Existing law, the California Emergency Services Act, among other things, creates the Office of Emergency Services (Cal OES), which is responsible for the states emergency and disaster response services, as specified. Existing law requires Cal OES to establish the California Cybersecurity Integration Center (Cal-CSIC) with the primary mission of reducing the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. Existing law requires Cal OES to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature on or before January 1, 2024, a strategic, multiyear outreach plan to assist the food and agriculture sector and wastewater sector in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, those sectors in their efforts to improve security preparedness.

This bill would require Cal OES to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature on or before January 1, 2025, a strategic, multiyear outreach plan to assist critical infrastructure sectors, as defined, in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, that sector in their efforts to improve cybersecurity preparedness. The bill would make related findings and declarations.

Existing law, the California Emergency Services Act, among other things, creates the Office of Emergency Services (Cal OES), which is responsible for the states emergency and disaster response services, as specified. Existing law requires Cal OES to establish the California Cybersecurity Integration Center (Cal-CSIC) with the primary mission of reducing the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. Existing law requires Cal-CSIC to provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure information networks, enable cross-sector coordination and sharing of best practices and security measures, and support certain cybersecurity assessments, audits, and accountability programs. Existing law also requires Cal-CSIC to develop a statewide cybersecurity strategy to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers, and to strengthen cyber emergency preparedness and response and expand cybersecurity awareness and public education. Cal OES to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature on or before January 1, 2024, a strategic, multiyear outreach plan to assist the food and agriculture sector and wastewater sector in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, those sectors in their efforts to improve security preparedness.

This bill would require Cal OES to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature on or before January 1, 2025, a strategic, multiyear outreach plan to assist critical infrastructure sectors, as defined, in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, that sector in their efforts to improve cybersecurity preparedness. The bill would make related findings and declarations.

Existing law, the California Emergency Services Act, among other things, creates the Office of Emergency Services (Cal OES), which is responsible for the states emergency and disaster response services, as specified. Existing law requires Cal OES to establish the California Cybersecurity Integration Center (Cal-CSIC) with the primary mission of reducing the likelihood and severity of cyber incidents that could damage Californias economy, its critical infrastructure, or public and private sector computer networks in the state. Existing law requires Cal-CSIC to provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure information networks, enable cross-sector coordination and sharing of best practices and security measures, and support certain cybersecurity assessments, audits, and accountability programs. Existing law also requires Cal-CSIC to develop a statewide cybersecurity strategy to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers, and to strengthen cyber emergency preparedness and response and expand cybersecurity awareness and public education.

This bill would require Cal OES to direct Cal-CSIC to prepare, and Cal OES to submit to the Legislature on or before January 1, 2025, a strategic, multiyear outreach plan to assist critical infrastructure sectors, as defined, in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, that sector in their efforts to improve cybersecurity preparedness. The bill would make related findings and declarations.

Date of Hearing: July 2, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

SBPCA Bill Id:SB 265

Author:(Hurtado) – As Amended Ver:June 19, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires the Office of Emergency Services (OES) to direct the California Cybersecurity Integration Center (Cal-CSIC) to prepare and submit, by January 1, 2025, specified cybersecurity reports regarding the state’s critical infrastructure sectors to the Legislature.

Specifically, this bill defines “critical infrastructure sectors” to mean those defined as such by the United States Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), including the energy sector, health care and public health sector, transportation systems sector, and 13 other sectors. The two required reports are:

1. A strategic, multi-year outreach plan to assist each of the state’s critical infrastructure sectors in their efforts to improve cybersecurity.
2. An evaluation of options to provide entities in critical infrastructure sectors with grants or alternative forms of funding to improve cybersecurity preparedness.

FISCAL EFFECT:

1. Annual costs ranging from approximately $2.1 million to $5.8 million to OES for three to seven staff positions and a consulting contract to develop the outreach plan, evaluate funding options, and prepare the required reports (General Fund (GF)).

Cal-CSIC is additionally comprised of representatives from the Department of Technology (CDT), California Military Department (CMD), California Highway Patrol (CHP), other state agencies, and non-state entities. For its part, CDT estimates annual costs of $686,000 in the first two fiscal years for three limited-term staff positions (GF), CMD reports one-time costs of approximately $215,000 for one limited-term staff position (GF), and CHP anticipates negligible costs.

1. Cost pressures of an unknown, but likely significant, amount to provide grants or alternative forms of funding identified by the evaluation to improve cybersecurity preparedness (GF).

According to the Legislative Analyst’s Office, the GF faces a structural deficit in the tens of billions of dollars over the next several fiscal years.

COMMENTS:

1. Purpose. According to the author:

Additional research has shown an increase in the number of cyberattacks targeting critical infrastructure sectors. These cyberattacks are predominantly comprised of phishing attempts and ransomware scams, which seek data and personal identifying information. This lack of preparedness threatens California’s economy and the livelihood of those who rely on these sectors.

This bill is supported by various local government entities and regional organizations.

1. Background.

Cal-CSIC. Under the umbrella of OES, Cal-CSIC serves as the central organizing hub of state government’s cybersecurity activities and coordinates information sharing among stakeholders, including local, state, and federal agencies; tribal governments; utilities and other service providers; academic institutions; and nongovernmental organizations. Cal-CSIC is co-located at the California State Threat Assessment Center, with the primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, critical infrastructure, or public and private sector computer networks.

Recent Federal and State Cybersecurity Efforts. The federal State and Local Cybersecurity Improvement Act (Cybersecurity Act) included in the $1.2 trillion Infrastructure Investment and Jobs Act bill package signed by President Biden in November 2021 authorized a new $1 billion grant program to improve cybersecurity at the state, territorial, local, and tribal level, allocated over four years by the Federal Emergency Management Agency. The state must first submit a cybersecurity plan to be eligible for funding and distribute 80% of awarded funds to local governments. Awardees must generally match a percentage of funds, with the match percentage growing gradually each year.

SB 892 (Hurtado), Chapter 820, Statutes of 2022, required OES to direct Cal-CSIC to prepare two reports: (a) a strategic, multi-year outreach plan to assist the food and agriculture sector and water and wastewater sector in their efforts to improve cybersecurity, and (b) an evaluation of options to provide entities in the food and agriculture sector or water and wastewater sector with grants or alternative forms of funding to improve cybersecurity preparedness. The food and agriculture sector and water and wastewater sector are two of 16 “critical infrastructure sectors” identified by CISA to have assets, systems, and networks that, if incapacitated or destroyed, would cause a debilitating effect on national security, economic security, or public health or safety. This bill requires OES to direct Cal-CSIC to prepare two more reports, similar to those required by SB 892, but inclusive of all 16 critical infrastructure sectors and with three additional reporting provisions.

1. Prior Legislation. SB 844 (Min), Chapter 505, Statutes of 2022, required Cal-CSIC to create four reports to the Legislature for fiscal years 2021-22, 2022-23, 2023-24 and 2024-25 describing all expenditures made by the state pursuant to the federal Cybersecurity Act.

Analysis Prepared by: Irene Ho / APPR. / (916) 319-2081

Date of Hearing: July 10, 2023

ASSEMBLY COMMITTEE ON EMERGENCY MANAGEMENT

Freddie Rodriguez, Chair

SBPCA Bill Id:SB 265

Author:(Hurtado) – As Amended Ver:June 19, 2023

SENATE VOTE: 40-0

SUBJECT: Cybersecurity preparedness: critical infrastructure sectors

SUMMARY: This bill directs the California Cybersecurity Integration Center (Cal-CSIC) to assist each critical infrastructure sector in California by preparing an outreach plan to help improve their cybersecurity measures and by evaluating funding options or actions that do not require funds that improves their cybersecurity preparedness. Specifically, this bill:

1. Directs Cal-CSIC to prepare a strategic, multiyear outreach plan that will help each of the state’s critical infrastructure sectors improve their cybersecurity, which includes but is not limited to:
   1. A description of the need for greater cybersecurity outreach and assistance to critical infrastructure sectors
   2. A description of workforce gaps and suggestions to increase the cybersecurity workforce in critical infrastructure sectors
   3. The outreach plan’s goal
   4. Methods for coordinating with stakeholders, as specified,
   5. The estimated cost of implementing the plan
   6. Potential funding sources, and
   7. A plan that can quantifiably evaluate the success of the outreach plan.
   8. An evaluation plan on methods for initial scoping, risk identification and analysis, and best documentation practices
2. Requires the California Governor’s Office of Emergency Services (Cal OES) to submit the completed outreach plan to the legislature by January 1, 2025
3. Directs Cal-CSIC to evaluate options for providing critical infrastructure sectors with funds, as specified, to improve cybersecurity preparedness.
4. Requires Cal OES to submit the funding evaluation to the legislature in a report by January 1, 2025. The report must include, but it not limited to:
   1. A summary of Cal -CSIC’s funding evaluation
   2. The grants or other funding opportunities, as specified, and
   3. Voluntary actions that do not require funds but will improve cybersecurity preparedness
   4. The benefit of routinely observing data security breaches within the Office of the Attorney General.
5. Defines critical infrastructure sectors, as specified, and makes other findings and declarations.

EXISTING LAW:

1. Establishes the California Office of Emergency Services (Cal OES) within the office of the Governor and makes Cal OES responsible for the state’s emergency and disaster response services for natural, technological, or manmade disasters and emergencies. (Government (Gov.) Code 8550)
2. Authorizes the Governor to proclaim a state of emergency and local officials and local governments to proclaim a local emergency when specified conditions of disaster or extreme peril to the safety of persons and property exist, and authorizes the Governor or the appropriate local government to exercise certain powers in response to that emergency. (Gov. Code 8558)
3. Establishes Cal-CSIC within Cal OES to, among other things, reduce the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or computer networks in the state; serve as the central organizing hub of state government’s cybersecurity activities; and to coordinate information sharing with relevant stakeholders. (Gov. Code 8586.5)
4. Requires Cal-CSIC to create an annual report for four years on all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act. (Gov. Code 8586.5)
5. Directs Cal-CSIC to prepare a strategic, multiyear outreach plan that focuses on ways to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity (Gov. Code 8592.50)

FISCAL EFFECT: According to the Senate Committee on Appropriations, “Total one-time cost of approximately $1.057 million to develop the plan, evaluate funding options, and submit the specified report and evaluation to the Legislature (General Fund):

• OES reports costs of approximately $850,000 for three limited-term staff.
• The California Military Department reports costs of approximately $207,000 for one limited-term staff.”

COMMENTS:

Bill Purpose: According to the author, “Cybersecurity is an issue that continues to rise in prevalence and any attack on our critical infrastructure sectors threaten our national and human security. Additional research has shown an increase in the number of cyberattacks targeting critical infrastructure sectors. These cyberattacks are predominantly comprised of phishing attempts and ransomware scams, which seek data and personal identifying information. This lack of preparedness threatens California’s economy and the livelihood of those who rely on these sectors. Unless at-risk companies and systems begin to prioritize their cybersecurity, any cyber threats they face will have the potential to harm not only California’s economy, but also the well-being of individual Californians.”

The author continues, “We need to ensure California is proactive and making a conscious effort to strengthen cyber defenses across all critical infrastructure sectors, including but not limited to, California’s emergency services sector, education sector, energy sector and financial services sector. These concerns highlight the need of SB 265. SB 265 expands on previous work by requiring Cal-OES and Cal-CSIC to develop cybersecurity preparedness plans for California’s critical infrastructure sectors. The plans must include a strategic, multiyear outreach strategy focusing on methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources in the critical infrastructure sector, as well as plans outlining the funding options necessary to achieve this outreach.”

Equity Impact: According to the author’s staff, “As society and industry embrace cutting-edge technology and advanced software solutions, the absence of robust cybersecurity measures exposes vulnerable targets to emerging and ever-changing cyber threats. Unfortunately, several critical infrastructure sectors in California are susceptible to such risks due to insufficient funding, hindering their acquisition of sophisticated technology. Moreover, rural communities within these sectors often lack the necessary expertise and personnel to effectively fortify themselves against attacks, rendering them even more susceptible. This limited access to resources and cybersecurity professionals impedes their ability to provide essential services to our communities without the constant apprehension of breaches or severe cyber incidents.

Significantly serving disadvantaged communities, particularly those situated in California's rural regions, critical infrastructure sectors bear substantial responsibility. By prioritizing cybersecurity and recognizing its paramount importance to California's critical infrastructure, the introduction of SB 265 represents a crucial step towards enhancing cybersecurity preparedness. Ultimately, this legislation will foster greater reliance on these critical infrastructure sectors, which significantly contribute to the daily lives of our communities, leading to a more secure and resilient future.”

California Emergency Services Act: The California Emergency Services Act (ESA) was enacted in 1970, and established Cal OES within the Governor’s Office. The ESA gives the Governor authority to proclaim a state of emergency in an area affected or likely to be affected when: conditions of disaster or extreme peril exist; the Governor is requested to do so upon request from a designated local government official; or the Governor finds that local authority is inadequate to cope with the emergency. Local governments may also issue local emergency proclamations, which is a prerequisite for requesting the Governor’s Proclamation of a State of Emergency.

Emergency Preparedness and Response: Cal OES is responsible for addressing natural, technological, or manmade disasters and emergencies, and preparing the state to prevent, respond to, quickly recover from, and mitigate the effects of both intentional and natural disasters. As part of its overall preparedness mission, Cal OES is required to develop a State Emergency Plan (SEP), State Hazard Mitigation Plan (SHMP), and maintains the Standardized Emergency Management System (SEMS) and the Emergency Management Mutual Aid System (EMMA). Cal OES, in coordination with FEMA and local partners, has developed four Catastrophic Plans to augment the State Emergency Plan.

California Cybersecurity Integration Center: In 2015, a Governor Brown Executive Order created the Cal-CSIC, and in 2018, Cal-CSIC was established in statute by AB 2813 (Irwin, Chapter 768, Statutes of 2018).  

Under the umbrella of Cal OES, Cal-CSIC serves as the central organizing hub of state government’s cybersecurity activities and coordinates information sharing among stakeholders that include local, state, and federal agencies, tribal governments, utilities and other service providers, academic institutions, and nongovernmental organizations. It is co-located at the California State Threat Assessment Center with the primary mission to reduce the likelihood and severity of cyber incidents that could damage California’s economy, critical infrastructure, or public and private sector computer networks.

To foster statutorily mandated coordination, Cal-CSIC is required to have representatives from the Office of Emergency Services, the Office of Information Security in the Department of Technology, the State Threat Assessment Center, the Department of the California Highway Patrol, the Military Department, the Office of the Attorney General, the California Health and Human Services Agency, and more. Cal-CSIC coordinates directly with the California State Threat Assessment Center and the United States Department of Homeland Security.

Cal-CSIC is also tasked with developing a statewide cybersecurity strategy, in accordance with state and federal standards, to improve how cyber threats are identified, understood, and shared in order to reduce threats to the California government, businesses, and consumers; providing warnings of cyberattacks to government agencies and nongovernmental partners; establishing a cyber-incident response team; safeguarding the privacy of individual’s sensitive information; assessing risks to critical infrastructure and information technology networks; supporting cybersecurity assessments, audits, and accountability programs; and collecting and sharing cyber threat information with relevant parties. 

Cyber Attacks and Threats to California: In 2020, there were 126 cyber related incidents reported by Cal-CSIC. In 2021, this number more than tripled to 460 incidents. They report a significant number are ransomware attacks, which cost an average of $1.85 million per incident.

This year alone, several cyberattacks occurred throughout the state. In May 2023, the San Bernardino Sheriff’s Department paid $1.1 million to hackers that infiltrated their system and stalled their emergency operations. In February 2023, the City of Oakland declared an emergency due to a ransomware attack against city government networks, infrastructure and communications systems. This attack resulted in the massive release of sensitive data to the dark web. In January 2023, the Bay Area Rapid Transit System (BART) Police Department’s systems were compromised and over 120,000 files were posted to the dark web.

Other recent entities to experience cyberattacks include the California Department of Finance in December 2022 and the Los Angeles Unified School District in September 2022, where bad actors posted at least 2000 student records, which included sensitive information, to the dark web.

State and Local Cybersecurity Improvement Act: By November 2021, Congress passed, and President Biden signed the $1 trillion Infrastructure Investment and Jobs Act bill package, which included the State and Local Cybersecurity Improvement Act. The State and Local Cybersecurity Improvement Act authorized a new $1 billion grant program to improve cybersecurity at the state, territorial, local, and tribal levels. Administered by the Federal Emergency Management Agency (FEMA), the $1 billion will be allocated over four years:

$200 million in FY 2022,

$400 million in FY 2023,

$300 million in FY 2024, and

$100 million in FY 2025.

With specific exceptions, awardees must match a percentage of funds, and the funding match percentages gradually increase each year. At a minimum, states must distribute 80 percent of awarded funds to local governments, with 25 percent designated to rural areas. Furthermore, this act requires states and tribes to submit a cybersecurity plan, which outlines how the state or tribe will improve its cybersecurity, to the Cybersecurity and Infrastructure Security Agency (CISA).

Critical Infrastructure: The federal Cybersecurity and Infrastructure Security Agency (CISA) identified 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, that, if incapacitated or destroyed, would cause a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

1. Chemical Sector
   1. This sector is responsible for the manufacturing, storage, use, and transportation of potentially dangerous chemicals on which other critical infrastructure sectors rely.
2. Commercial Facilities Sector
   1. The Commercial Facilities Sector includes public sites that can attract large groups of people, such as shopping, business, entertainment, and lodging locations.  
3. Communications Sector
   1. The communications sector includes all terrestrial, satellite, and wireless communication systems.
4. Critical Manufacturing Sector
   1. This sector includes the manufacturing industry, which provide economic benefit to the state as well as materials needed to continue operations throughout the state.
5. Dams Sector
   1. This sector includes all dams used for critical water retention and control services.
6. Defense Industrial Base Sector
   1. This sector includes companies and subcontractors that supply materials, services, and facilities to the U.S. military.
7. Emergency Services Sector
   1. This sector includes the emergency personnel, and related resources and assets, saving lives, protecting property and the environment, and assisting in recovery efforts after emergencies and disasters.
8. Energy Sector
   1. The energy sector includes electricity, oil, and natural gas resources and assets to maintain consistent energy supplies.
9. Financial Services Sector
   1. This sector handles financial assets as well as the ability to access and utilize those assets.
10. Food and Agriculture Sector
    1. The food and agriculture sector includes farms, restaurants, and food manufacturing, processing, and storage facilities.
11. Government Facilities Sector
    1. This sector includes federal, state, local and tribunal government buildings and spaces.
12. Healthcare and Public Health Sector
    1. This sector includes the various entities providing public health as well as those that provide response and recovery after disasters.
13. Information Technology Sector
    1. This sector produce and provide hardware, software, and information technology systems and services, as well as play a role in maintaining the internet.
14. Nuclear Reactors, Materials, and Waste Sector
    1. This sector includes nuclear power reactors and facilities as well as nuclear materials used for medical services.
15. Transportation Systems Sector
    1. This sector includes the transportation infrastructure throughout the state.
16. Water and Wastewater Systems
    1. This sector includes the entities providing access to healthy and clean water as well as removal of waste.

Arguments in Support: According to the City of Lindsay, “Recent reports regarding various cybersecurity attacks in the education, health care, energy, and financial sectors have demonstrated that California’s critical infrastructure sectors are vulnerable to attack and suffer from a stark lack of cybersecurity preparedness. Research has continued to show an increase in the number of cyberattacks targeting critical infrastructure sectors. These cyberattacks are predominantly made up of phishing attempts and ransomware. Phishing attacks aim to steal a user’s login credentials, and ransomware locks a user out of a system until a fee is paid to regain access. Both provide intruders with access to technology systems, money, and sensitive data and information, and not only do they threaten California’s economy, but also the health and safety of Californians across the state.SB 265 aims to increase cybersecurity protections in all of California’s critical infrastructure sectors, including but not limited to, California’s emergency services sector, education sector, energy sector, financial services sector and healthcare sector.”

They continue, “For these reasons, the City of Lindsay supports SB 265 (Hurtado) and respectfully asks for your AYE vote.”

Prior and Related Legislation:

SB 892 (Hurtado) Chapter 820, Statutes of 2022. Directs Cal-CSIC to prepare a strategic, multiyear outreach plan that focuses on ways to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity

SB 844 (Min) Chapter 505, Statutes of 2022. Requires the California Cybersecurity Integration Center (Cal-CSIC) to create an annual report for four years on all expenditures made by the state within a single fiscal year pursuant to the federal State and Local Cybersecurity Improvement Act.

SB 1001 (Min) requires Cal-CSIC to submit a report to the Legislature on the feasibility and benefits of requiring credit reporting bureaus and lenders to implement new information security tactics that protect consumers from financial fraud, as specified. (Vetoed)

AB 2355 (Salas) Chapter 498, Statutes of 2022. Requires local educational agencies to report any cyberattack to Cal-CSIC, as specified. (Pending in the Senate Governmental Organization Committee)

AB 2813 (Irwin) Chapter 768, Statutes of 2018. Established Cal-CSIC in statute, as specified.

REGISTERED SUPPORT / OPPOSITION:

Support

City of Lindsay

City of Porterville Mayor Martha A. Flores

County of Tulare Supervisor Dennis Townsend

Cybersecurity Center at California State University San Bernardino

Los Angeles County Sanitation Districts

OACYS Technology

Porterville Chamber of Commerce

Opposition

None on file.

Analysis Prepared by: Ryan Fleming / E.M. / (916) 319-3802

 THIRD READING  

Bill No: SB 265

Author: Hurtado (D), et al.

Amended: 5/18/23

Vote: 21

SENATE GOVERNMENTAL ORG. COMMITTEE: 13-0, 3/14/23

AYES: Dodd, Wilk, Alvarado-Gil, Archuleta, Ashby, Bradford, Glazer, Jones, Nguyen, Padilla, Portantino, Roth, Seyarto

NO VOTE RECORDED: Ochoa Bogh, Rubio

SENATE APPROPRIATIONS COMMITTEE: 7-0, 5/18/23

AYES: Portantino, Jones, Ashby, Bradford, Seyarto, Wahab, Wiener

SUBJECT: Cybersecurity preparedness: critical infrastructure sectors

SOURCE: Author

DIGEST:

This bill requires the Office of Emergency Services (OES) to direct the California Cybersecurity Integration Center (Cal-CSIC) to prepare, and OES to submit to the Legislature, a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified.

ANALYSIS:

Existing law:

1. Establishes, pursuant to the Emergency Services Act (ESA), OES for the state’s emergency and disaster response services, as specified.
2. Establishes Cal-CSIC with the primary mission of reducing the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
3. Requires OES to direct Cal-CSIC to prepare, and OES to submit to the Legislature, a strategic, multiyear outreach plan to assist the food and agriculture sector and wastewater sector in their efforts to improve cybersecurity and an evaluation of options for providing grants or alternative forms of funding to, and potential voluntary actions that do not require funding and that assist, those sectors in their efforts to improve security preparedness.

This bill:

1. Requires OES to direct Cal-CSIC to prepare a strategic, multiyear outreach plan that focuses on ways to assist each of California’s critical infrastructure sectors in their efforts to improve cybersecurity and that includes, but is not limited to, all of the following:
   1. A description of the need for greater cybersecurity outreach and assistance to critical infrastructure sectors.
   2. The goal of the outreach plan.
   3. Methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources for critical infrastructure sectors.
   4. An estimate of the funding needed to execute the outreach plan.
   5. Potential funding sources for the funding needed by the Cal-CSIC for the plan.
   6. A plan to evaluate the success of the outreach plan that includes quantifiable measures of success.
2. Requires OES to submit the outreach plan prepared pursuant to this bill to the Legislature no later than January 1, 2025.
3. Requires OES to direct Cal-CSIC to evaluate options for providing entities in critical infrastructure sectors with grants or alternative forms of funding to improve cybersecurity preparedness. Upon completion of the evaluation, requires OES to submit a report to the legislature no later than January 1, 2025, that includes, but is not limited to, all of the following:
   1. A summary of the evaluation performed by the Cal-CSIC.
   2. The specific grants and forms of funding for improved cybersecurity preparedness, as specified.
   3. Potential voluntary actions that do not require funding and assist critical infrastructure sectors in their efforts to improve cybersecurity preparedness.
4. Defines “critical infrastructure sectors” the critical infrastructure sectors as defined by the United States Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, including the chemical sector, commercial facilities sector, communications sector, critical manufacturing sector, dams sector, defense industrial base sector, emergency services sector, energy sector, financial services sector, food and agriculture sector, government facilities sector, health care and public health sector, information technology sector, nuclear reactors, materials, and waste sector, transportation systems sector, and water and wastewater systems sector.
5. Includes a sunset date for submitting the reports of January 1, 2029.

Background

Purpose of the bill. According to the author’s office, “cybersecurity is one of the most pressing issues impacting governmental entities in the modern era. In December 2022, the California Department of Finance was hit by a cybersecurity threat that took several days to control. Then, in September 2022, the Los Angeles Unified School District experienced a cybersecurity attack where attackers threatened to release highly confidential information. These are just some examples of many cyber-attacks that have impacted California’s critical infrastructure sectors. Recent reports regarding various cybersecurity attacks in the education, health care, energy, and financial sectors have demonstrated that California’s critical infrastructure sectors are vulnerable to attacks and suffer from a stark lack of cybersecurity preparedness.”

Further, the author’s office states that, “these concerns highlight the need of SB 265. SB 265 expands on previous work by requiring OES and Cal-CSIC to develop cybersecurity preparedness plans for California’s critical infrastructure sectors. The plans must include a strategic, multiyear outreach strategy focusing on methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources in the critical infrastructure sector, as well as plans outlining the funding options necessary to achieve this outreach.”

United States Cybersecurity and Infrastructure Security Agency. The United States Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. They connect stakeholders in industry and government to each other and to resources, analyses, and tools to help them build their own cyber, communications, and physical security and resilience, in turn helping to ensure a secure and resilient infrastructure for the American people.

CISA is the national coordinator for critical infrastructure security and resilience. The agency looks at the entire threat picture and works with partners across government and industry to defend against today’s threats while securing the nation’s critical infrastructure against threats that are just over the horizon. CISA’s Infrastructure Security Division coordinates and collaborates across government and the private sector. The division conducts and facilitates vulnerability and consequence assessments to help critical infrastructure owners and operators and State, local, tribal, and territorial partners understand and address risks to critical infrastructure. It also provides information on emerging threats and hazards so that appropriate actions can be taken, as well as tools and training to partners to help partners in government and industry manage the risks to their assets, systems, and networks.

CISA identifies 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have debilitating effect on security, national economic security, national public health or safety, or any combination thereof. CISA’s Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure including the: chemical sector, commercial facilities sector, communications sector, critical manufacturing sector, dams sector, defense industrial base sector, emergency services sector, energy sector, financial services sector, food and agriculture sector, government facilities sector, healthcare and public health sector, information technology sector, nuclear reactors, materials, and waste sector, transportation systems sector, water and wastewater systems sector.

California Cybersecurity Integration Center. The Cal-CSIC’s mission is to reduce the number of cyber threats and attacks in California. Cal-CSIC’s focus is to respond to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state.

The Cal-CSIC is the hub of state government’s cybersecurity events. Cal-CSIC coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

Cal-CSIC publishes a statewide cybersecurity strategy that takes recommendations from the California Task Force on Cybersecurity and follows state and federal requirements. The cybersecurity strategy improves how cyber threats are found, understood, and shared. The strategy strengthens cyber emergency preparedness and response, standardize data protection measures, enhance digital forensics, and increase cyber investigative capabilities, supply lessons learned to California’s workforce of cybersecurity professionals, and expand cybersecurity awareness.

Recent federal data show that cyberattacks are increasing in California. In 2020, an estimated 47,000 cyberattacks with payouts totaling $1.2 billion were reported in the state across all entities and sectors. Specifically, the author’s office points to a January 2021 cyberattack by an unknown hacker in the San Francisco Bay Area. The hacker used the username and password for a former employee’s account, which allowed for remote access to the network. The hacker deleted programs that the water plant used to treat drinking water. The hack wasn’t discovered until the following day. Just a few weeks later, a cyberattack in Florida resulted in increasing the level of lye in public drinking water to unsafe levels for nearly 15,000 people.

December 2022 Cybersecurity attack on Department of Finance. Multiple federal and state agencies responded to a cybersecurity attack on the California Department of Finance (DOF). According to OES, the “intrusion was proactively identified through coordination with state and federal security partners. Upon identification of this threat, digital security and online threat-hunting experts were rapidly deployed to assess the extent of the intrusion and to evaluate, contain and mitigate future vulnerabilities. The response effort includes multiple public and private agencies including the partners who make up the Cal-CSIC: the Governor’s Office of Emergency Services, Department of Technology, California Military Department and California Highway Patrol. While we cannot comment on specifics of the ongoing investigation, we can share that no state funds have been compromised, and the Department of Finance is continuing its work to prepare the Governor’s Budget that will be released next month.”

Further, OES stated that the “incident serves as an important reminder as to why Governor Gavin Newsom launched the state’s first multi-year cybersecurity roadmap Cal-Secure, which strengthens the state’s cybersecurity measures and prioritizes the resources to manage the most significant cyber risks and safeguard those services. The Newsom Administration, in partnership with the legislature, has advanced $260 million to bolster the state’s ability to prevent and respond to cyberattacks. The FY21-22 state budget also included $38.8 million ongoing to mature the state’s overall security posture, improve statewide information security initiatives, analyze cyber threat intelligence and mitigate potential threats.”

Extremist Attacks on Critical Infrastructure. There is growing concern that extremists within the country are focusing their attacks on our critical infrastructure in an attempt to drive fear and division among Americans. Earlier this month, federal authorities announced the arrest of a neo-Nazi couple on charges that they were plotting to attack the Maryland power grid system. Prosecutors allege that the couple planned to use guns to shoot five substations near Baltimore to “completely destroy” the city. Last July, the same group produced a 136-page manifesto and audio book imploring readers to commit acts of terror. The narrator of that manifesto was recently identified as a Sacramento native with ties to extremist groups in the state and a history of interactions with the justice system.

Multiyear Outreach Plan. This bill requires OES to direct Cal-CSIC to prepare a strategic, multiyear outreach plan that focuses on ways to assist each of California’s critical infrastructure sectors in their efforts to improve cybersecurity. Specifically, this bill focuses on effort ways to assist each sector including: a description of the need for greater cybersecurity outreach and assistance to critical infrastructure sectors, the goal of the outreach plan, methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources for critical infrastructure sectors, and estimate of the funding needed to execute the outreach plan, potential funding sources for the funding needed by Cal-CSIC for the plan, and a plan to evaluate the success of the outreach plan that includes quantifiable measures of success.

This bill requires OES to submit the outreach plan to the Legislature by January 1, 2025. Additionally, this bill requires Cal-CSIC to evaluate options for providing entities in critical infrastructure sectors with grants or alternative forms of funding to improve cybersecurity preparedness. Upon completion of the evaluation, OES shall submit a report to the Legislature, no later than January 1, 2025. This bill includes a sunset date of January 1, 2029.

Déjà Vu. This bill is substantially similar to SB 892 (Hurtado, Chapter 892, Statutes of 2022) which requires Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity by January 1, 2024.

This bill includes that same requirement, pushing the date out one year to January 1, 2025, and adds all critical infrastructure sectors identified by the federal government to focus a strategic, multiyear outreach plan on ways to assist in efforts to improve cybersecurity. Moving forward, the author may wish to consider amending this bill to add federally identified critical infrastructure sectors to the existing law established by SB 892 last year rather than creating a new, nearly identical and adjacent section.

Related/Prior Legislation

SB 74 (Dodd, 2023) requires state entities to prohibit certain high-risk applications for social media platforms from being downloaded or installed on those entities’ state-owned or state-issued devices, as specified. (Pending on the Senate Floor)

AB 569 (E. Garcia, 2023) requires the Department of Veterans Affairs, the Department of Technology, the California Community Colleges, and the California State University to develop a cybersecurity apprenticeship program for veterans at California community colleges and the California State University to receive training in and be able to enter the cybersecurity field, as specified. (Pending in the Assembly Appropriations Committee)

AB 740 (Gabriel, 2023) requires the Department of General Services, in consultation with the Chief of the Office of Information Security, to adopt rules and regulations to ensure that unmanned aircraft used by a government entity meet appropriate safeguards to ensure the confidentiality, integrity, and availability of any data collected, transmitted, or stored by that unmanned aircraft, as specified. (Pending in the Assembly Privacy and Consumer Protections Committee)

AB 1023 (Papan, 2023) states the intent of the Legislature to enact future legislation that would provide additional support and funding to local educational agencies to improve and expand protections against cybersecurity threats. (Pending referral at the Senate Desk)

SB 892 (Hurtado, Chapter 820, Statutes of 2022) required OES to direct Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity, as specified.

AB 2813 (Irwin, Chapter 768, Statutes of 2018) established in statute Cal-CSIC within OES, the primary mission of which is the same as the Cal-CSIC as created by the previous executive order.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee, total one-time cost of approximately $1.057 million to develop the plan, evaluate funding options, and submit the specified report and evaluation to the Legislature (General Fund).

• OES reports costs of approximately $850,000 for three limited-term staff.
• The California Military Department reports costs of approximately $207,000 for one limited-term staff.

SUPPORT: (Verified 5/18/23)

City of Lindsay

City of Porterville Mayor Martha A. Flores

County of Tulare Supervisor Dennis Townsend

Cybersecurity Center at California State University San Bernardino

Los Angeles County Sanitation Districts

OACYS Technology
Porterville Chamber of Commerce

OPPOSITION: (Verified 5/18/23)

None received

ARGUMENTS IN SUPPORT: In support of the bill, the City of Lindsay writes that, “[r]ecent reports regarding various cybersecurity attacks in the education, health care, energy, and financial sectors have demonstrated that California’s critical infrastructure sectors are vulnerable to attack and suffer from a stark lack of cybersecurity preparedness. Research has continued to show an increase in the number of cyberattacks targeting critical infrastructure sectors. These cyberattacks are predominantly made up of phishing attempts and ransomware. Phishing attacks aim to steal a user’s login credentials, and ransomware locks a user out of a system until a fee is paid to regain access. Both provide intruders with access to

technology systems, money, and sensitive data and information, and not only do they threaten California’s economy, but also the health and safety of Californians across the state.”

Prepared by: Brian Duke / G.O. / (916) 651-1530

5/23/23 12:00:14

**** END ****

SENATE COMMITTEE ON

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

SB 265 (Hurtado) - Cybersecurity preparedness: critical infrastructure sectors

Bill Summary:

SB 265 requires the Office of Emergency Services (OES) to direct the California Cybersecurity Integration Center (Cal-CSIC) to prepare a strategic, multiyear outreach plan to improve cybersecurity in each of California’s critical infrastructure sectors and evaluate funding options for entities in critical infrastructure sectors to improve their cybersecurity preparedness, as specified. SB 265 requires OES to submit reports on the outreach plan and evaluation to the Legislature by January 1, 2025.

*********** ANALYSIS ADDENDUM – SUSPENSE FILE ***********

The following information is revised to reflect amendments

adopted by the committee on May 18, 2023

Fiscal Impact:

Total one-time cost of approximately $1.057 million to develop the plan, evaluate funding options, and submit the specified report and evaluation to the Legislature (General Fund).

• OES reports costs of approximately $850,000 for three limited-term staff.
• The California Military Department reports costs of approximately $207,000 for one limited-term staff.

Author Amendments:

• Consolidate current Cal-CSIC cybersecurity outreach plan requirements for the food and agriculture and the water and wastewater sectors as specified by SB 892 (Hurtado, Chapter 820, Statutes of 2022).
• Add coauthors.

-- END --

SENATE COMMITTEE ON

Senator Anthony Portantino, Chair

2023 - 2024 Regular Session

SB 265 (Hurtado) - Cybersecurity preparedness: critical infrastructure sectors

Bill Summary:

SB 265 requires the Office of Emergency Services (OES) to direct the California Cybersecurity Integration Center (Cal-CSIC) to prepare a strategic, multiyear outreach plan to improve cybersecurity in each of California’s critical infrastructure sectors and evaluate funding options for entities in critical infrastructure sectors to improve their cybersecurity preparedness, as specified. SB 265 requires OES to submit reports on the outreach plan and evaluation to the Legislature by January 1, 2025.

Fiscal Impact:

Total costs of approximately $1.057 million for up to four one-year limited-term staff to develop the plan, evaluate funding options, and submit the specified report and evaluation to the Legislature (General Fund).

Background:

The Cal-CSIC’s mission is to reduce the number of cyber threats and attacks in California, with a focus on responding to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state. Generally, Cal-CSIC is the hub of state government’s cybersecurity events. Cal-CSIC coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

SB 892 (Hurtado, Chapter 820, Statutes of 2022) requires Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in efforts to improve cybersecurity by January 1, 2024.

The OES has submitted a Budget Change Proposal (BCP) for $531,000 for Fiscal Year (FY) 2023-24 and $280,000 in FY 2024-25 to implement the provisions of SB 892 (General Fund). In this BCP, OES additionally notes that the Cal-CSIC is currently operating under a three-year funding commitment, set to expire on June 30, 2023. The Cal-CSIC has submitted a separate BCP jointly with the OES, California Military Department, California Department of Technology, and the California Highway Patrol for an additional $28.7 million ongoing General Fund to maintain and expand its operations.

This bill expands on last year’s SB 892 to include all critical infrastructure sectors identified by the United States Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, in addition to the food and agriculture sector and the water and wastewater sector. This bill also pushes the deadline to develop the outreach plan and alternative funding evaluation and associated reports to the Legislature out to January 1, 2025.

Proposed Law:

• Requires OES to direct Cal-CSIC to:
  • Prepare a strategic, multiyear outreach plan focusing on ways to assist each of California’s critical infrastructure sectors in their efforts to improve cybersecurity.
    • Requires the plan to include specified components, including a description of the need for greater cybersecurity outreach and assistance, goals of the plan, coordination methods with other state and federal agencies, an estimate of funding needs and potential funding sources, and a plan to evaluate the program’s success.
  • Evaluate options for providing entities in critical infrastructure sectors with grants or alternative forms of funding to improve cybersecurity preparedness.
    • Requires the evaluation to include a summary, the specific grants and forms of funding, and potential voluntary actions that do not require funding.
• Requires OES to submit a report on the outreach plan and a report on the evaluation to the Legislature by January 1, 2025. Establishes a sunset date of January 1, 2029 for these reporting requirements.
• Specifies that “critical infrastructure sectors” includes the chemical sector, commercial facilities sector, communications sector, critical manufacturing sector, dams sector, defense industrial base sector, emergency services sector, energy sector, financial services sector, food and agriculture sector, government facilities sector, health care and public health sector, information technology sector, nuclear reactors, materials and waste sector, transportation systems sector, and water and wastewater systems sector.
• States legislative findings and declarations.

-- END --

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Bill Dodd

Chair

2023 - 2024 Regular

Bill No: 265 Hearing Date: 3/14/2023

SUBJECT: Cybersecurity preparedness: critical infrastructure sectors

DIGEST: This bill requires the Office of Emergency Services (OES) to direct the California Cybersecurity Integration Center (Cal-CSIC) to prepare, and OES to submit to the Legislature, a strategic, multi-year outreach plan to assist critical infrastructure sectors in their efforts to improve cybersecurity and an evaluation of options for providing grants to those sectors in their efforts to improve cybersecurity preparedness, as specified.

ANALYSIS:

Existing law:

1. The Emergency Services Act (ESA) establishes OES for the state’s emergency and disaster response services, as specified.
2. Establishes Cal-CSIC with the primary mission of reducing the likelihood and severity of cyber incidents that could damage California’s economy, its critical infrastructure, or public and private sector computer networks in the state.
3. Requires Cal-CSIC to provide warnings of cyberattacks to government agencies and nongovernmental partners, coordinate information sharing among these entities, assess risks to critical infrastructure information networks, enable cross-sector coordination and sharing of best practices and security measures, and support certain cybersecurity assessments, audits, and accountability programs.
4. Requires Cal-CSIC to develop a statewide cybersecurity strategy to improve how cyber threats are identified, understood, and shared in order to reduce threats to California government, businesses, and consumers, and to strengthen cyber emergency preparedness and response and expand cybersecurity awareness and public education.

This bill:

1. Requires OES to direct Cal-CSIC to prepare a strategic, multi-year outreach plan that focuses on ways to assist each of California’s critical infrastructure sectors in their efforts to improve cybersecurity and that includes, but is not limited to, all of the following:
2. A description of the need for greater cybersecurity outreach and assistance to critical infrastructure sectors.
3. The goal of the outreach plan.
4. Methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources for critical infrastructure sectors.
5. An estimate of the funding needed to execute the outreach plan.
6. Potential funding sources for the funding needed by Cal-CSIC for the plan.
7. A plan to evaluate the success of the outreach plan that includes quantifiable measures of success.
8. Requires OES to submit the outreach plan to the Legislature no later than January 1, 2025, as specified.
9. Requires OES to direct Cal-CSIC to evaluate options for providing entities in critical infrastructure sectors with grants or alternative forms of funding to improve cybersecurity preparedness, as specified.
10. Requires OES, upon completion of the evaluation, to submit a report to the Legislature no later than January 1, 2025, that includes, but is not limited to, all of the following:
    1. A summary of the evaluation performed by Cal-CSIC.
    2. The specific grants and forms of funding for improved cybersecurity preparedness, including, but not limited to current overall funding level and potential funding sources.
    3. Potential voluntary actions that do not require funding and assist critical infrastructure sectors in their efforts to improve cybersecurity preparedness.
11. Defines “critical infrastructure sectors” to mean the critical infrastructure sectors as defined by the United States Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, including chemical sector, commercial facilities sector, communications sector, critical manufacturing sector, dams sector, defense industrial base sector, emergency services sector, energy sector, financial services sector, food and agriculture sector, government facilities sector, health care and public health sector, information technology sector, nuclear reactors, materials and waste sector, transportation systems sector, and water and wastewater systems sector.
12. Includes legislative findings and declarations relating to cybersecurity preparedness.

Background

Purpose of the Bill. According to the author’s office, “cybersecurity is one of the most pressing issues impacting governmental entities in the modern era. In December 2022, the California Department of Finance was hit by a cybersecurity threat that took several days to control. Then, in September 2022, the Los Angeles Unified School District experienced a cybersecurity attack where attackers threatened to release highly confidential information. These are just some examples of many cyber-attacks that have impacted California’s critical infrastructure sectors. Recent reports regarding various cybersecurity attacks in the education, health care, energy, and financial sectors have demonstrated that California’s critical infrastructure sectors are vulnerable to attacks and suffer from a stark lack of cybersecurity preparedness.”

Further, the author’s office states that, “these concerns highlight the need of SB 265. SB 265 expands on previous work by requiring OES and Cal-CSIC to develop cybersecurity preparedness plans for California’s critical infrastructure sectors. The plans must include a strategic, multiyear outreach strategy focusing on methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources in the critical infrastructure sector, as well as plans outlining the funding options necessary to achieve this outreach.”

United States Cybersecurity and Infrastructure Security Agency. The United States Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. They connect stakeholders in industry and government to each other and to resources, analyses, and tools to help them build their own cyber, communications, and physical security and resilience, in turn helping to ensure a secure and resilient infrastructure for the American people.

CISA is the national coordinator for critical infrastructure security and resilience. The agency looks at the entire threat picture and works with partners across government and industry to defend against today’s threats while securing the nation’s critical infrastructure against threats that are just over the horizon. CISA’s Infrastructure Security Division coordinates and collaborates across government and the private sector. The division conducts and facilitates vulnerability and consequence assessments to help critical infrastructure owners and operators and State, local, tribal, and territorial partners understand and address risks to critical infrastructure. It also provides information on emerging threats and hazards so that appropriate actions can be taken, as well as tools and training to partners to help partners in government and industry manage the risks to their assets, systems, and networks.

CISA identifies 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have debilitating effect on security, national economic security, national public health or safety, or any combination thereof. CISA’s Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure including the: chemical sector, commercial facilities sector, communications sector, critical manufacturing sector, dams sector, defense industrial base sector, emergency services sector, energy sector, financial services sector, food and agriculture sector, government facilities sector, healthcare and public health sector, information technology sector, nuclear reactors, materials, and waste sector, transportation systems sector, water and wastewater systems sector.

California Cybersecurity Integration Center. The Cal-CSIC’s mission is to reduce the number of cyber threats and attacks in California. Cal-CSIC’s focus is to respond to cyber threats and attacks that could damage the economy, its critical infrastructure, or computer networks in the state.

The Cal-CSIC is the hub of state government’s cybersecurity events. Cal-CSIC coordinates information sharing at all levels of government agencies, utilities and other service providers, academic institutions, and nongovernmental organizations.

Cal-CSIC publishes a statewide cybersecurity strategy that takes recommendations from the California Task Force on Cybersecurity and follows state and federal requirements. The cybersecurity strategy improves how cyber threats are found, understood, and shared. The strategy strengthens cyber emergency preparedness and response, standardize data protection measures, enhance digital forensics, and increase cyber investigative capabilities, supply lessons learned to California’s workforce of cybersecurity professionals, and expand cybersecurity awareness.

Recent federal data show that cyberattacks are increasing in California. In 2020, an estimated 47,000 cyberattacks with payouts totaling $1.2 billion were reported in the state across all entities and sectors. Specifically, the author’s office points to a January 2021 cyberattack by an unknown hacker in the San Francisco Bay Area. The hacker used the username and password for a former employee’s account, which allowed for remote access to the network. The hacker deleted programs that the water plant used to treat drinking water. The hack wasn’t discovered until the following day. Just a few weeks later, a cyberattack in Florida resulted in increasing the level of lye in public drinking water to unsafe levels for nearly 15,000 people.

December 2022 Cybersecurity attack on Department of Finance. Multiple federal and state agencies responded to a cybersecurity attack on the California Department of Finance (DOF). According to OES, the “intrusion was proactively identified through coordination with state and federal security partners. Upon identification of this threat, digital security and online threat-hunting experts were rapidly deployed to assess the extent of the intrusion and to evaluate, contain and mitigate future vulnerabilities. The response effort includes multiple public and private agencies including the partners who make up the Cal-CSIC: the Governor’s Office of Emergency Services, Department of Technology, California Military Department and California Highway Patrol. While we cannot comment on specifics of the ongoing investigation, we can share that no state funds have been compromised, and the Department of Finance is continuing its work to prepare the Governor’s Budget that will be released next month.”

Further, OES stated that the “incident serves as an important reminder as to why Governor Gavin Newsom launched the state’s first multi-year cybersecurity roadmap Cal-Secure, which strengthens the state’s cybersecurity measures and prioritizes the resources to manage the most significant cyber risks and safeguard those services. The Newsom Administration, in partnership with the legislature, has advanced $260 million to bolster the state’s ability to prevent and respond to cyberattacks. The FY21-22 state budget also included $38.8 million ongoing to mature the state’s overall security posture, improve statewide information security initiatives, analyze cyber threat intelligence and mitigate potential threats.”

Extremist Attacks on Critical Infrastructure. There is growing concern that extremists within the country are focusing their attacks on our critical infrastructure in an attempt to drive fear and division among Americans. Earlier this month, federal authorities announced the arrest of a neo-Nazi couple on charges that they were plotting to attack the Maryland power grid system. Prosecutors allege that the couple planned to use guns to shoot five substations near Baltimore to “completely destroy” the city. Last July, the same group produced a 136-page manifesto and audio book imploring readers to commit acts of terror. The narrator of that manifesto was recently identified as a Sacramento native with ties to extremist groups in the state and a history of interactions with the justice system.

Multiyear Outreach Plan. This bill requires OES to direct Cal-CSIC to prepare a strategic, multiyear outreach plan that focuses on ways to assist each of California’s critical infrastructure sectors in their efforts to improve cybersecurity. Specifically, this bill focuses on effort ways to assist each sector including: a description of the need for greater cybersecurity outreach and assistance to critical infrastructure sectors, the goal of the outreach plan, methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources for critical infrastructure sectors, and estimate of the funding needed to execute the outreach plan, potential funding sources for the funding needed by Cal-CSIC for the plan, and a plan to evaluate the success of the outreach plan that includes quantifiable measures of success.

This bill requires OES to submit the outreach plan to the Legislature by January 1, 2025. Additionally, this bill requires Cal-CSIC to evaluate options for providing entities in critical infrastructure sectors with grants or alternative forms of funding to improve cybersecurity preparedness. Upon completion of the evaluation, OES shall submit a report to the Legislature, no later than January 1, 2025. Nothing in the bill requires the identification of specific critical infrastructure, or the divulgence of critical information that could be harmful to the state.

Déjà Vu. This bill is substantially similar to SB 892 (Hurtado, Chapter 892, Statutes of 2022) which requires Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity by January 1, 2024.

This bill includes that same requirement, pushing the date out one year to January 1, 2025, and adds all critical infrastructure sectors identified by the federal government to focus a strategic, multiyear outreach plan on ways to assist in efforts to improve cybersecurity. Moving forward, the author may wish to consider amending this bill to add federally identified critical infrastructure sectors to the existing law established by SB 892 last year rather than creating a new, nearly identical and adjacent section.

Prior/Related Legislation

SB 74 (Dodd, 2023) requires state entities to prohibit certain high-risk applications for social media platforms from being downloaded or installed on those entities’ state-owned or state-issued devices, as specified. (Pending in the Senate Governmental Organization Committee)

AB 569 (E. Garcia, 2023) requires the Department of Veterans Affairs, the Department of Technology, the California Community Colleges, and the California State University to develop a cybersecurity apprenticeship program for veterans at California community colleges and the California State University to receive training in and be able to enter the cybersecurity field, as specified. (Pending in the Assembly Military and Veterans Affairs Committee)

AB 740 (Gabriel, 2023) requires the Department of General Services, in consultation with the Chief of the Office of Information Security, to adopt rules and regulations to ensure that unmanned aircraft used by a government entity meet appropriate safeguards to ensure the confidentiality, integrity, and availability of any data collected, transmitted, or stored by that unmanned aircraft, as specified. (Pending in the Assembly Privacy and Consumer Protections Committee)

AB 1023 (Papan, 2023) states the intent of the Legislature to enact future legislation that would provide additional support and funding to local educational agencies to improve and expand protections against cybersecurity threats. (Pending referral at the Assembly Desk)

SB 892 (Hurtado, Chapter 820, Statutes of 2022) requires OES to direct Cal-CSIC to prepare and submit a strategic, multiyear outreach plan to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity, as specified.

AB 2135 (Irwin, Chapter 773, Statutes of 2022) requires state agencies not under direct authority of the Governor to adopt and implement certain information security and privacy policies, standards, and procedures meeting specified federally-established criteria; and, requires those agencies to perform a comprehensive independent security assessment (ISA) every two years, as specified.

AB 2355 (Salas, Chapter 498, Statutes of 2022) requires a Local Educational Agency (LEA) to report a cyberattack impacting 500 or more pupils or personnel to report to Cal-CSIC and requires the Cal-CSIC to annually report to the Governor and relevant policy committees of the Legislature with specified information related to the cyberattack.

AB 1352 (Chau, Chapter 593, Statutes of 2021) authorized the Military Department to perform an independent security assessment of a local educational agency or school-site, at the request and expense of the local educational agency, as specified.

AB 2813 (Irwin, Chapter 768, Statutes of 2018) established in statute Cal-CSIC within OES, the primary mission of which is the same as the Cal-CSIC as created by the previous executive order.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

City of Lindsay

City of Porterville Mayor Martha A. Flores

County of Tulare Supervisor Dennis Townsend

Cybersecurity Center at California State University San Bernardino

OACYS Technology
Porterville Chamber of Commerce

OPPOSITION:

None received

ARGUMENTS IN SUPPORT: In support of the bill, the City of Lindsay writes that, “[r]ecent reports regarding various cybersecurity attacks in the education, health care, energy, and financial sectors have demonstrated that California’s critical infrastructure sectors are vulnerable to attack and suffer from a stark lack of cybersecurity preparedness. Research has continued to show an increase in the number of cyberattacks targeting critical infrastructure sectors. These cyberattacks are predominantly made up of phishing attempts and ransomware. Phishing attacks aim to steal a user’s login credentials, and ransomware locks a user out of a system until a fee is paid to regain access. Both provide intruders with access to technology systems, money, and sensitive data and information, and not only do they threaten California’s economy, but also the health and safety of Californians across the state.”