Amended in Assembly April 14, 2016

Amended in Assembly March 28, 2016

California Legislature—2015–16 Regular Session

Assembly Bill No. 1841

Introduced by Assembly Member Irwin

February 9, 2016

An act to add Article 6.4 (commencing with Section 8592.30) to Chapter 7 of Division 1 of Title 2 of the Government Code, relating to begin delete emergency services. end delete begin insert state government. end insert

LEGISLATIVE COUNSEL’S DIGEST

AB 1841, as amended, Irwin. begin delete Office of Emergency Services: duties: cybersecurity. end delete begin insert Cybersecurity incident response plan and standards. end insert

(1) The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. begin insert Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. end insert

This bill would require the Office of Emergency begin delete Services end delete begin insert Services, in conjunction with the Department of Technology, end insert to transmit to the Legislature, on or before July 1, 2017, begin insert a cybersecurity incident response plan, known as end insert the Cyber Security Annex to the State Emergency Plan, begin delete also known as end delete Emergency Function begin delete 18 end delete begin insert 18, end insert or EF 18. The bill would further require the begin delete office end delete begin insert office, in conjunction with the Department of Technology and on or before January 1, 2018, end insert to develop begin delete a comprehensive end delete cybersecurity begin delete strategy setting end delete begin insert incident response end insert standards for state agencies, as defined, to, among other things, prepare for cybersecurity interference with, or the compromise or incapacitation of, critical infrastructure and would require state agencies to report begin delete its end delete begin insert their end insert compliance with these standards to the office. The bill would require the begin delete office end delete begin insert office end insert begin insert , in conjunction with the Department of Technology, end insert to provide suggestions for a state agency to improve compliance with these standards. The bill would prohibit public disclosure of begin insert reports and end insert public records relating to the cybersecurity strategies of state agencies, as specified.

(2) Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.

This bill would make legislative findings to that effect.

Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no.

The people of the State of California do enact as follows:

SECTION 1.  

The Legislature finds and declares all the
following:

(a) The current pervasive use of information technology in
public enterprises has resulted in an abundance of public access
to information and services provided by the government, but the
increased interdependence of information technology systems has
created a new type of risk for society. Threats to public critical
infrastructure that use information technology within the state
present risks to public health and safety and could severely disrupt
economic activity within California.

(b) Ensuring sufficient preparations are taken to protect critical
infrastructure from interference, compromise, or incapacitation
are in the public interest and serve a public purpose.

(c) A comprehensive cybersecurity begin delete strategy, end delete begin insert incident response
plan, end insert undertaken in a coordinated effort begin delete between end delete begin insert among end insert state
agencies, will help prepare for threats to critical infrastructure,
thereby reducing the potential consequences from those attacks.

(d) The Office of Emergency Services, in its role as the lead
executive entity that coordinates state resources for emergency
preparedness, response, and damage mitigation, is a state entity
appropriate to develop, implement, and manage a comprehensive
cybersecurity begin delete strategy, end delete begin insert incident response plan, end insert undertaken in a
coordinated effort begin delete between end delete begin insert among end insert state agencies, to protect critical
infrastructure. The Office of Emergency Services is already
developing the necessary expertise in cybersecurity through its
current work developing methods to provide emergency services
during an interference with, or the compromise or incapacitation
of, critical infrastructure.

(e) It is the intent of the Legislature in enacting this legislation
to develop a comprehensive cybersecurity begin delete strategy, end delete begin insert incident
response plan, end insert undertaken in a coordinated effort begin delete between end delete begin insert among end insert
state agencies, to prepare California for threats to critical
infrastructure under the unifying coordination of the Office of
Emergency Services.

SEC. 2.  

Article 6.4 (commencing with Section 8592.30) is
added to Chapter 7 of Division 1 of Title 2 of the Government
Code, to read:

 

Article 6.4.  Cybersecurity

 

8592.30.  

As used in this article, the following definitions shall
apply:

(a) “Critical infrastructure” means systems and assets so vital
to the state that the incapacity or destruction of those systems or
assets would have a debilitating impact on security, economic
security, public health and safety, or any combination of those
matters.

(b) “Critical infrastructure information” means information not
customarily in the public domain pertaining to any of the following:

(1) Actual, potential, or threatened interference with, or an attack
on, compromise of, or incapacitation of critical infrastructure by
either physical or computer-based attack or other similar conduct,
including, but not limited to, the misuse of, or unauthorized access
to, all types of communications and data transmission systems,
that violates federal, state, or local law, harms economic security,
or threatens public health or safety.

(2) The ability of critical infrastructure to resist any interference,
compromise, or incapacitation, including, but not limited to, any
planned or past assessment or estimate of the vulnerability of
critical infrastructure, including, but not limited to, security testing,
risk evaluation, risk management planning, or risk audits.

(3) Any planned or past operational problem or solution
regarding critical infrastructure, including, but not limited to, repair,
recovery, reconstruction, insurance, or continuity, to the extent it
is related to interference, compromise, or incapacitation of critical
infrastructure.

(c) “Secretary” means the secretary of each state agency as set
forth in subdivision (a) of Section 12800.

(d) “State agency” or “state agencies” means the same as “state
agency” as set forth in Section 11000.

8592.35.  

(a) On or before July 1, 2017, the begin delete office end delete begin insert office, in
conjunction with the Department of Technology, end insert shall transmit to
the Legislature begin insert a cybersecurity incident response plan, known as end insert
the Cyber Security Annex to the State Emergency Plan begin delete , also
known as end delete Emergency Function begin delete 18 end delete begin insert 18, end insert or EF 18, that includes, but
is not limited to, all of the following:

(1) Methods for providing emergency services.

(2) Command structure for begin delete state-wide end delete begin insert statewide end insert coordinated
emergency services.

(3) Emergency service roles of appropriate state agencies.

(4) Identification of resources to be mobilized.

(5) Public information plans.

(6) Continuity of government services.

(b) The office shall transmit the plan to the Legislature pursuant
to Section 9795.

8592.40.  

begin delete (a) end delete begin delete   end delete On or before begin delete July end delete begin insert January end insert 1, 2018, begin insert in conjunction
with the Department of Technology, end insert the office shall develop begin delete a
comprehensive end delete cybersecurity begin delete strategy setting end delete begin insert incident response end insert
standards for state agencies to prepare for cybersecurity
interference with, or the compromise or incapacitation of, critical
infrastructure and the development of critical infrastructure
information, and to transmit critical infrastructure information to
the office. In developing the standards, the office shall consider
all of the following:

begin delete

(1)

end delete

begin insert (a) end insert  Costs to implement the standards.

begin delete

(2)

end delete

begin insert (b) end insert  Security of critical infrastructure information.

begin delete

(3)

end delete

begin insert (c) end insert  Centralized management of risk.

begin delete

(4)

end delete

begin insert (d) end insert  National private industry best practices.

begin delete

(b) The office shall post the cybersecurity strategy on the
Internet Web site of the office and transmit a copy to each
secretary.

end delete

8592.45.  

(a) Each state agency shall report on begin delete their end delete begin insert its end insert
compliance with the standards developed pursuant to Section
8592.40 to the office in the manner and at the time directed by the
begin delete office end delete begin insert office, end insert but no later than January 1, 2019.

(b) The begin delete office end delete begin insert office, end insert begin insert in conjunction with the Department of
Technology, end insert shall provide suggestions for a state agency to improve
compliance with the standards developed pursuant to Section
8592.40, if any, to the head of the state agency and the secretary
responsible for the state agency. For a state agency that is not under
the responsibility of a secretary, the office shall provide any
suggestions to the head of the state agency and the Governor.

8592.50  

 The report required by subdivision (a) of Section
8592.45 and any public records relating to any communication
made pursuant to, or in furtherance of the purposes of, subdivision
(b) of Section 8592.45 are confidential and shall not be disclosed
pursuant to any state law, including, but not limited to, the
California Public Records Act (Chapter 3.5 (commencing with
Section 6250) of Division 7 of Title 1).

SEC. 3.  

The Legislature finds and declares that Section 2 of
this act, which adds Section 8592.50 to the Government Code,
imposes a limitation on the public’s right of access to the meetings
of public bodies or the writings of public officials and agencies
within the meaning of Section 3 of Article I of the California
Constitution. Pursuant to that constitutional provision, the
Legislature makes the following findings to demonstrate the interest
protected by this limitation and the need for protecting that interest:

Preventing public disclosure of the individual cybersecurity
preparations of state agencies promotes public safety by prohibiting
access to those who would use that information to thwart the
cybersecurity of critical infrastructure within the state.