. A description of any steps the state agency has completed, including advancements towards achieving Zero Trust architecture maturity levels.
   2. Following an independent security assessment, an identification of activities that have not yet been completed and that would have the most immediate security impact.
   3. A schedule to implement any planned activities.
6. Authorizes the Chief of OIS to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to also include information on how a state agency is progressing with respect to the following:
   
   1. Shifting away from trusted networks to implement security controls based on a presumption of compromise.
   2. Implementing principles of least privilege in administering information security programs.
   3. Limiting the ability of entities that cause cyberattacks to move laterally through or between a state agency’s systems.
   4. Identifying cyber threats quickly.
   5. Isolating and removing unauthorized entities from state agencies’ systems as quickly as practicable, accounting for cyber threat intelligence or law enforcement purposes.
7. Defines “Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model” to mean the Zero Trust Maturity Model published by the Cybersecurity and Infrastructure Security Agency.
8. Defines “endpoint detection and response” to mean a cybersecurity solution that continuously monitors end-user devices to detect and respond to cyber threats.
9. Defines “multifactor authentication” to mean using two or more different types of identification factors to authenticate a user’s identity for the purpose of accessing systems and data.
10. Defines “Zero Trust architecture” to mean a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy that employs continuous monitoring, risk-based access controls, secure identity and access management practices, and system security automation techniques to address the cybersecurity risk from threats inside and outside traditional network boundaries.
11. Includes Legislative findings and declarations related to cybersecurity and states the intent of the Legislature that this bill be implemented in a manner that is consistent with the state’s timely compliance with requirements that are conditions to receipt of federal funds, including, but not limited to, funding from the Infrastructure Investment and Jobs Act.

Background

Author Statement. According to the author’s office, “the cybersecurity of California’s state agencies is foundational to the smooth and efficient operation of countless critical services. The State has a strong tradition of leveraging the expertise and example of our federal partners in the cybersecurity space to ensure Californians can have the same level of confidence in the security of their data and the dependability of services regardless of which level of government is responsible. Cybersecurity standards resulting from certain provisions of EO 14028 have already been adopted into California law. It is important to continue to identify and pursue additional elements of this EO and other work being done by NIST and CISA to ensure we are continuing to follow cybersecurity best practices. With AB 749 California will take an important step towards adoption of Zero Trust principles, by revising our standards and procedures to reflect them and put them into operation in already mandated processes, assessments, and reports.”

Zero Trust Architecture. Recently it has become accepted that across both public and private sector networks, legacy approaches to cybersecurity are failing to address new threat vectors. These include “perimeter” focused approaches like firewalls, and “implicit trust” designed systems that do not require a user or device re-authenticate itself once it has been granted access to a network. This understanding has generated a new approach to cybersecurity referred to as “zero trust” whose application to developing and deploying cybersecurity solutions is referred to as “zero trust architecture” (ZTA). The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207 provides the following operative definition of zero trust and ZTA:

Zero trust provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.

ZTA is an enterprise’s cybersecurity plan that uses zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a ZTA plan.

The Federal Government has acknowledged vulnerabilities in legacy approaches to cybersecurity including perimeter defense and acted to remediate it. In his Executive Order on Improving the Nation’s Cybersecurity (EO 14028), President Biden ordered each federal agency to “develop a plan to implement Zero Trust Architecture, which shall incorporate, as appropriate, the migration steps that the National Institute of Standards and Technology (NIST) within the Department of Commerce has outlined in standards and guidance, describe any such steps that have already been completed, identify activities that will have the most immediate security impact, and include a schedule to implement them;”

The Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security has also published a “Zero Trust Maturity Model” which outlines the steps federal agencies and others may take to establish ZTA and build upon it to increasingly sophisticated levels (traditional > initial > advanced > optimal).

The Bipartisan Infrastructure Law (BIL) passed in 2021 created the State and Local Cybersecurity Grant Program (SLCGP). The SLCGP is a four-year $1 billion federal grant administered by CISA and the Federal Emergency Management Agency (FEMA). The Notice of Funding Opportunity (NOFO), published last fall outlines the required elements of the statutory Cybersecurity Plan that must be submitted. Included in the 16 required elements are two portions of AB 749, multi-factor authentication and robust logging practices, while it encourages the third portion endpoint threat detection and response for advanced states.

California has already received roughly $8 million in funds from SLCGP for FY22. As a condition of the grant, a Cybersecurity Plan must be submitted by a Cybersecurity Planning Committee. Due to delays in CISA developing the NOFO, the Plan must be submitted by Sept 30, 2023. The California Office of Emergnecy Services (OES) is leading the coordination of the Planning Committee.

Cybersecurity Plan. Each eligible entity is required to submit its Cybersecurity Plan that adheres to the 16 required elements identified in section 2220A of the Homeland Security Act of 2002 as amended by the BIL and included in Appendix C of this NOFO unless the eligible entity is applying for funds to develop a Cybersecurity Plan as described more below. The Cybersecurity Plan must include a description of SLT roles, an assessment of capabilities for each element, address resources and timeline for implementing the Plan, and identify metrics. Governments are encouraged to take a holistic approach in the development of their Plan as entities must be able to sustain capabilities once SLCGP funds are no longer available. The role of state entities as coordinator and service provider to local entities should be encouraged and supported.

The NOFO directs the Cybersecurity Plan to include required and recommended language to advance towards ZTA and implement the capabilities required by this bill.

To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, governments must take decisive steps to modernize their approach to cybersecurity, adopting security best practices and advancing toward ZTA. The following strategic elements, therefore, are required to be included in Cybersecurity Plans and in individual projects:

1. Implement multi-factor authentication;
2. Implement enhanced logging;
3. Data encryption for data at rest and in transit;
4. End use of unsupported/end of life software and hardware that are accessible from the Internet;
5. Prohibit use of known/fixed/default passwords and credentials;
6. Ensure the ability to reconstitute systems (backups); and
7. Migration to the .gov internet domain.

As individual government entities increase their cybersecurity maturity, implementing more advanced best practices, such as endpoint detection and response capabilities, as well as conducting regular penetration testing, will be recommended.

While state agencies have made great strides in recent years to increase their cybersecurity maturity, there remains significant areas with need for improvement to achieve the high level of security expected by Californians.

To address these needed areas of improvement, Governor Newsom’s Administration, through the CDT, published in 2021 “Cal-SECURE: State of California Executive Branch Multi-Year Information Security Maturity Roadmap.” Cal-SECURE charts out a phased order of priority for cybersecurity capabilities, which includes many operational elements of ZTA including “privileged access management,” “multifactor authentication,” “mobile device management,” “identity lifecycle management,” “network threat detection,” and “log management.” However, unlike EO 14028, Cal-SECURE does not have any deadlines for action, and has not seen as robust effort placed behind it to achieve its goals.

On May 17^th, the CDT issued a Technology Letter (23-01) “Multi-Factor Authentication Standard.” Technology Letters (TL) are issued by the CDT to convey official communications regarding state IT, announce new (or changes to existing) IT policies and procedures, or announce new (or changes to existing) state IT services or standards. TL 23-01 while announcing SIMM 5360-C and 5360-D, which outlines standards for when and how to use multifactor authentication (MFA), also set noticed the Administration’s adoption of ZTA:

“This TL also serves as a notice that all State entities must work toward a Zero Trust Architecture (ZTA) model as outlined in NIST 800-207. Refer to the Cybersecurity Infrastructure Security Agency (CISA) Zero Trust Maturity Model Version 2.0. By May 2024, all State agencies/entities must have assessed, planned, and implemented the “Initial” maturity stage of each of the five pillars including Identity, Devices, Networks, Applications & Workloads, and Data.”

With new state systems being brought online, legacy systems being replaced, and state agencies investing in remediating findings from independent security assessments on a rolling basis, California is at risk of falling behind if we do not focus on Zero Trust Architecture informing these critical IT maintenance and procurement activities.

This bill requires implementation to, at a minimum, prioritize: multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency; enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities; robust logging practices to provide adequate data to support security investigations and proactive threat hunting.

Prior/Related Legislation

SB 74 (Dodd & Jones, 2023) requires state entities to prohibit the downloading or installation of high-risk social media applications on those entities’ state-owned or state-issued devices if a country or entity of concern owns or controls the social media company, as specified. (Pending in the Assembly Accountability and Administrative Review Committee)

SB 265 (Hurtado, 2023) requires OES to direct the California Cybersecurity Integration Center (Cal-CSIC) to prepare, and OES to submit to the Legislature, a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified. (Pending in the Assembly Emergency Management Committee)

AB 1023 (Papan, 2023) expands the scope of Cal-CSIC by explicitly requiring the center to coordinate cyber threat information sharing with school districts, county offices of education, and charter schools, as specified. (Pending in the Senate Appropriations Committee)

AB 2135 (Irwin, Chapter 773, Statutes of 2022) requires state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, requires those agencies to perform a comprehensive independent security assessment (ISA) every two years, as specified.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

Software Alliance

Technology Industry Association of California

OPPOSITION:

None received

ARGUMENTS IN SUPPORT: In support of the bill, the Software Alliance writes, "[w]e strongly encourage policymakers to support increased investment in modern IT infrastructure and cybersecurity, for example, by implementing zero trust architecture and using state-of-the-art identity, credentialing, and access management, which AB 749 proposes. Organizations, including governments, should expect these investments to grow as they continue their digital transformations, and thus are able to deliver better, more secure services to citizens and customers. This can be achieved by using commercial-off-the-shelf (COTS) solutions by enterprise technology companies who continuously update their solutions to improve both security and functionality.”

ASSEMBLY THIRD READING

ATR Bill Id:AB 749

Author:(Irwin)

As Amended Ver:April 25, 2023

Majority vote

SUMMARY

Requires every state agency to implement Zero Trust architecture by January 1, 2026, including multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices, following uniform technology policies, standards, and procedures developed by the Chief of the Office of Information Security.

Major Provisions

1. Defines the following terms:
   1. "Endpoint detection and response" means a cybersecurity solution that continuously monitors end-user devices to detect and respond to cyber threats.
   2. "Multifactor authentication" means using two or more different types of identification factors to authenticate a user's identity for the purpose of accessing systems and data.
   3. "Zero Trust architecture" means a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy that employs continuous monitoring, risk-based access controls, secure identity and access management practices, and system security automation techniques to address the cybersecurity risk from threats inside and outside traditional network boundaries.
2. Requires, by January 1, 2026, every state agency to implement Zero Trust architecture, including the following for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments:
   1. Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.
   2. Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.
   3. Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.
3. Requires, no later than January 1, 2025, the Chief of the Office of Information Security to develop uniform technology policies, standards, and procedures for use by each state agency in implementing Zero Trust architecture, including multifactor authentication, on all systems in the State Administrative Manual and Statewide Information Management Manual.
4. States the intent of the Legislature that this bill be implemented in a manner that is consistent with the state's timely compliance with requirements that are conditions to receipt of federal funds, including, but not limited to, funding from the Infrastructure Investment and Jobs Act (Public Law 117-58).

COMMENTS

Background. The basic problem addressed by this bill is that traditional approaches to cybersecurity fail to address current and emerging threats to government networks. Such traditional approaches include securing the perimeter of a network with one or more firewalls, and requiring a user or device to submit a credential, such as a password, in order to gain access to a network. Once the user or device meets these requirements, that user or device is presumed to be trustworthy and generally need not demonstrate its trustworthiness again while logged into the network. It is well-known that hackers try, and sometimes succeed, in fraudulently meeting these requirements through tactics such as phishing (posing as a trusted individual or entity in order to obtain passwords or other sensitive information). However, it is also disturbingly common for individuals who are in positions of trust, including employees and executives, to use legitimate network access in order to steal and reveal secure information.

In response, this bill proposes to require California state agencies to adopt certain cybersecurity standards and methodologies outlined in President Biden's Executive Order (EO) 14028 on Improving the Nation's Cybersecurity, (86 Fed. Reg. 26,633 (May 17, 2021), available at https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity.)

Foremost among these standards and methodologies is the adoption of a "Zero Trust" model for California state government's security architecture. As its name implies, Zero Trust, described in greater detail below, is a "cybersecurity approach that authenticates and authorizes every interaction between a network and a user or device – in contrast to traditional cybersecurity models that allow users or devices to move freely within the network once they are granted access. [Zero Trust architecture] works on the 'never trust, always verify' principle and assumes that attacks will come from within and outside of the network." (United States Government Accountability Office, Science & Tech Spotlight: Zero Trust Architecture (Nov. 18, 2022) GAO-23-106065, available at https://www.gao.gov/products/gao-23-106065.)

What this bill would do. Under this bill, covered state entities would be required to implement Zero Trust architecture by January 1, 2026, which includes implementing the following:

1. "Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency."

Multifactor authentication, at its most basic, means not permitting a user to log in to a network unless they can present more than one form of authentication to prove their identity. It is not sufficient for a user to simply enter their password in order to gain network access. Users will likely be regularly prompted to reauthenticate themselves in order to maintain network access.

1. "Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities."

A cybersecurity threat might involve a virus or malware infecting computers on the network. But it might also take the form of a trusted employee accessing files they do not ordinarily access, or downloading terabytes of data to a USB drive, in either case to purloin confidential or sensitive information. The phrase "enterprise endpoint detection and response" means continuously monitoring users' devices. The phrase "real-time detection of cybersecurity threats" means identifying such threats while they are occurring, rather than – as often occurs now – after the network has been hacked, when it is too late to prevent or mitigate the problem. In other words, this provision of the bill would require state agencies to use technologies to continuously monitor users' behavior and activity within their networks in order to rapidly (and ideally, immediately) identify threats as they occur.

1. "Robust logging practices to provide adequate data to support security investigations and proactive threat hunting."

"Logging" means maintaining records of relevant activity in the network. This provision is meant to ensure that in the event of a successful cyberattack, there is sufficient, adequate information available to perform a forensic analysis meant to prevent a similar attack from occurring again.

In order to implement these requirements, the bill would require the state Office of Information Security (OIS) to update policies, standards, and procedures in the State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) to use in implementing Zero Trust architecture. State entities covered by the SAM and SIMM would have to include progress towards Zero Trust in their annual reporting, and the OIS would be free to update reporting requirements as necessary.

Entities deemed "constitutional officers" – i.e., those executive branch officers provided for under the California Constitution that are not under the direct authority of the Governor—including the Lieutenant Governor, Attorney General, Controller, Insurance Commissioner, Public Utilities Commission, Secretary of State, Superintendent of Public Instruction, Treasurer, the State Board of Equalization, and the State Auditor, are not required to comply with the policies, standards, and procedures in the SAM and SIMM. Accordingly, this bill would provide these entities the option of using the updated policies, standards, and procedures therein.

Analysis. As this bill's author notes, cost-benefit analysis likely favors this bill's adoption:

Implementing multi-factor authentication, endpoint detection, and increasing logging practice would have associated costs, but would not prevent or significantly modify an agency's workflow. These capabilities would likely pay for themselves in avoided costs related to a potential breach or shutdown of an agency's systems.

Cybersecurity is ultimately not an abstract issue. The state operates critical computer systems related to public health (Covered California, MediCal), food assistance (CalFresh), labor and workforce development (unemployment insurance, workers' compensation), occupational licensing, and so forth. If these systems were disabled or malfunctioned due to a cyber attack, millions of vulnerable Californians and their families could be harmed.

According to the Author

The cybersecurity of California's state agencies is foundational to the smooth and efficient operation of countless critical services. The state has a strong tradition of leveraging the expertise and example of our federal partners in the cybersecurity space to ensure Californians can have the same level of confidence in the security of their data and the dependability of services regardless of which level of government is responsible. […] With AB 749, California will take an important step towards adoption of Zero Trust principles, by revising our standards and procedures to reflect them and put them into operation in already mandated processes, assessments, and reports.

Arguments in Support

BSA The Software Alliance writes:

We strongly encourage policymakers to support increased investment in modern IT infrastructure and cybersecurity, for example, by implementing zero trust architecture and using state-of-the-art identity, credentialing, and access management, which AB 749 proposes. Organizations, including governments, should expect these investments to grow as they continue their digital transformations, and thus are able to deliver better, more secure services to citizens and customers.

Arguments in Opposition

None on file

FISCAL COMMENTS

According to the Assembly Appropriations Committee:

1. General Fund (GF) costs of approximately $1.6 million in the first year and GF costs of approximately $1.2 million annually thereafter to CDT for five staff positions to develop policy and technical standards, help state agencies comply with Zero Trust architecture, and help conduct rapid assessments and validation.
2. Costs of an unknown, but definitely significant, amount across state agencies for new personnel and technical tools needed to implement updated cybersecurity policies.

For its part, the Secretary of State (SOS) estimates costs of approximately $854,000 in the first year and $844,000 annually thereafter to implement Zero Trust architecture and share information with the OIS chief relating to the SOS's progress in increasing internal defenses of agency systems. Costs include two additional information technology (IT) staff positions and IT operating equipment and expenses. Similarly, the Department of Insurance estimates costs of approximately $946,000 in fiscal year (FY) 2023-24, $1.8 million in FY 2024-25, $2.8 million in FY 2025-26, and $1.7 million annually thereafter. The State Controller's Office (SCO) also estimates costs of $10,000 per employee to implement Zero Trust architecture. Given the size of the SCO, such costs would total approximately $15 million.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM ACCOUNTABILITY AND ADMINISTRATIVE REVIEW: 6-0-1

YES: Petrie-Norris, Dixon, Davies, Stephanie Nguyen, Rodriguez, Wilson

ABS, ABST OR NV: Bains

ASM APPROPRIATIONS: 15-0-1

YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Hart, Lowenthal, Mathis, Papan, Pellerin, Sanchez, Weber, Ortega

ABS, ABST OR NV: Robert Rivas

UPDATED

VERSION: April 25, 2023

CONSULTANT: Jith Meganathan / P. & C.P. / (916) 319-2200 FN: 0000760

Date of Hearing: May 10, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 749

Author:(Irwin) – As Amended Ver:April 25, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires, by January 1, 2026, every state agency to implement Zero Trust architecture for cybersecurity.

Specifically, this bill:

1. Requires each state agency to implement Zero Trust architecture, which includes the following, for all data, hardware, software, internal systems, and essential third-party software: (a) multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency; (b) enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities, and (c) robust logging practices to provide adequate data to support security investigations and proactive threat hunting.
2. Requires, by January 1, 2025, the Office of Information Security (OIS) chief within the Department of Technology (CDT) to develop uniform technology policies, standards, and procedures for use by each state agency in implementing Zero Trust architecture on all systems in specified state manuals. State agencies not under direct authority of the Governor, are authorized to follow these policies, but are not required to do so. The chief must update requirements for existing annual reporting activities to collect information relating to a state agency’s progress in increasing the internal defenses of agency systems.
3. Specifies the intent of the Legislature that the above-described provisions are timely implemented in compliance with conditions for the receipt of federal funds.

FISCAL EFFECT:

1. General Fund (GF) costs of approximately $1.6 million in the first year and GF costs of approximately $1.2 million annually thereafter to CDT for five staff positions to develop policy and technical standards, help state agencies comply with Zero Trust architecture, and help conduct rapid assessments and validation.
2. Costs of an unknown, but definitely significant, amount across state agencies for new personnel and technical tools needed to implement updated cybersecurity policies.

For its part, the Secretary of State (SOS) estimates costs of approximately $854,000 in the first year and $844,000 annually thereafter to implement Zero Trust architecture and share information with the OIS chief relating to the SOS’s progress in increasing internal defenses of agency systems. Costs include two additional information technology (IT) staff positions and IT operating equipment and expenses. Similarly, the Department of Insurance estimates costs of approximately $946,000 in fiscal year (FY) 2023-24, $1.8 million in FY 2024-25, $2.8 million in FY 2025-26, and $1.7 million annually thereafter. The State Controller’s Office (SCO) also estimates costs of $10,000 per employee to implement Zero Trust architecture. Given the size of the SCO, such costs would total approximately $15 million.

COMMENTS:

1. Purpose. According to the author, cybersecurity standards from certain provisions of President Biden’s Executive Order (EO) 14028 have already been adopted into California law, but it is important to continue to identify and pursue additional elements of the EO and other work being done by federal cybersecurity partners. The author intends this bill to “take an important step towards adoption of Zero Trust principles” by revising state cybersecurity standards and procedures. This bill is supported by the Technology Industry Association of California and BSA, the Software Alliance.
2. Background.

EO 14028. Issued May 12, 2021, EO 14028 set forth a detailed plan of action to strengthen federal cybersecurity on a prescribed timeline. While the EO is in many ways specific to the operations of the federal government, the EO endorses practices that, if applied in California, would also enhance the state’s cybersecurity efforts. Most notably, the EO requires adoption of a “Zero Trust” architecture, which the U.S. Government Accountability Office describes as a “cybersecurity approach that authenticates and authorizes every interaction between a network and a user or device – in contrast to traditional cybersecurity models that allow users or devices to move freely within the network once they are granted access.”

State Cybersecurity Efforts. OIS is a division of CDT charged with ensuring the confidentiality and security of state technology systems. Existing law requires state agencies under the direct control of the Governor (thus, exclusive of constitutional officers and other specified entities) to adhere to the policies and procedures established by OIS. This bill requires all state agencies to adopt certain cybersecurity standards and methodologies outlined in EO 14028, most notably Zero Trust architecture. According to the author, this bill’s requirements align with cybersecurity provisions in the federal Infrastructure, Investment, and Jobs Act (IIJA), and thus position California to draw down more IIJA funds.

1. Prior Legislation. AB 2135 (Irwin), Chapter 773, Statutes of 2022, required state agencies not under direct authority of the Governor to implement specified information security and privacy policies, standards, and procedures and perform a comprehensive independent security assessment every two years.

Analysis Prepared by: Irene Ho / APPR. / (916) 319-2081

Date of Hearing: April 19, 2023

ASSEMBLY COMMITTEE ON ACCOUNTABILITY AND ADMINISTRATIVE REVIEW

Cottie Petrie-Norris, Chair

ABPCA Bill Id:AB 749 (

Author:Irwin) – As Amended Ver:April 13, 2023

SUBJECT: State agencies: information security: uniform standards

DOUBLE REFERRAL: AB 749 (as amended March 14, 2023) was heard March 21, 2023, by the Assembly Committee on Privacy and Consumer Protection and was approved 11-0.

SUMMARY: Requires every state agency to implement Zero Trust architecture by January 1, 2026, including multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices, following uniform technology policies, standards, and procedures developed by the Chief of the Office of Information Security. Specifically, this bill:

1) Makes the following findings and declarations:

a) Recent cyber breaches have had wide-ranging consequences and demand a state-level response.

b) Cyber defense requires greater speed and agility to mitigate cyber threats, limit the impact of data breaches, and better protect the state’s workforce and residents.

c) Cyber attacks not only significantly impact institutions financially, but they also erode public trust and confidence in government.

d) To better defend against cyber threats, the Legislature intends for state agencies to embrace technologies and practices outlined in Executive Order 14028 on Improving the Nation’s Cybersecurity. At a minimum, this includes formalizing Zero Trust as the desired model for security.

e) Zero Trust is a security architecture requiring all users, whether in or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or retaining access to applications and data.

2) Defines the following terms:

a) “Chief” means the Chief of the Office of Information Security within the California Department of Technology (“CDT”).

b) “Endpoint detection and response” means a cybersecurity solution that continuously monitors end-user devices to detect and respond to cyber threats.

c) “Multifactor authentication” means using two or more different types of identification factors to authenticate a user’s identity for the purpose of accessing systems and data.

d) “State agency” means every state office, officer, department, division, bureau, board, and commission, excluding the California State University.

e) “Zero Trust architecture” means a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy that employs continuous monitoring, risk-based access controls, secure identity and access management practices, and system security automation techniques to address the cybersecurity risk from threats inside and outside traditional network boundaries.

3) Requires, by January 1, 2026, every state agency to implement Zero Trust architecture, including the following for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments:

a) Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.

b) Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.

c) Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.

4) Directs state agencies, in implementing Zero Trust architecture, including multifactor authentication, to prioritize the use of solutions that comply with, are authorized by, or align to, applicable federal guidelines, programs, and frameworks, including the Federal Risk and Authorization Management Program, the Continuous Diagnostics and Mitigation Program, and guidance and frameworks from the National Institute of Standards and Technology.

5) Requires, no later than January 1, 2025, the Chief to develop uniform technology policies, standards, and procedures for use by each state agency in implementing Zero Trust architecture, including multifactor authentication, on all systems in the State Administrative Manual and Statewide Information Management Manual.

6) Encourages, but does not mandate, state constitutional officers other than the Governor to use the policies, standards, and procedures developed by the Chief.

7) Requires the Chief to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to collect information relating to a state agency’s progress in increasing the internal defenses of agency systems, including:

a) A description of any steps the state agency has completed, including advancements toward achieving Zero Trust architecture requirements and multifactor authentication.

b) Following an independent security assessment, an identification of activities that have not yet been completed and that would have the most immediate security impact.

c) A schedule to implement any planned activities.

8) Permits the Chief to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to also include information on how a state agency is progressing with respect to the following:

a) Shifting away from trusted networks to implement security controls based on a presumption of compromise.

b) Implementing principles of least privilege in administering information security programs.

c) Limiting the ability of entities that cause cyberattacks to move laterally through or between a state agency’s systems.

d) Identifying cyber threats quickly.

e) Isolating and removing unauthorized entities from state agencies’ systems as quickly as practicable, accounting for cyber threat intelligence or law enforcement purposes.

EXISTING LAW:

1) Establishes CDT in the Government Operations Agency (“GovOps”). (Gov. Code § 11545.)

2) Establishes the Office of Information Security (“OIS”) within CDT to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. (Gov. Code § 11549.)

3) Requires the Chief to establish an information security program with responsibilities including, among others, the creation, updating, maintenance, and issuing of information security and privacy policies, standards, and procedures for state agencies, and of policies, standards, and procedures directing state agencies to effectively manage security and risk for IT, and for mission critical, confidential, sensitive, or personal information. (Gov. Code § 11549.3(a).)

4) Requires state agencies and state entities within the executive branch that are under the direct authority of the Governor to implement the policies and procedures issued by OIS, as specified. (Gov. Code § 11549.3(b).

5) Establishes information security and privacy policies, standards, and procedures for state entities within the executive branch that are not under the direct authority of the Governor. (Gov. Code § 11549.3(f).)

6) Establishes comprehensive information security and privacy policies, standards, and procedures for state agencies, including guidelines for risk management and assessment. (State Administrative Manual § 5300 et seq.)

7) Establishes standards, instructions, forms and templates that state agencies must use to comply with state information technology policy. (State Information Management Manual.)

FISCAL EFFECT: Unknown. This bill has not been analyzed by a fiscal committee.

COMMENTS:

1) Background. The basic problem addressed by this bill is that traditional approaches to cybersecurity fail to address current and emerging threats to government networks. Such traditional approaches include securing the perimeter of a network with one or more firewalls, and requiring a user or device to submit a credential, such as a password, in order to gain access to a network. Once the user or device meets these requirements, that user or device is presumed to be trustworthy and generally need not demonstrate its trustworthiness again while logged into the network. It is well-known that hackers try, and sometimes succeed, in fraudulently meeting these requirements through tactics such as phishing (posing as a trusted individual or entity in order to obtain passwords or other sensitive information). However, it is also disturbingly common for individuals who are in positions of trust, including employees and executives, to use legitimate network access in order to steal and reveal secure information.

In response, this bill proposes to require California state agencies to adopt certain cybersecurity standards and methodologies outlined in President Biden’s Executive Order (“EO”) 14028 on Improving the Nation’s Cybersecurity, (86 Fed. Reg. 26,633 (May 17, 2021), available at https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity.)

Foremost among these standards and methodologies is the adoption of a “Zero Trust” model for California state government’s security architecture. As its name implies, Zero Trust, described in greater detail below, is a “cybersecurity approach that authenticates and authorizes every interaction between a network and a user or device—in contrast to traditional cybersecurity models that allow users or devices to move freely within the network once they are granted access. [Zero Trust architecture] works on the ‘never trust, always verify’ principle and assumes that attacks will come from within and outside of the network.” (United States Government Accountability Office, Science & Tech Spotlight: Zero Trust Architecture (Nov. 18, 2022) GAO23-106065, available at https://www.gao.gov/products/gao-23-106065.)

2) Author’s statement. According to the author:

“The cybersecurity of California’s state agencies is foundational to the smooth and efficient operation of countless critical services. The state has a strong tradition of leveraging the expertise and example of our federal partners in the cybersecurity space to ensure Californians can have the same level of confidence in the security of their data and the dependability of services regardless of which level of government is responsible.

Cybersecurity standards resulting from certain provisions of EO 14028 have already been adopted into California law. It is important to continue to identify and pursue additional elements of this EO and other work being done by [the National Institute of Standards and Technology (NIST)] and [the Cybersecurity and Infrastructure Security Agency (CISA)] to ensure we are continuing to follow cybersecurity best practices. With AB 749, California will take an important step towards adoption of Zero Trust principles, by revising our standards and procedures to reflect them and put them into operation in already mandated processes, assessments, and reports.”

3) Federal Executive Order. President Biden’s Executive Order 14028 on “Improving the Nation’s Cybersecurity.” EO 14028, dated May 12, 2021, opens with the following policy statement:

“The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people’s security and privacy. The Federal Government must improve its efforts to identify, deter, protect against, detect, and respond to these actions and actors. The Federal Government must also carefully examine what occurred during any major cyber incident and apply lessons learned. […]

It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order.” (86 Fed. Reg. 26633.)

The EO goes on to set forth a detailed plan of action to strengthen federal cybersecurity on a prescribed timeline. While the EO is in many ways specific to the operations of the federal government, it endorses practices that, if applied in California, would enhance the state’s cybersecurity. The EO outlines the following steps that this bill would require California state agencies to implement:

• “[D]evelop a plan to implement Zero Trust Architecture.” (86 Fed. Reg. 26636.)

• “[E]mploy all appropriate resources and authorities to maximize the early detection of cybersecurity vulnerabilities and incidents on [government] networks.” (86 Fed. Reg. 26643.)

• “[D]eploy an Endpoint Detection and Response (“EDR”) initiative to support proactive detection of cybersecurity incidents.” (Ibid.)

• Capturing and maintaining “[i]nformation from network and system logs…[which is] invaluable for both investigation and remediation purposes.” (86 Fed. Reg. 26644.)

4) What this bill would do. Under this bill, covered state entities would be required to implement Zero Trust architecture by January 1, 2026, which includes implementing the following:

• “Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.”

Multifactor authentication, at its most basic, means not permitting a user to log in to a network unless they can present more than one form of authentication to prove their identity. It is not sufficient for a user to simply enter their password in order to gain network access. Users will likely be regularly prompted to reauthenticate themselves in order to maintain network access.

• “Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.”

A cybersecurity threat might involve a virus or malware infecting computers on the network. But it might also take the form of a trusted employee accessing files they do not ordinarily access, or downloading terabytes of data to a USB drive, in either case to purloin confidential or sensitive information. The phrase “enterprise endpoint detection and response” means continuously monitoring users’ devices. The phrase “real-time detection of cybersecurity threats” means identifying such threats while they are occurring, rather than—as often occurs now—after the network has been hacked, when it is too late to prevent or mitigate the problem. In other words, this provision of the bill would require state agencies to use technologies to continuously monitor users’ behavior and activity within their networks in order to rapidly (and ideally, immediately) identify threats as they occur.

• “Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.”

“Logging” means maintaining records of relevant activity in the network. This provision is meant to ensure that in the event of a successful cyberattack, there is sufficient, adequate information available to perform a forensic analysis meant to prevent a similar attack from occurring again.

In order to implement these requirements, the bill would require the Chief to update policies, standards, and procedures in the State Administrative Manual (“SAM”) and Statewide Information Management Manual (“SIMM”) to use in implementing Zero Trust architecture. State entities covered by the SAM and SIMM would have to include progress towards Zero Trust in their annual reporting, and the OIS would be free to update reporting requirements as necessary.

Entities deemed “constitutional officers”—i.e., those executive branch officers provided for under the California Constitution that are not under the direct authority of the Governor— including the Lieutenant Governor, Attorney General, Controller, Insurance Commissioner, Public Utilities Commission, Secretary of State, Superintendent of Public Instruction, Treasurer, the State Board of Equalization, and the State Auditor, are not required to comply with the policies, standards, and procedures in the SAM and SIMM. Accordingly, this bill would provide these entities the option of using the updated policies, standards, and procedures therein.

5) Analysis of the need for this bill. In 2021, the Newsom Administration, through the California Department of Technology, published Cal-SECURE: State of California Executive Branch Multi-Year Information Security Maturity Roadmap (“Cal-SECURE”), which can be found at https://cdt.ca.gov/wp-content/uploads/2021/10/Cybersecurity_Strategy_Plan_FINAL.pdf. Cal-SECURE charts out a phased order of priority for cybersecurity capabilities, which includes many operational elements of Zero Trust architecture, including “privileged access management,” “multifactor authentication,” “mobile device management,” “identity lifecycle management,” “network threat detection,” and “log management.” (Cal-SECURE 7.) However, unlike EO 14028, Cal-SECURE does not provide a specific timeline for implementing these elements.

This bill would provide a definite timeline and steps to be taken in implementing Zero Trust architecture at state agencies. This is critical. Cybersecurity threats are present and growing. It is inadvisable to postpone adopting security measures that both the Biden and Newsom Administrations have recognized the importance of. Moreover, this bill would make clear the importance of Zero Trust to constitutional officers and potentially encourage the architecture’s adoption by those entities.

In addition, as the author notes, cost-benefit analysis likely favors this bill’s adoption:

“Implementing multi-factor authentication, endpoint detection, and increasing logging practice would have associated costs, but would not prevent or significantly modify an agency’s workflow. These capabilities would likely pay for themselves in avoided costs related to a potential breach or shutdown of an agency’s systems.”

Cybersecurity is ultimately not an abstract issue. The state operates critical computer systems related to public health (Covered California, MediCal), food assistance (CalFresh), labor and workforce development (unemployment insurance, workers’ compensation), occupational licensing, and so forth. If these systems were disabled or malfunctioned due to a cyber attack, millions of vulnerable Californians and their families could be harmed.

6) Alignment to draw federal funds. According to the author, the Zero Trust architecture this bill would require aligns with cybersecurity provisions in the federal Infrastructure, Investment, and Jobs Act (“IIJA”) and therefore will help position California to draw federal IIJA funds. Among the many IIJA programs is the State and Local Cybersecurity Grant Program (“SLCGP”), which requires each state to establish a cybersecurity committee and submit a cybersecurity plan, which currently is due September 30, 2023. California has already received about $8 million in SLCGP planning funds. The California Office of Emergency Services (“CalOES”) is leading coordination of the planning committee. States will be required to demonstrate progress in implementing the plan for future rounds of funding. Moreover, other IIJA programs, such as funding for broadband infrastructure, include cybersecurity compliance elements.^[1]

Recent amendments to this bill moved the date for the Chief to issue guidelines for Zero Trust architecture to January 1, 2025, and the date for state agencies to implement Zero Trust architecture to January 1, 2026. It is unclear if these dates are adequately aligned with individual IIJA program expenditure deadlines. For example, will these dates ensure compliance with cybersecurity provisions in IIJA broadband programs that require states to encumber funds by December 31, 2024, and spend them by December 31, 2026?

This bill would require state agencies, in implementing Zero Trust architecture, to “prioritize the use of solutions that comply with, are authorized by, or align to applicable federal guidelines, programs, and frameworks, including the Federal Risk and Authorization Management Program, the Continuous Diagnostics and Mitigation Program, and guidance and frameworks from the National Institute of Standards and Technology.” It is unclear if this directive will ensure California is in compliance with cybersecurity elements of various IIJA programs, especially when each IIJA program has a Notice of Funding Opportunity and related conditions for funding that could still evolve.

Thus, both timing and substance of California’s implementation of Zero Trust architecture could impact the state’s ability to draw potentially billions of dollars in IIJA funds. Adequate flexibility in state statute to meet federal requirements is critical. Especially in times of budget deficits, it is good policy to position the state to maximize all federal funding opportunities. Accordingly, the committee may wish to consider amending the bill to express legislative intent that the state implement this bill in a manner that ensures timely compliance with requirements for federal funding, including, but not limited to, IIJA funding.

ARGUMENTS IN SUPPORT:

BSA, the Software Alliance, an advocate for the global software industry, states: “We strongly encourage policymakers to support increased investment in modern IT infrastructure and cybersecurity, for example, by implementing zero trust architecture and using state-of-the-art identity, credentialing, and access management, which AB 749 proposes. Organizations, including governments, should expect these investments to grow as they continue their digital transformations, and thus are able to deliver better, more secure services to citizens and customers. This can be achieved by using commercial-off-the-shelf (COTS) solutions by enterprise technology companies who continuously update their solutions to improve both security and functionality.”

RELATED LEGISLATION

AB 2135 (Irwin, Chap. 773, Stats. 2022) required state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, requires those agencies to perform a comprehensive independent security assessment every two years, as specified.

AB 2564 (Chau, 2020) would have stated the Legislature’s intent to enact legislation to improve the security of information technology systems and connected devices by requiring public agencies and businesses to develop security vulnerability disclosure policies. The bill died without being referred to Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

BSA the Software Alliance
Technology Industry Association of California

Opposition

None received

Analysis Prepared by: Jacqueline Kinney / A. & A.R. / (916) 319-3600

1. See, for example, the Notice of Funding Opportunity for the IIJA Broadband Equity, Access and Deployment program, available at BEAD NOFO.pdf (doc.gov) (at 70-71). ↑

Date of Hearing: March 21, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 749 (

Author:Irwin) – As Amended Ver:March 14, 2023

SUBJECT: State agencies: information security: uniform standards

SYNOPSIS

This author-sponsored measure would require California state agencies under the direct authority of the Governor to adopt certain cybersecurity standards and methodologies outlined in President Biden’s Executive Order (EO) 14028 on Improving the Nation’s Cybersecurity. In particular, it would require adoption of a “Zero Trust” model for the state’s information technology security architecture. As its name implies, Zero Trust is a cybersecurity approach that authenticates and authorizes every interaction between a network and a user or device, on the “never trust, always verify” principle.

This bill would provide a specific timeline and steps to be taken in implementing Zero Trust architecture at covered state agencies. Given the ever-growing danger of cyberattacks from both recognized threats, such as hackers, as well as unrecognized threats, such as trusted employees, adoption of Zero Trust will help ensure that state computer systems relied upon by millions of Californians will remain operational.

If passed by this Committee, this bill will next be heard by the Assembly Accountability and Administrative Review Committee.

SUMMARY: Requires every state agency to implement Zero Trust architecture by January 1, 2025, including multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices, following uniform technology policies, standards, and procedures developed by the Chief of the Office of Information Security. Specifically, this bill:

1. Makes the following findings and declarations:
2. Recent cyber breaches have had wide-ranging consequences and demand a state-level response.
3. Cyber defense requires greater speed and agility to mitigate cyber threats, limit the impact of data breaches, and better protect the state’s workforce and residents.
4. Cyber attacks not only significantly impact institutions financially, but they also erode public trust and confidence in government.
5. To better defend against cyber threats, the Legislature intends for state agencies to embrace technologies and practices outlined in Executive Order 14028 on Improving the Nation’s Cybersecurity. At a minimum, this includes formalizing Zero Trust as the desired model for security.
6. Zero Trust is a security architecture requiring all users, whether in or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or retaining access to applications and data.
7. Defines the following terms:
   1. “Chief” means the Chief of the Office of Information Security.
   2. “Endpoint detection and response” means a cybersecurity solution that continuously monitors end-user devices to detect and respond to cyber threats.
   3. “Multifactor authentication” means using two or more different types of identification factors to authenticate a user’s identity for the purpose of accessing systems and data.
   4. “State agency” means every state office, officer, department, division, bureau, board, and commission, excluding the California State University.
   5. “Zero Trust architecture” means a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy that employs continuous monitoring, risk-based access controls, secure identity and access management practices, and system security automation techniques to address the cybersecurity risk from threats inside and outside traditional network boundaries.
8. Requires, by January 1, 2025, every state agency to implement Zero Trust architecture, including the following for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments:
   1. Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.
   2. Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.
   3. Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.
9. Directs state agencies, in implementing Zero Trust architecture, including multifactor authentication, to prioritize the use of solutions that comply with, are authorized by, or align to, applicable federal guidelines, programs, and frameworks, including the Federal Risk and Authorization Management Program, the Continuous Diagnostics and Mitigation Program, and guidance and frameworks from the National Institute of Standards and Technology.
10. Requires, no later than January 1, 2024, the Chief to develop uniform technology policies, standards, and procedures for use by each state agency in implementing Zero Trust architecture, including multifactor authentication, on all systems in the State Administrative Manual and Statewide Information Management Manual.
11. Encourages, but does not mandate, state constitutional officers other than the Governor to use the policies, standards, and procedures developed by the Chief.
12. Requires the Chief to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to collect information relating to a state agency’s progress in increasing the internal defenses of agency systems, including:
    1. A description of any steps the state agency has completed, including advancements toward achieving Zero Trust architecture requirements and multifactor authentication.
    2. Following an independent security assessment, an identification of activities that have not yet been completed and that would have the most immediate security impact.
    3. A schedule to implement any planned activities.
13. Permits the Chief to update requirements for existing annual reporting activities, including standards for audits and independent security assessments, to also include information on how a state agency is progressing with respect to the following:
    1. Shifting away from trusted networks to implement security controls based on a presumption of compromise.
    2. Implementing principles of least privilege in administering information security programs.
    3. Limiting the ability of entities that cause cyberattacks to move laterally through or between a state agency’s systems.
    4. Identifying cyber threats quickly.
    5. Isolating and removing unauthorized entities from state agencies’ systems as quickly as practicable, accounting for cyber threat intelligence or law enforcement purposes.

EXISTING LAW:

1. Establishes CDT in the Government Operations Agency (GovOps). (Gov. Code § 11545.)
2. Establishes the Office of Information Security (OIS) within CDT to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. (Gov. Code § 11549.)
3. Requires the Chief of OIS to establish an information security program with responsibilities including, among others, the creation, updating, maintenance, and issuing of information security and privacy policies, standards, and procedures for state agencies, and of policies, standards, and procedures directing state agencies to effectively manage security and risk for IT, and for mission critical, confidential, sensitive, or personal information. (Gov. Code § 11549.3(a).)
4. Requires state agencies and state entities within the executive branch that are under the direct authority of the Governor to implement the policies and procedures issued by OIS, as specified. (Gov. Code § 11549.3(b).)
5. Establishes information security and privacy policies, standards, and procedures for state entities within the executive branch that are not under the direct authority of the Governor. (Gov. Code § 11549.3(f).)
6. Establishes comprehensive information security and privacy policies, standards, and procedures for state agencies, including guidelines for risk management and assessment. (State Administrative Manual § 5300 et seq.)
7. Establishes standards, instructions, forms and templates that state agencies must use to comply with state information technology policy. (State Information Management Manual.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Background. The basic problem addressed by this bill is that traditional approaches to cybersecurity fail to address current and emerging threats to government networks. Such traditional approaches include securing the perimeter of a network with one or more firewalls, and requiring a user or device to submit a credential, such as a password, in order to gain access to a network. Once the user or device meets these requirements, that user or device is presumed to be trustworthy and generally need not demonstrate its trustworthiness again while logged into the network. It is well-known that hackers try, and sometimes succeed, in fraudulently meeting these requirements through tactics such as phishing (posing as a trusted individual or entity in order to obtain passwords or other sensitive information). However, it is also disturbingly common for individuals who are in positions of trust, including employees and executives, to use legitimate network access in order to steal and reveal secure information.

In response, this bill proposes to require California state agencies to adopt certain cybersecurity standards and methodologies outlined in President Biden’s Executive Order (EO) 14028 on Improving the Nation’s Cybersecurity, (86 Fed. Reg. 26,633 (May 17, 2021), available at https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity.)

Foremost among these standards and methodologies is the adoption of a “Zero Trust” model for California state government’s security architecture. As its name implies, Zero Trust, described in greater detail below, is a “cybersecurity approach that authenticates and authorizes every interaction between a network and a user or device—in contrast to traditional cybersecurity models that allow users or devices to move freely within the network once they are granted access. [Zero Trust architecture] works on the ‘never trust, always verify’ principle and assumes that attacks will come from within and outside of the network.” (United States Government Accountability Office, Science & Tech Spotlight: Zero Trust Architecture (Nov. 18, 2022) GAO-23-106065, available at https://www.gao.gov/products/gao-23-106065.)

2) Author’s statement. According to the author:

The cybersecurity of California’s state agencies is foundational to the smooth and efficient operation of countless critical services. The state has a strong tradition of leveraging the expertise and example of our federal partners in the cybersecurity space to ensure Californians can have the same level of confidence in the security of their data and the dependability of services regardless of which level of government is responsible. Cybersecurity standards resulting from certain provisions of EO 14028 have already been adopted into California law. It is important to continue to identify and pursue additional elements of this EO and other work being done by [the National Institute of Standards and Technology (NIST)] and [the Cybersecurity and Infrastructure Security Agency (CISA)] to ensure we are continuing to follow cybersecurity best practices. With AB 749, California will take an important step towards adoption of Zero Trust principles, by revising our standards and procedures to reflect them and put them into operation in already mandated processes, assessments, and reports.

3) President Biden’s Executive Order 14028 on “Improving the Nation’s Cybersecurity.” EO 14028, dated May 12, 2021, opens with the following policy statement:

The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people’s security and privacy. The Federal Government must improve its efforts to identify, deter, protect against, detect, and respond to these actions and actors. The Federal Government must also carefully examine what occurred during any major cyber incident and apply lessons learned. […]

It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order. (86 Fed. Reg. 26633.)

The EO goes on to set forth a detailed plan of action to strengthen federal cybersecurity on a prescribed timeline. While the EO is in many ways specific to the operations of the federal government, it endorses practices that, if applied in California, would enhance the state’s cybersecurity. The EO outlines the following steps that this bill would require California state agencies to implement:

• “[D]evelop a plan to implement Zero Trust Architecture.” (86 Fed. Reg. 26636.)
• “[E]mploy all appropriate resources and authorities to maximize the early detection of cybersecurity vulnerabilities and incidents on [government] networks.” (86 Fed. Reg. 26643.)
• “[D]eploy an Endpoint Detection and Response (EDR) initiative to support proactive detection of cybersecurity incidents.” (Ibid.)
• Capturing and maintaining “[i]nformation from network and system logs…[which is] invaluable for both investigation and remediation purposes.” (86 Fed. Reg. 26644.)

4) What this bill would do. Under this bill, covered state entities would be required to implement Zero Trust architecture by January 1, 2025, which includes implementing the following:

• “Multifactor authentication for access to all systems and data owned, managed, maintained, or utilized by or on behalf of the state agency.”

Multifactor authentication, at its most basic, means not permitting a user to log in to a network unless they can present more than one form of authentication to prove their identity. It is not sufficient for a user to simply enter their password in order to gain network access. Users will likely be regularly prompted to reauthenticate themselves in order to maintain network access.

• “Enterprise endpoint detection and response solutions to promote real-time detection of cybersecurity threats and rapid investigation and remediation capabilities.”

A cybersecurity threat might involve a virus or malware infecting computers on the network. But it might also take the form of a trusted employee accessing files they do not ordinarily access, or downloading terabytes of data to a USB drive, in either case to purloin confidential or sensitive information. The phrase “enterprise endpoint detection and response” means continuously monitoring users’ devices. The phrase “real-time detection of cybersecurity threats” means identifying such threats while they are occurring, rather than—as often occurs now—after the network has been hacked, when it is too late to prevent or mitigate the problem. In other words, this provision of the bill would require state agencies to use technologies to continuously monitor users’ behavior and activity within their networks in order to rapidly (and ideally, immediately) identify threats as they occur.

• “Robust logging practices to provide adequate data to support security investigations and proactive threat hunting.”

“Logging” means maintaining records of relevant activity in the network. This provision is meant to ensure that in the event of a successful cyberattack, there is sufficient, adequate information available to perform a forensic analysis meant to prevent a similar attack from occurring again.

In order to implement these requirements, the bill would require the state Office of Information Security (OIS) to update policies, standards, and procedures in the State Administrative Manual (SAM) and Statewide Information Management Manual (SIMM) to use in implementing Zero Trust architecture. State entities covered by the SAM and SIMM would have to include progress towards Zero Trust in their annual reporting, and the OIS would be free to update reporting requirements as necessary.

Entities deemed “constitutional officers”—i.e., those executive branch officers provided for under the California Constitution that are not under the direct authority of the Governor—including the Lieutenant Governor, Attorney General, Controller, Insurance Commissioner, Public Utilities Commission, Secretary of State, Superintendent of Public Instruction, Treasurer, the State Board of Equalization, and the State Auditor, are not required to comply with the policies, standards, and procedures in the SAM and SIMM. Accordingly, this bill would provide these entities the option of using the updated policies, standards, and procedures therein.

5) Analysis of the need for this bill. In 2021, the Newsom Administration, through the California Department of Technology, published Cal-SECURE: State of California Executive Branch Multi-Year Information Security Maturity Roadmap (Cal-SECURE), which can be found at https://cdt.ca.gov/wp-content/uploads/2021/10/Cybersecurity_Strategy_Plan_FINAL.pdf.

Cal-SECURE charts out a phased order of priority for cybersecurity capabilities, which includes many operational elements of Zero Trust architecture, including “privileged access management,” “multifactor authentication,” “mobile device management,” “identity lifecycle management,” “network threat detection,” and “log management.” (Cal-SECURE 7.) However, unlike EO 14028, Cal-SECURE does not provide a specific timeline for implementing these elements.

This bill would provide a definite timeline and steps to be taken in implementing Zero Trust architecture at state agencies. This is critical. Cybersecurity threats are present and growing. It is inadvisable to postpone adopting security measures that both the Biden and Newsom Administrations have recognized the importance of. Moreover, this bill would make clear the importance of Zero Trust to constitutional officers and potentially encourage the architecture’s adoption by those entities.

As the bill’s author notes, cost-benefit analysis likely favors this bill’s adoption:

Implementing multi-factor authentication, endpoint detection, and increasing logging practice would have associated costs, but would not prevent or significantly modify an agency’s workflow. These capabilities would likely pay for themselves in avoided costs related to a potential breach or shutdown of an agency’s systems.

Cybersecurity is ultimately not an abstract issue. The state operates critical computer systems related to public health (Covered California, MediCal), food assistance (CalFresh), labor and workforce development (unemployment insurance, workers’ compensation), occupational licensing, and so forth. If these systems were disabled or malfunctioned due to a cyber attack, millions of vulnerable Californians and their families could be harmed.

6) Related legislation: AB 2135 (Irwin, Chap. 773, Stats. 2022) required state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, requires those agencies to perform a comprehensive independent security assessment every two years, as specified.

AB 2564 (Chau, 2020) would have stated the Legislature’s intent to enact legislation to improve the security of information technology systems and connected devices by requiring public agencies and businesses to develop security vulnerability disclosure policies. The bill died without being referred to Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200