Amended in Senate August 4, 2014

Amended in Senate June 12, 2014

Amended in Assembly May 23, 2014

California Legislature—2013–14 Regular Session

Assembly Bill No. 2200

Introduced by Assembly Member John A. Pérez

February 20, 2014

An act to add and repeal begin delete Chapter 5.8 end delete begin insert Article 3.9 end insert (commencing with Section begin delete 11549.50) end delete begin insert 8574.50) end insert of begin delete Part 1 end delete begin insert Chapter 7 end insert of Division begin delete 3 end delete begin insert 1 end insert of Title 2 of the Government Code, relating to cyber security.

LEGISLATIVE COUNSEL’S DIGEST

AB 2200, as amended, John A. Pérez. California Cyber Security Commission.

Existing law establishes various advisory boards and commissions in state government with specified duties and responsibilities. Existing law begin delete until January 1, 2015, end delete establishes in state government the begin delete Department of Technology within the Government Operations supervised by the Director of Technology. end delete begin insert Governor’s Office of Emergency Services. end insert

This bill would create the California Cyber Security Commission in the begin delete Department of Technology end delete begin insert Governor’s Office of Emergency Services, end insert consisting of begin delete 12 end delete begin insert 15 end insert members comprised of representatives from state government, appointed representatives from begin delete the private sectors in end delete the technology or cybersecurity industry and begin delete utility, energy, or telecommunications end delete begin insert the utility or energy end insert industry, and an appointed representative of California’s critical infrastructure interests. The bill would also authorize the commission to appoint representatives from state, local, federal, and private entities to form an advisory board in order to receive input or advice concerning the implementation of the duties of the commission. The duties of the commission would include establishing cyber-attack response strategies and performing risk assessments on state information technology systems. The bill would require the commission to meet on a quarterly basis, or as specified, and would begin delete require end delete begin insert allow end insert the commission to issue a report begin delete on at least an annual basis end delete to the Governor’s Office and the Legislature that details the activities of the commission and makes recommendations to improve California’s cybersecurity preparedness.

The bill would abolish the commission, and repeal these provisions, on January 1, 2019.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

begin delete Chapter 5.8 end delete begin insert Article 3.9 end insert (commencing with Section
begin delete 11549.50) end delete begin insert 8574.50) end insert is added to begin delete Part 1 end delete begin insert Chapter 7 end insert of Division begin delete 3 end delete begin insert 1 end insert
of Title 2 of the Government Code, to read:

begin delete

 

Chapter  5.8. California Cyber Security Commission

 

end delete

 

begin insert

Article begin insert 3.9. end insert   begin insert California Cyber Security Commission end insert

end insert

 

begin delete 11549.50. end delete
begin insert 8574.50. end insert   

The Legislature finds and declares all of the following:

(a) The State of California’s growing dependence on technology
has made it increasingly vulnerable to both foreign and domestic
cyber security attacks. Thus far, there has been a fragmented
approach to this issue with independent efforts occurring through
federal, state, and local government, as well as in the state’s
universities and within private industry. For the purposes of public
safety and protection of public assets, the state has a role in
coordinating and improving its overall security and response
capabilities.

(b) The market for cyber security is estimated to be more than
seventy billion dollars ($70,000,000,000) in 2014. Of that amount,
sixty-seven billion dollars ($67,000,000,000) is estimated to be
spent nationally by private companies for computer and network
security and the United States Department of Defense is planning
to spend four billion six hundred million dollars ($4,600,000,000).
The United States Department of Defense is planning on spending
twenty-three billion dollars ($23,000,000,000) over the next five
years. Overall spending is expected to increase rapidly as
recognition of threats becomes more ubiquitous. The California
economy stands to greatly benefit from this industry growth.

(c) The State of California has already made investments for
the purpose of cyber security; examples of which are research
funding for the Lawrence Livermore National Laboratory and
funding to augment a cyber security assessment and response team
within the California National Guard.

(d) The California Cyber Security Task Force was initiated in
May 2013 for the purposes of identifying critical threats,
assembling primary stakeholders, and highlighting the growing
importance of the issue. Among other things, this has increased
awareness of the state’s compliance with the new federal National
Institute of Standards and Technology (NIST) standards and the
Office of Emergency Services establishing Emergency Function
18, created particularly for cyber security.

(e) Over 50,000 new malicious online activities are identified
every day, according to the United States Department of Defense.
Incidents of sophisticated and well-coordinated attacks and data
breaches are occurring more regularly, the average cost of which
amounts to more than ten million dollars ($10,000,000). In 2012,
a data breach to the state of South Carolina required more than
twenty million dollars ($20,000,000) in response and restitution.
The State of California is vulnerable technically, legally, and
financially to these threats.

begin delete 11549.51. end delete
begin insert 8574.51. end insert   

(a) There is in the begin delete Department of Technology end delete
begin insert Governor’s Office of Emergency Services end insert the California Cyber
Security Commission. The commission shall consist of the
following members:

(1) The Director of begin delete the Department of Technology, end delete begin insert Emergency
Services, end insert or his or her designee with knowledge, expertise, and
decisionmaking authority with respect to the begin delete director’s end delete begin insert Office of
Emergency Service’s end insert information technology and information
security duties begin delete set forth in Chapter 5.6 (commencing with Section
11545) end delete .

(2) The Chief of the Office of Information Security, or his or
her designee with knowledge, expertise, and decisionmaking
authority with respect to the chief’s information technology and
information security duties set forth in Chapter 5.7 (commencing
with Section 11549) begin insert of Part 1 of Division 3 end insert .

begin delete

(3) The Director of Emergency Services, or his or her designee
with knowledge, expertise, and decisionmaking authority with
respect to the Office of Emergency Services’s information
technology and information security.

end delete begin delete

(4)

end delete

begin insert (3) end insert  The Attorney General, or his or her designee with
knowledge, expertise, and decisionmaking authority with respect
to the Department of Justice’s information technology and
information security.

begin delete

(5)

end delete

begin insert (4) end insert  The Adjutant General of the Military Department, or his or
her designee with knowledge, expertise, and decisionmaking
authority with respect to the Military Department’s information
technology and information security.

begin delete

(6)

end delete

begin insert (5) end insert  The Insurance Commissioner, or his or her designee with
knowledge, expertise, and decisionmaking authority with respect
to the Department of Insurance’s information technology and
information security.

begin delete

(7)

end delete

begin insert (6) end insert  The Secretary of Health and Human Services, or his or her
designee with knowledge, expertise, and decisionmaking authority
with respect to the California Health and Human Services Agency’s
information technology and information security.

begin delete

(8)

end delete

begin insert (7) end insert  The begin delete Director of Transportation, end delete begin insert Secretary of the California
Transportation Agency, end insert or his or her designee with knowledge,
expertise, and decisionmaking authority with respect to the
begin delete Department of Transportation’s end delete begin insert agency’s end insert information technology
and information security.

begin delete

(9)

end delete

begin insert (8) end insert  The Controller, or his or her designee with knowledge,
expertise, and decisionmaking authority with respect to the office
of the Controller’s information technology and information
security.

begin insert

(9) The Commissioner of the California Highway Patrol, or his
or her designee with knowledge, expertise, and decisionmaking
authority with respect to the California Highway Patrol’s
information technology and information security.

end insert begin insert

(10) The Commander of the State Threat Assessment Center,
or his or her designee with knowledge, expertise, and
decisionmaking authority with respect to the State Threat
Assessment Center’s information technology and information
security.

end insert begin delete

(10)

end delete

begin insert (11) end insert  A representative from the private sector in the technology
or cybersecurity industry, who shall be appointed by the Governor.

begin insert

(12) A representative of the state’s higher education system
with knowledge, expertise, and decisionmaking authority with
respect to information technology and information security, who
shall be appointed by the Governor.

end insert begin insert

(13) A representative of the Public Utilities Commission,
California Energy Commission, or California Independent System
Operator with knowledge, expertise, and decisionmaking authority
with respect to information technology and information security,
who shall be appointed by the Governor.

end insert begin delete

(11)

end delete

begin insert (14) end insert  A representative from the begin delete private sector in the utility,
energy, or telecommunications end delete begin insert utility or energy end insert industry, who shall
be appointed by the Speaker of the Assembly.

begin delete

(12)

end delete

begin insert (15) end insert  A representative of California’s critical infrastructure
interests, such as air traffic control, ports, and water systems, who
shall be appointed by the Senate Committee on Rules.

(b) (1) Each representative appointed by the Governor, Speaker
of the Assembly, or Senate Committee on Rules shall be appointed
to serve a two-year term.

(2) Any representative may serve consecutive terms.

(c) Any designee shall serve at the pleasure of the official who
designated them.

(d)  begin delete Nine end delete begin insert Eight end insert members shall constitute a quorum for the
transaction of business, and all official acts of the commission
shall require the affirmative vote of a majority of its members
constituting a quorum.

(e) The members of the commission shall serve without
compensation, except that each member of the commission shall
be entitled to receive his or her actual necessary traveling expenses
while on official business of the commission.

begin delete 11549.52. end delete
begin insert 8574.52. end insert   

(a) The commission may appoint representatives to
form an advisory board in order to receive input or advice
concerning the implementation of the duties of the commission.
begin insert The commission may expand, as needed, the advisory board to
accommodate the representation necessary to inform and advance
the duties of the commission. end insert

(b) The advisory board may be comprised of one or more
representatives from the following:

(1) The United States Department of Homeland Security.

(2) The National Institute for Standards and Technology.

(3) State government.

(4) Local government.

(5) California’s utility grid, both private and public.

(6) Technology firms, cybersecurity firms, critical infrastructure
operators, utility providers, financial firms, health care providers,
and other private industries.

(7) California’s cybersecurity law enforcement apparatus, which
includes:

(A) The Attorney General’s eCrimes Unit.

(B) The five regional task forces of the High Technology Theft
Apprehension and Prosecution Program.

(C) The Department of the California Highway Patrol.

(8) Entities operating with the commission to perform its duties,
including:

(A) The State Threat Assessment Center and fusion centers, for
the purpose of sharing information that informs preventive actions.

(B) The California National Guard’s Computer Network Defense
Team, for the purpose of coordinating comprehensive risk
assessments.

(C) California’s public and private universities and laboratories
for the purpose of directing research and best utilizing its results.

(c) The commission shall appoint each representative by a
majority vote of its members constituting a quorum. Each
representative shall serve at the pleasure of the commission.

begin delete 11549.53. end delete
begin insert 8574.53. end insert   

The commission shall meet quarterly, or more often
as determined by a majority vote of its members constituting a
quorum, or in the event of an emergency.

begin delete 11549.54. end delete
begin insert 8574.54. end insert   

The duties of the commission shall include the
following:

(a) Developing within state government cyber prevention,
defense, and response strategies and defining a hierarchy of
command within the state for this purpose. This duty includes, but
is not limited to, the following activities:

(1) Performing comprehensive risk assessments on state
information technology systems. The Chief Information Security
Officer shall coordinate the process of performing risk assessments
and the assessments shall be performed by such entities as the
California National Guard’s Computer Defense Network Team
and the State Threat Assessment Center, in addition to other public
and private sector entities.

(2) Creating a risk profile of public assets, critical infrastructure,
public networks, and private operations susceptible to cyber attacks.

(3) Coordinating efforts to reduce state information technology
risks and gaps in existing service.

(b) Partnering with the United States Department of Homeland
Security to develop an appropriate information sharing system that
allows for a controlled and secure process to effectively disseminate
cyber threat and response information and data to relevant private
and public sector entities. This information sharing system shall
reflect state priorities and target identified threat and capability
gaps.

(c) Providing recommendations for information technology
security standards for all state agencies using, among other things,
protocols established by the National Institute for Standards and
Technology and reflective of appropriate state priorities.

(d) Compiling and integrating, as appropriate, the research
conducted by academic institutions, federal laboratories, and other
cybersecurity experts into state operations and functions.

(e) Expanding the state’s public-private cybersecurity
partnership network both domestically and internationally to assist
in the state’s efforts to prevent and respond to cyber threats and
cyber attacks as well as enhance overall cyber detection capability.

(f) Developing and providing a training program to produce a
credentialed and qualified state cybersecurity workforce. This
program should include training based begin delete in whole or in part end delete on the
requirements and protocols outlined in begin insert models such as end insert Department
of Defense Directive 8570. The commission shall work with state
workforce and labor entities as well as the state’s higher education
systems, federal agencies, and others to provide training and
develop curriculum.

(g)  begin delete Developing, end delete begin insert Analyzing, end insert in conjunction with the Department
of Insurance, begin insert the development of end insert a strategy to acquire and
incorporate cyber insurance into the procurement and
administrative processes of state agencies to protect state assets
and information.

(h) Expanding collaboration with the state’s law enforcement
apparatus assigned jurisdiction to prevent, deter, investigate, and
prosecute cyber attacks and information technology crime,
including collaboration with entities like the High-Tech Theft
Apprehension Program, and its five regional task forces, the
Department of the California Highway Patrol, and the Attorney
General’s eCrimes unit. Collaboration will include information
sharing that will enhance their capabilities including assistance to
better align their activities with federal and local resources, provide
additional resources, and extend their efforts into regions of the
state not currently represented.

(i) Proposing, where appropriate, potential begin delete governmental
reorganization options to enhance end delete begin insert operational or functional
enhancement to end insert the state’s cybersecurity assessment and response
capabilities begin insert , as well as investment or spending recommendation
and guidance for the state’s information technology budget and
procurement end insert .

(j) Coordinating the pursuit of fiscal resources including federal
grants and other funding opportunities to enhance the state’s
cybersecurity, information technology, data privacy, cyber research,
and technology-based emergency response capabilities.

begin delete 11549.55. end delete
begin insert 8574.55. end insert   

The commission shall take all necessary steps to
protect personal information, public and private sector data, as
well as ensure consumer privacy, when implementing its duties.

begin delete 11549.56. end delete
begin insert 8574.56. end insert   

(a) The commission begin delete shall end delete begin insert may end insert issue begin delete an annual end delete begin insert a end insert
report to the Governor’s office and the begin delete Legislature, or more often
if needed due to an emergency situation or time sensitive nature
of a cyber event, that contains the following information: end delete
begin insert Legislature detailing the activities of the commission, including,
but not limited to, progress on the commission’s various tasks and
actions taken and recommended in response to an incident, as
appropriate. end insert

begin delete

(1) Details on the activities of the commission, including, but
not limited to, progress on the commission’s various tasks and
actions taken and recommended in response to an incident, as
appropriate.

end delete begin delete

(2) Policy, organizational, and investment recommendations to
improve the cybersecurity preparedness of the state.

end delete

(b) The reports shall be submitted in compliance with Section
9795.

begin insert

begin insert 8574.57. end insert   

The commission may engage or accept the services
of agency or department personnel, accept the services of
stakeholder organizations, and accept federal, private, or other
nonstate funding, to operate, manage, or conduct the business of
the commission.

end insert begin insert

begin insert 8574.58. end insert   

The commission shall operate within the current
information technology budget of each department and agency
they serve. Each department and agency shall cooperate with the
commission and furnish it with information and assistance that is
necessary or useful to further the purposes of this article.

end insert

begin delete 11549.57. end delete
begin insert 8574.59. end insert   

This begin delete chapter end delete begin insert article end insert shall become inoperative on
January 1, 2019, and shall be repealed as of that date.