BILL ANALYSIS                                                                                                                                                                                                    Ó



                                                                    AB 2595


                                                                    Page  1





          Date of Hearing:  May 18, 2016


                        ASSEMBLY COMMITTEE ON APPROPRIATIONS


                               Lorena Gonzalez, Chair


          AB  
          2595 (Linder) - As Amended March 30, 2016


           ----------------------------------------------------------------- 
          |Policy       |Privacy and Consumer           |Vote:|11-0         |
          |Committee:   |Protection                     |     |             |
          |             |                               |     |             |
          |             |                               |     |             |
          |-------------+-------------------------------+-----+-------------|
          |             |Governmental Organization      |     |19 - 0       |
          |             |                               |     |             |
          |             |                               |     |             |
          |-------------+-------------------------------+-----+-------------|
          |             |                               |     |             |
          |             |                               |     |             |
          |             |                               |     |             |
           ----------------------------------------------------------------- 


          Urgency:  No  State Mandated Local Program:  NoReimbursable:  No


          SUMMARY: This bill establishes the California Cybersecurity  
          Integration Center (Cal-CSIC) to develop a cybersecurity  
          strategy for California, and authorizes the administration of  
          federal homeland security grant funding by the Office of  
          Emergency Services.   Specifically, this bill:  










                                                                    AB 2595


                                                                    Page  2








          1)Establishes the California Cybersecurity Integration Center  
            (Cal-CSIC) within the Governor's Office of Emergency Services  
            (OES). 



          2)Requires Cal-CSIC to develop a cybersecurity strategy for  
            California in coordination with the Cybersecurity Task Force  
            (Task Force), and in accordance with state and federal  
            requirements, consistent with applicable standards and best  
            practices.



          3)Requires the Cal-CSIC to include, but not be limited to,  
            representatives of OES, the California Department of  
            Technology's (CDT) Office of Information Security (OIS), the  
            State Threat Assessment Center, the California Highway Patrol,  
            the California Military Department, the Office of the Attorney  
            General, the California Health and Human Services Agency, the  
            California Utilities Emergency Association, the California  
            State University, the University of California and the  
            California Community Colleges.



          4)Authorizes the Director of OES, in consultation with OIS or  
            the Task Force, to administer, authorize, and allocate federal  
            homeland security grant funding in accordance with federal  
            grant guidelines, and prioritize grant funding for prevention  
            measures undertaken by the OIS in furtherance of the provision  
            in the Governor's Executive order B-34-15.



          5)Provides that this authorization shall not preclude the  








                                                                    AB 2595


                                                                    Page  3





            Director of OES from administering the grant programs to  
            respond to statewide emergencies requiring immediate  
            attention.



          FISCAL EFFECT:


          By codifying an existing Executive Order, this bill creates  
          ongoing General Fund cost pressures to fund Cal-CSIC in  
          perpetuity, thereby removing the authority of the Governor to  
          modify or otherwise adjust the program in response to future  
          budget constraints.


          COMMENTS:


          1)Purpose.  This bill is intended to codify the new state CISC  
            created by Executive Order in 2015, and to provide more  
            specific guidance to OES regarding the expenditure of federal  
            grant money for cybersecurity purposes.  


            According to the author, "In 2013, Governor Brown reorganized  
            government to address the growing needs of technology by  
            creating the CDT and the Cybersecurity Task Force, which is  
            co-chaired by the department and the Governor's Office of  
            Emergency Services.  Since that time, however, there has been  
            no accounting of federal homeland security grant dollars that  
            could be used to fund cybersecurity prevention efforts by the  
            state. This bill is needed to require OES to administer  
            homeland security grant funding in a way that would be  
            beneficial for the state to reach its proper prevention levels  
            to protect against a cyberattack, intrusion, or data breach."


          2)Executive Order creating Cal-CSIC.  On August 31, 2015,  








                                                                    AB 2595


                                                                    Page  4





            Governor Brown signed Executive Order B-34-15 which noted the  
            increasing number and complexity of cyberattacks against  
            public and private networks, and in response announced the  
            establishment of the Cal-CSIC. 

          Cal-CSIC is charged with reducing the likelihood and severity of  
            a damaging cyber incident in California, and would serve as  
            the "central organizing hub" of state government's  
            cybersecurity activities and coordinate information sharing"  
            with a variety of government agencies.  It would be comprised  
            of representatives from at least 15 different state and  
            federal public entities, and its main functions would be  
            threat information sharing, risk assessment, threat  
            prioritization, supporting governmental audits and  
            accountability measures, enabling cross-sector coordination  
            and sharing of best practices.  Cal-CSIC would also be  
            responsible for developing a statewide cybersecurity strategy.  




            The authorization provided by this bill differs from the  
            Executive Order in a few substantial ways.  This bill omits  
            four federal partner agencies and other members designated by  
            OES, although they could be added at the discretion of the  
            Director of OES.  Also, the bill omits any mention of the  
            creation of a Cyber Incident Response Team, and also does not  
            require that information sharing be conducted in a manner that  
            protects the privacy and civil liberties of individuals,  
            safeguards sensitive information, and preserves business  
            confidentiality.  Staff notes that the Executive Branch  
            already has the authority to create and operate Cal-CSIC,  
            which is now far along in the development stage.  Codification  
            would remove the Governor's authority to unilaterally change  
            any of the provisions added to statute. 



          3)Related legislation.  This is one of five  








                                                                    AB 2595


                                                                    Page  5





            cybersecurity-related bills before this Committee today:


             a)   AB 1841 (Irwin) would require the state OES in  
               conjunction with the CDT to develop, by July 1, 2017, a  
               statewide emergency services response plan for  
               cybersecurity attacks against critical infrastructure (EF  
               18), and would require OES and CDT to develop a  
               comprehensive cybersecurity strategy by January 1, 2018,  
               with which all state agencies must report compliance by  
               January 1, 2019.  


             b)   AB 1881 (Chang) would require the Director of CDT to  
               develop and update mandatory baseline security controls for  
               state networks based industry and national standards, and  
               annually measure the state's progress towards compliance.





             c)   AB 2623 (Gordon) would require state agencies and  
               entities to report their information security expenditures  
               on an annual basis to the CDT, including the expenditure of  
               federal grant funds for information security purposes.



             d)   AB 2720 (Chau) would authorize the creation of a  
               Cybersecurity Vulnerability Reporting Reward Program that  
               would provide a monetary reward to eligible individuals who  
               identify and report previously unknown vulnerabilities in  
               state computer networks.
          












                                                                    AB 2595


                                                                    Page  6









          Analysis Prepared by:Jennifer Swenson / APPR. / (916)  
          319-2081