Amended in Assembly April 6, 2015

California Legislature—2015–16 Regular Session

Assembly Bill No. 670

Introduced by Assembly Member Irwin

February 25, 2015

An act to amend Section 11549.3 of the Government Code, relating to technology.

LEGISLATIVE COUNSEL’S DIGEST

AB 670, as amended, Irwin. Security assessments.

Existing law establishes the Department of Technology within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. The department is responsible for the approval and oversight of information technology projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs.

Existing law establishes the Office of Technology Services within the department, under the supervision of the Chief of the Office of Technology Services, and sets forth its duties, including, but not limited to, the authority to conduct or require a security begin delete assessments end delete begin insert assessment end insert of any state agency, as prescribed.

This bill would, instead, require the office to conduct, or require, an assessment of every state agency at least once every 2 years and would require the state agency being audited to pay the costs of the security assessment. The bill would authorize the department to require agencies that are not in compliance to redirect available funding to pay the costs of the assessments. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department.

This bill would authorize begin delete the department and end delete the Governor’s Office of Emergency Services to begin delete jointly end delete conduct the strategic direction of begin delete risk end delete begin insert security end insert assessments performed by the Military Department’s Computer Network Defense Team begin insert , and would require those assessments to contain certain elements end insert .

begin insert

Existing law requires that a statute that limits the public’s right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.

end insert begin insert

This bill would limit access to security assessment results, and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.

end insert

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

Section 11549.3 of the Government Code is
amended to read:

11549.3.  

(a) The director shall establish an information security
program. The program responsibilities include, but are not limited
to, all of the following:

(1) The creation, updating, and publishing of information
security and privacy policies, standards, and procedures for state
agencies in the State Administrative Manual.

(2) The creation, issuance, and maintenance of policies,
standards, and procedures directing state agencies to effectively
manage security and risk for both of the following:

(A) Information technology, which includes, but is not limited
to, all electronic technology systems and services, automated
information handling, system design and analysis, conversion of
data, computer programming, information storage and retrieval,
telecommunications, requisite system controls, simulation,
electronic commerce, and all related interactions between people
and machines.

(B) Information that is identified as mission critical, confidential,
sensitive, or personal, as defined and published by the Office of
Information Security.

(3) The creation, issuance, and maintenance of policies,
standards, and procedures directing state agencies for the collection,
tracking, and reporting of information regarding security and
privacy incidents.

(4) The creation, issuance, and maintenance of policies,
standards, and procedures directing state agencies in the
development, maintenance, testing, and filing of each agency’s
disaster recovery plan.

(5) Coordination of the activities of agency information security
officers, for purposes of integrating statewide security initiatives
and ensuring compliance with information security and privacy
policies and standards.

(6) Promotion and enhancement of the state agencies’ risk
management and privacy programs through education, awareness,
collaboration, and consultation.

(7) Representing the state before the federal government, other
state agencies, local government entities, and private industry on
issues that have statewide impact on information security and
privacy.

(b) An information security officer appointed pursuant to Section
11546.1 shall implement the policies and procedures issued by the
Office of Information Security, including, but not limited to,
performing both of the following duties:

(1) Comply with the information security and privacy policies,
standards, and procedures issued pursuant to this chapter by the
Office of Information Security.

(2) Comply with filing requirements and incident notification
by providing timely information and reports as required by policy
or directives of the office.

(c)  The office shall conduct, or require to be conducted, an
independent security assessment of every state agency, department,
or office at least once every two years. The cost of the security
assessment shall be funded by the state agency, department, or
office being assessed. begin insert The assessment results shall be made
available only to the assessed entity. end insert The assessment shall include,
begin delete at a minimum, end delete begin insert to the extent practicable, end insert all of the following
components, which shall be conducted in compliance with the
National Institute of Standards and Technology (NIST) Special
Publication (SP) 800-53 Controls:

begin delete

(1) A legal, policy, standards, and procedure compliance review.

end delete begin delete

(2)

end delete

begin insert (1) end insert  Vulnerability begin delete scanning. end delete begin insert scanning, that includes, but is not
limited to, all of the following: end insert

begin insert

(A) Validation that IT systems have currently supported
software, with all necessary security patches and updates applied.

end insert begin insert

(B) Validation that system security configurations are in
compliance with NIST standards.

end insert begin insert

(C) Validation that the network architecture is arranged so as
to separate internal, publicly accessible, and external zones, along
with a mechanism to identify and alert on attempted intrusions.

end insert begin delete

(3)

end delete

begin insert (2) end insert  Penetration begin delete testing. end delete begin insert testing, when determined appropriate
by the Governor’s Offices of Emergency Services. end insert

begin insert

(3) A report on the number, severity, and nature of identified
vulnerabilities and recommendations for remediation and risk
mitigation.

end insert

(d) The office shall report to the Department of Technology any
state agency found to be noncompliant with information security
program requirements.

(e) The Department of Technology may require that any agency
in noncompliance with subdivision (c) redirect any funds within
the agency’s budget, that may be legally expended for these
purposes, for the purposes of paying the costs of compliance with
subdivision (c).

(f) The begin delete Department of Technology and the end delete Governor’s Office
of Emergency Services may begin delete jointly end delete conduct the strategic direction
of begin delete risk end delete begin insert security end insert assessments performed by the Military
Department’s Computer Network Defense Team, as budgeted in
Item 8940-001-0001 of the Budget Act of 2014. begin insert Each assessment
shall include all of the following: end insert

begin insert

(1) Contracting and negotiations with state agencies,
departments, and offices, or private entities to be assessed.

end insert begin insert

(2) Setting an assessment calendar to be followed by the CND-T.

end insert begin insert

(3) Prioritizing of incident response.

end insert

(g) The Department of Technology shall adopt standards, to be
included within the State Administrative Manual, setting forth the
manner for the assessed agency to communicate the assessment
results to the department, including, but not limited to, all of the
following:

begin delete

(1) Identification of vulnerabilities.

end delete begin insert

(1) Aggregated, statistical information relevant to the assessment
results, including, but not limited to, the number of identified
vulnerabilities categorized by high, medium, and low risk. These
results shall not include any specific information relative to the
nature of the risk that is potentially exploitable.

end insert

(2) Prioritization of vulnerabilities.

(3) Identification of relevant internal resources.

(4) Strategy for addressing and mitigating those vulnerabilities.

begin insert

(h) Communication of assessment results shall be restricted to
only approved government employees and validated contractors.
Assessment results and related aggregated reports shall be
confidential and, pursuant to Section 6254.19, shall be exempt
from disclosure under the California Public Records Act (Chapter
3.5 (commencing with Section 6250) of Division 7 of Title 1).

end insert begin insert

(i) Data produced by assessments shall be retained by all parties
for no longer than one year, unless the Governor’s Office of
Emergency Services determines that retention for a longer period
is necessary.

end insert

begin insert

begin insert SEC. 2. end insert   

end insert begin insert

The Legislature finds and declares that Section 1 of
this act, which amends Section 11549.3 of the Government Code,
imposes a limitation on the public’s right of access to the meetings
of public bodies or the writings of public officials and agencies
within the meaning of Section 3 of Article I of the California
Constitution. Pursuant to that constitutional provision, the
Legislature makes the following findings to demonstrate the interest
protected by this limitation and the need for protecting that
interest:

end insert begin insert

The state has a very strong interest in protecting its information
technology systems from intrusion, because those systems play a
critical role in assisting the entities of state government in carrying
out their duties. Thus, information regarding the specific
vulnerabilities of those systems should be protected at least until
those vulnerabilities have been remediated so as to preclude use
of that information to facilitate attacks on those systems.

end insert