California Assembly Bill AB670 Amended / Bill

 BILL NUMBER: AB 670AMENDED BILL TEXT AMENDED IN ASSEMBLY APRIL 6, 2015 INTRODUCED BY Assembly Member Irwin FEBRUARY 25, 2015 An act to amend Section 11549.3 of the Government Code, relating to technology. LEGISLATIVE COUNSEL'S DIGEST AB 670, as amended, Irwin. Security assessments. Existing law establishes the Department of Technology within the Government Operations Agency, headed by the Director of Technology who is also known as the State Chief Information Officer. The department is responsible for the approval and oversight of information technology projects by, among other things, consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Technology Services within the department, under the supervision of the Chief of the Office of Technology Services, and sets forth its duties, including, but not limited to, the authority to conduct or require a security  assessments   assessment  of any state agency, as prescribed. This bill would, instead, require the office to conduct, or require, an assessment of every state agency at least once every 2 years and would require the state agency being audited to pay the costs of the security assessment. The bill would authorize the department to require agencies that are not in compliance to redirect available funding to pay the costs of the assessments. The bill would require the department to adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department. This bill would authorize  the department and  the Governor's Office of Emergency Services to  jointly  conduct the strategic direction of  risk   security  assessments performed by the Military Department' s Computer Network Defense Team  , and would require those assessments t   o contain certain elements  .  Existing law requires that a statute that limits the public's right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings to demonstrate the interest protected by the limitation and the need for protecting that interest.   This bill would limit access to security assessment results, and would make findings to demonstrate the interest protected by the limitation and the need for protecting that interest.  Vote: majority. Appropriation: no. Fiscal committee: yes. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 11549.3 of the Government Code is amended to read: 11549.3. (a) The director shall establish an information security program. The program responsibilities include, but are not limited to, all of the following: (1) The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual. (2) The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following: (A) Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines. (B) Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the Office of Information Security. (3) The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents. (4) The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each agency's disaster recovery plan. (5) Coordination of the activities of agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards. (6) Promotion and enhancement of the state agencies' risk management and privacy programs through education, awareness, collaboration, and consultation. (7) Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy. (b) An information security officer appointed pursuant to Section 11546.1 shall implement the policies and procedures issued by the Office of Information Security, including, but not limited to, performing both of the following duties: (1) Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the Office of Information Security. (2) Comply with filing requirements and incident notification by providing timely information and reports as required by policy or directives of the office. (c) The office shall conduct, or require to be conducted, an independent security assessment of every state agency, department, or office at least once every two years. The cost of the security assessment shall be funded by the state agency, department, or office being assessed.  The assessment results shall be made available only to the assessed entity.  The assessment shall include,  at a minimum,   to the extent practicable,  all of the following components, which shall be conducted in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Controls:  (1) A legal, policy, standards, and procedure compliance review.   (2)   (1)  Vulnerability  scanning.   scanning, that includes, but is not limited to, all of the following:   (A) Validation that IT systems have currently supported software, with all necessary security patches and updates applied.   (B) Validation that system security configurations are in compliance with NIST standards.   (C) Validation that the network architecture is arranged so as to separate internal, publicly accessible, and external zones, along with a mechanism to identify and alert on attempted intrusions.   (3)   (2)  Penetration  testing.   testing, when determined appropriate by the Governor's Offices of Emergency Services.   (3) A report on the number, severity, and nature of identified vulnerabilities and recommendations for remediation and risk mitigation.  (d) The office shall report to the Department of Technology any state agency found to be noncompliant with information security program requirements. (e) The Department of Technology may require that any agency in noncompliance with subdivision (c) redirect any funds within the agency's budget, that may be legally expended for these purposes, for the purposes of paying the costs of compliance with subdivision (c). (f) The  Department of Technology and the  Governor's Office of Emergency Services may  jointly  conduct the strategic direction of  risk   security  assessments performed by the Military Department' s Computer Network Defense Team, as budgeted in Item 8940-001-0001 of the Budget Act of 2014.  Each assessment shall include all of the following:   (1) Contracting and negotiations with state agencies, departments, and offices, or private entities to be assessed.   (2) Setting an assessment calendar to be followed by the CND-T.   (3) Prioritizing of incident response.  (g) The Department of Technology shall adopt standards, to be included within the State Administrative Manual, setting forth the manner for the assessed agency to communicate the assessment results to the department, including, but not limited to, all of the following:  (1) Identification of vulnerabilities.   (1) Aggregated, statistical information relevant to the assessment results, including, but not limited to, the number of identified vulnerabilities categorized by high, medium, and low risk. These results shall not include any specific information relative to the nature of the risk that is potentially exploitable.  (2) Prioritization of vulnerabilities. (3) Identification of relevant internal resources. (4) Strategy for addressing and mitigating those vulnerabilities.  (h) Communication of assessment results shall be restricted to only approved government employees and validated contractors. Assessment results and related aggregated reports shall be confidential and, pursuant to Section 6254.19, shall be exempt from disclosure under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1).   (i) Data produced by assessments shall be retained by all parties for no longer than one year, unless the Governor's Office of Emergency Services determines that retention for a longer period is necessary.   SEC. 2.   The Legislature finds and declares that Section 1 of this act, which amends Section 11549.3 of the Government Code, imposes a limitation on the public's right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:   The state has a very strong interest in protecting its information technology systems from intrusion, because those systems play a critical role in assisting the entities of state government in carrying out their duties. Thus, information regarding the specific vulnerabilities of those systems should be protected at least until those vulnerabilities have been remediated so as to preclude use of that information to facilitate attacks on those systems.