BILL ANALYSIS                                                                                                                                                                                                    



          SENATE COMMITTEE ON APPROPRIATIONS
                             Senator Ricardo Lara, Chair
                            2015 - 2016  Regular  Session

          AB 1841 (Irwin) - Cybersecurity incident response plan and  
          standards
          
           ----------------------------------------------------------------- 
          |                                                                 |
          |                                                                 |
          |                                                                 |
           ----------------------------------------------------------------- 
          |--------------------------------+--------------------------------|
          |                                |                                |
          |Version: April 14, 2016         |Policy Vote: G.O. 12 - 0, JUD.  |
          |                                |          7 - 0                 |
          |                                |                                |
          |--------------------------------+--------------------------------|
          |                                |                                |
          |Urgency: No                     |Mandate: No                     |
          |                                |                                |
          |--------------------------------+--------------------------------|
          |                                |                                |
          |Hearing Date: August 8, 2016    |Consultant: Debra Cooper        |
          |                                |                                |
           ----------------------------------------------------------------- 


          This bill meets the criteria for referral to the Suspense File.


          Bill  
          Summary:  AB 1841 would require the Office of Emergency Services  
          (OES), in conjunction with the Department of Technology (CDT) to  
          transmit a cybersecurity incident response plan to the  
          Legislature by July 1, 2017. This bill would also require  
          development of cybersecurity incident response standards for  
          state agencies by January 1, 2018.


          Fiscal  
          Impact:  


           Estimated costs to OES of $2.9 million in fiscal year 2016-17,  
            $1.5 million in 2017-18, and ongoing costs of $1.3 million per  
            year. (GF) These costs include: 

               -      One-time costs to OES for hardware, software, and  







          AB 1841 (Irwin)                                        Page 1 of  
          ?
          
          
                 personnel costs for development of a secure database.

               -      Properly retaining Protected Critical Infrastructure  
                 Information transmitted to Cal OES by state agencies.

               -      On-going database maintenance.

               -      Developing standards for state agencies that  
                 maintain critical infrastructure.

               -      Oversight to ensure that state agencies are meeting  
                 the standards.

               -      Six PY of staff in the Information Technology  
                 Services Division and the Critical Infrastructure  
                 Protection Unit to maintain, monitor, and manage system  
                 infrastructure.


           Ongoing, potentially significant cost pressure for state  
            entities to adopt cybersecurity incident response standards  
            developed by OES and to make necessary changes to address any  
            issues identified by OES concerning compliance with the  
            standards. (GF and/or Special Funds).  




          Background:  In 2013, the Governor administratively directed OES and CDT to  
          create a Cyber Security Task Force composed of specified  
          stakeholders, subject matter experts, and cyber security  
          professionals from public, private, academic, and law  
          enforcement sectors. The mission of the Task Force is to enhance  
          the security of California's digital infrastructure and to  
          create a culture of cybersecurity through collaboration,  
          information sharing, and education and awareness.
          The State Emergency Plan (SEP) addresses the state's response to  
          extraordinary emergency situations associated with natural  
          disasters or human-caused emergencies. The most recent SEP,  
          prepared by OES in 2009 outlined a state-level strategy to  
          support local government efforts during large scale emergencies.  
          The 2009 SEP established 18 Emergency Functions (EF 18) that are  
          primary activities essential for state entities to work together  
          to address emergency management needs. According to OES's  








          AB 1841 (Irwin)                                        Page 2 of  
          ?
          
          
          website, EF 18 is the only incomplete component of the SEP. One  
          of the 18 incomplete EF 18 functions is cybersecurity.


          According to the California Military Department, California's  
          size and importance makes it vulnerable to cyber incidents that  
          disrupt business, shutdown critical infrastructure, and  
          compromise intellectual property or national security. The  
          owners and operators of California's infrastructure such as  
          power plants, water distribution systems, refineries, and  
          communications equipment have largely replaced analog control  
          systems with digital controls, often connected through computer  
          networks. These updated systems make management of critical  
          infrastructure more efficient but also more vulnerable to  
          cyber-attack.


          According to the author, the State Emergency Plan does not  
          currently have an established cybersecurity strategy or an  
          incident response plan to account for cybersecurity risks  
          imposed on the state and general public. 




          Proposed Law:  
            This bill would:
           Require OES, in conjunction with CDT, on or before July 1,  
            2017, to transmit to the Legislature, a cybersecurity plan  
            that includes, but is not limited to:
               -      Methods for providing emergency services;
               -      Command structure for statewide coordinated  
                 emergency services;
               -      Emergency service roles of appropriate state  
                 agencies;
               -      Identification of resources to be mobilized;
               -      Public information plans;
               -      Continuity of government services.
           Require OES, on or before January 1, 2018, in conjunction with  
            CDT, to develop cybersecurity incident response standards for  
            state agencies to prepare for cybersecurity interference with,  
            or the compromise or incapacitation of, critical  
            infrastructure and for the development and transmission of  
            critical infrastructure information to OES. In development of  








          AB 1841 (Irwin)                                        Page 3 of  
          ?
          
          
            the standards, OES shall consider the following:
               -      Costs to implement the standards;
               -      Security of critical infrastructure information; 
               -      Centralized management of risk;
               -      Industry best practices;
               -      Continuity of operations;
               -      Protection of personal information.
           Require each state agency to report on its compliance with the  
            standards by January 1, 2019, and directs OES, in conjunction  
            with CDT, to provide suggestions for state agencies to improve  
            compliance with the standards. 
           Specify that the report and communications required under this  
            provision are confidential and shall not be disclosed pursuant  
            to any state law including the California Public Records Act. 




          Related  
          Legislation:  
          SB 949 (Jackson, 2016) would have authorized the Governor to  
          require owners and operators of critical infrastructure, as  
          defined to submit critical infrastructure information to OES.  
          This bill was referred to the Senate Governmental Organization  
          Committee but never heard. 


          AB 1346 (Gray, 2016) would require OES to update the SEP on or  
          before January 1, 2018 and every 5 years thereafter and would  
          require the plan to be consistent with specified state climate  
          adaptation strategies. This bill is pending in the Senate  
          Appropriations Committee.


          AB 2595 (Linder, 2016) would have established the California  
          Cybersecurity Integration Center within OES to develop a  
          cybersecurity strategy for California in coordination with the  
          Cybersecurity Task Force. This bill was held in the Assembly  
          Appropriations Committee.


          AB 670 (Irwin, Chapter 518, Statutes of 2015) requires CDT to  
          conduct, or require to be conducted, no fewer than 35  
          independent security assessments of state agencies, departments,  








          AB 1841 (Irwin)                                        Page 4 of  
          ?
          
          
          or offices annually.


          AB 1172 (Chau, 2015) would have continued in existence the  
          California Cybersecurity Task Force, created in 2013, by OES and  
          CDT. This bill was ordered to the Senate Inactive File.




          Staff  
          Comments:  This bill would require OES to collect protected  
          critical infrastructure information from all state agencies,  
          which OES does not currently do. In order to do this, OES would  
          have to create and maintain a secure "virtual infrastructure"  
          system that is appropriate for retaining this critical  
          information. The main source of costs in fiscal year 2016-17  
          would be development of such a system. An initial $1.5 million  
          would be needed for licensing and two limited term positions for  
          building the database and launching the system.
          The virtual infrastructure system would require an ongoing  
          $300,000 per year for licensing and maintaining the system. OES  
          estimates they would also need an additional 6 PY of staffing  
          for ongoing IT demands, critical infrastructure analysis, and  
          data entry and resolution.




                                      -- END --