| Old | New | Differences | |
|---|---|---|---|
| 1 | - | ||
| 1 | + | Amended IN Senate June 08, 2022 Amended IN Assembly January 24, 2022 Amended IN Assembly March 25, 2021 CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION Assembly Bill No. 581Introduced by Assembly Member IrwinFebruary 11, 2021 An act to add Section 11549.3.5 to the Government Code, relating to cybersecurity. LEGISLATIVE COUNSEL'S DIGESTAB 581, as amended, Irwin. Cybersecurity. Existing law establishes the Office of Information Security within the Department of Technology, under the direction of the Chief of the Office of Information Security, for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires an entity within the executive branch that is under the direct authority of the Governor to implement the policies and procedures issued by the office. The law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. The law authorizes the Military Department to perform an independent security assessment of any state agency, department, or office.This bill would require all state agencies, as generally defined, to review and implement specified National Institute of Standards and Technology (NIST) guidelines for, among other things, reporting, coordinating, publishing, and receiving information about a security vulnerability relating to information systems and the resolution thereof, no later than July 1, 2023. The bill would require the chief to review the NIST guidelines and to create, update, and publish any appropriate standards or procedures in the State Administrative Manual and Statewide Information Management Manual to apply the NIST guidelines to state agencies and state entities no later than April 1, 2023. The bill would authorize a state agency, and require certain state agencies and state entities, to satisfy their requirement to implement NIST guidelines by adopting those standards and procedures published in the State Administrative Manual and Statewide Information Management Manual. The bill would require the office to provide assistance to any state agency or state entity that requests assistance in implementing the guidelines or the standards and procedures, and to provide operational and technical assistance to state agencies and state entities on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems, until that agency or entity withdraws their request for assistance with implementation or cybersecurity.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. The Legislature finds and declares all of the following:(a) On December 4, 2020, House Resolution 1668, the Internet of Things Cybersecurity Improvement Act of 2020, became Public Law 116-207.(b) Section 5 of Public Law 116-207 requires the Director of the National Institute of Standards and Technology (NIST) to publish guidelines by June 2, 2021, for both of the following:(1) Reporting, coordinating, publishing, and receiving of information about both of the following:(A) A security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency).(B) The resolution of that security vulnerability.(2) For a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing that information system to that contractor, on both of the following:(A) Receiving information about a potential security vulnerability relating to the information system.(B) Disseminating information about the resolution of a security vulnerability relating to the information system.(c) In June 2021, NIST published Draft NIST Special Publication 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines to comply with the requirements of Public Law 116-207. (d) Section 6 of Public Law 116-207 requires all federal agencies, by December 4, 2022, to develop and oversee the implementation of policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems consistent with the standards published by NIST.SEC. 2. Section 11549.3.5 is added to the Government Code, to read:11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 2 | 2 | ||
| 3 | - | ||
| 3 | + | Amended IN Senate June 08, 2022 Amended IN Assembly January 24, 2022 Amended IN Assembly March 25, 2021 CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION Assembly Bill No. 581Introduced by Assembly Member IrwinFebruary 11, 2021 An act to add Section 11549.3.5 to the Government Code, relating to cybersecurity. LEGISLATIVE COUNSEL'S DIGESTAB 581, as amended, Irwin. Cybersecurity. Existing law establishes the Office of Information Security within the Department of Technology, under the direction of the Chief of the Office of Information Security, for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires an entity within the executive branch that is under the direct authority of the Governor to implement the policies and procedures issued by the office. The law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. The law authorizes the Military Department to perform an independent security assessment of any state agency, department, or office.This bill would require all state agencies, as generally defined, to review and implement specified National Institute of Standards and Technology (NIST) guidelines for, among other things, reporting, coordinating, publishing, and receiving information about a security vulnerability relating to information systems and the resolution thereof, no later than July 1, 2023. The bill would require the chief to review the NIST guidelines and to create, update, and publish any appropriate standards or procedures in the State Administrative Manual and Statewide Information Management Manual to apply the NIST guidelines to state agencies and state entities no later than April 1, 2023. The bill would authorize a state agency, and require certain state agencies and state entities, to satisfy their requirement to implement NIST guidelines by adopting those standards and procedures published in the State Administrative Manual and Statewide Information Management Manual. The bill would require the office to provide assistance to any state agency or state entity that requests assistance in implementing the guidelines or the standards and procedures, and to provide operational and technical assistance to state agencies and state entities on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems, until that agency or entity withdraws their request for assistance with implementation or cybersecurity.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO | |
| 4 | 4 | ||
| 5 | - | ||
| 5 | + | Amended IN Senate June 08, 2022 Amended IN Assembly January 24, 2022 Amended IN Assembly March 25, 2021 | |
| 6 | 6 | ||
| 7 | - | Amended IN Senate June 20, 2022 | |
| 8 | 7 | Amended IN Senate June 08, 2022 | |
| 9 | 8 | Amended IN Assembly January 24, 2022 | |
| 10 | 9 | Amended IN Assembly March 25, 2021 | |
| 11 | 10 | ||
| 12 | 11 | CALIFORNIA LEGISLATURE 20212022 REGULAR SESSION | |
| 13 | 12 | ||
| 14 | 13 | Assembly Bill | |
| 15 | 14 | ||
| 16 | 15 | No. 581 | |
| 17 | 16 | ||
| 18 | 17 | Introduced by Assembly Member IrwinFebruary 11, 2021 | |
| 19 | 18 | ||
| 20 | 19 | Introduced by Assembly Member Irwin | |
| 21 | 20 | February 11, 2021 | |
| 22 | 21 | ||
| 23 | 22 | An act to add Section 11549.3.5 to the Government Code, relating to cybersecurity. | |
| 24 | 23 | ||
| 25 | 24 | LEGISLATIVE COUNSEL'S DIGEST | |
| 26 | 25 | ||
| 27 | 26 | ## LEGISLATIVE COUNSEL'S DIGEST | |
| 28 | 27 | ||
| 29 | 28 | AB 581, as amended, Irwin. Cybersecurity. | |
| 30 | 29 | ||
| 31 | 30 | Existing law establishes the Office of Information Security within the Department of Technology, under the direction of the Chief of the Office of Information Security, for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires an entity within the executive branch that is under the direct authority of the Governor to implement the policies and procedures issued by the office. The law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. The law authorizes the Military Department to perform an independent security assessment of any state agency, department, or office.This bill would require all state agencies, as generally defined, to review and implement specified National Institute of Standards and Technology (NIST) guidelines for, among other things, reporting, coordinating, publishing, and receiving information about a security vulnerability relating to information systems and the resolution thereof, no later than July 1, 2023. The bill would require the chief to review the NIST guidelines and to create, update, and publish any appropriate standards or procedures in the State Administrative Manual and Statewide Information Management Manual to apply the NIST guidelines to state agencies and state entities no later than April 1, 2023. The bill would authorize a state agency, and require certain state agencies and state entities, to satisfy their requirement to implement NIST guidelines by adopting those standards and procedures published in the State Administrative Manual and Statewide Information Management Manual. The bill would require the office to provide assistance to any state agency or state entity that requests assistance in implementing the guidelines or the standards and procedures, and to provide operational and technical assistance to state agencies and state entities on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems, until that agency or entity withdraws their request for assistance with implementation or cybersecurity. | |
| 32 | 31 | ||
| 33 | 32 | Existing law establishes the Office of Information Security within the Department of Technology, under the direction of the Chief of the Office of Information Security, for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. The law requires an entity within the executive branch that is under the direct authority of the Governor to implement the policies and procedures issued by the office. The law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. The law authorizes the Military Department to perform an independent security assessment of any state agency, department, or office. | |
| 34 | 33 | ||
| 35 | 34 | This bill would require all state agencies, as generally defined, to review and implement specified National Institute of Standards and Technology (NIST) guidelines for, among other things, reporting, coordinating, publishing, and receiving information about a security vulnerability relating to information systems and the resolution thereof, no later than July 1, 2023. The bill would require the chief to review the NIST guidelines and to create, update, and publish any appropriate standards or procedures in the State Administrative Manual and Statewide Information Management Manual to apply the NIST guidelines to state agencies and state entities no later than April 1, 2023. The bill would authorize a state agency, and require certain state agencies and state entities, to satisfy their requirement to implement NIST guidelines by adopting those standards and procedures published in the State Administrative Manual and Statewide Information Management Manual. The bill would require the office to provide assistance to any state agency or state entity that requests assistance in implementing the guidelines or the standards and procedures, and to provide operational and technical assistance to state agencies and state entities on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems, until that agency or entity withdraws their request for assistance with implementation or cybersecurity. | |
| 36 | 35 | ||
| 37 | 36 | ## Digest Key | |
| 38 | 37 | ||
| 39 | 38 | ## Bill Text | |
| 40 | 39 | ||
| 41 | - | The people of the State of California do enact as follows:SECTION 1. The Legislature finds and declares all of the following:(a) On December 4, 2020, House Resolution 1668, the Internet of Things Cybersecurity Improvement Act of 2020, became Public Law 116-207.(b) Section 5 of Public Law 116-207 requires the Director of the National Institute of Standards and Technology (NIST) to publish guidelines by June 2, 2021, for both of the following:(1) Reporting, coordinating, publishing, and receiving of information about both of the following:(A) A security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency).(B) The resolution of that security vulnerability.(2) For a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing that information system to that contractor, on both of the following:(A) Receiving information about a potential security vulnerability relating to the information system.(B) Disseminating information about the resolution of a security vulnerability relating to the information system.(c) In June 2021, NIST published Draft NIST Special Publication 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines to comply with the requirements of Public Law 116-207. (d) Section 6 of Public Law 116-207 requires all federal agencies, by December 4, 2022, to develop and oversee the implementation of policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems consistent with the standards published by NIST.SEC. 2. Section 11549.3.5 is added to the Government Code, to read:11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 40 | + | The people of the State of California do enact as follows:SECTION 1. The Legislature finds and declares all of the following:(a) On December 4, 2020, House Resolution 1668, the Internet of Things Cybersecurity Improvement Act of 2020, became Public Law 116-207.(b) Section 5 of Public Law 116-207 requires the Director of the National Institute of Standards and Technology (NIST) to publish guidelines by June 2, 2021, for both of the following:(1) Reporting, coordinating, publishing, and receiving of information about both of the following:(A) A security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency).(B) The resolution of that security vulnerability.(2) For a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing that information system to that contractor, on both of the following:(A) Receiving information about a potential security vulnerability relating to the information system.(B) Disseminating information about the resolution of a security vulnerability relating to the information system.(c) In June 2021, NIST published Draft NIST Special Publication 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines to comply with the requirements of Public Law 116-207. (d) Section 6 of Public Law 116-207 requires all federal agencies, by December 4, 2022, to develop and oversee the implementation of policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems consistent with the standards published by NIST.SEC. 2. Section 11549.3.5 is added to the Government Code, to read:11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 42 | 41 | ||
| 43 | 42 | The people of the State of California do enact as follows: | |
| 44 | 43 | ||
| 45 | 44 | ## The people of the State of California do enact as follows: | |
| 46 | 45 | ||
| 47 | 46 | SECTION 1. The Legislature finds and declares all of the following:(a) On December 4, 2020, House Resolution 1668, the Internet of Things Cybersecurity Improvement Act of 2020, became Public Law 116-207.(b) Section 5 of Public Law 116-207 requires the Director of the National Institute of Standards and Technology (NIST) to publish guidelines by June 2, 2021, for both of the following:(1) Reporting, coordinating, publishing, and receiving of information about both of the following:(A) A security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency).(B) The resolution of that security vulnerability.(2) For a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing that information system to that contractor, on both of the following:(A) Receiving information about a potential security vulnerability relating to the information system.(B) Disseminating information about the resolution of a security vulnerability relating to the information system.(c) In June 2021, NIST published Draft NIST Special Publication 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines to comply with the requirements of Public Law 116-207. (d) Section 6 of Public Law 116-207 requires all federal agencies, by December 4, 2022, to develop and oversee the implementation of policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems consistent with the standards published by NIST. | |
| 48 | 47 | ||
| 49 | 48 | SECTION 1. The Legislature finds and declares all of the following:(a) On December 4, 2020, House Resolution 1668, the Internet of Things Cybersecurity Improvement Act of 2020, became Public Law 116-207.(b) Section 5 of Public Law 116-207 requires the Director of the National Institute of Standards and Technology (NIST) to publish guidelines by June 2, 2021, for both of the following:(1) Reporting, coordinating, publishing, and receiving of information about both of the following:(A) A security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency).(B) The resolution of that security vulnerability.(2) For a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing that information system to that contractor, on both of the following:(A) Receiving information about a potential security vulnerability relating to the information system.(B) Disseminating information about the resolution of a security vulnerability relating to the information system.(c) In June 2021, NIST published Draft NIST Special Publication 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines to comply with the requirements of Public Law 116-207. (d) Section 6 of Public Law 116-207 requires all federal agencies, by December 4, 2022, to develop and oversee the implementation of policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems consistent with the standards published by NIST. | |
| 50 | 49 | ||
| 51 | 50 | SECTION 1. The Legislature finds and declares all of the following: | |
| 52 | 51 | ||
| 53 | 52 | ### SECTION 1. | |
| 54 | 53 | ||
| 55 | 54 | (a) On December 4, 2020, House Resolution 1668, the Internet of Things Cybersecurity Improvement Act of 2020, became Public Law 116-207. | |
| 56 | 55 | ||
| 57 | 56 | (b) Section 5 of Public Law 116-207 requires the Director of the National Institute of Standards and Technology (NIST) to publish guidelines by June 2, 2021, for both of the following: | |
| 58 | 57 | ||
| 59 | 58 | (1) Reporting, coordinating, publishing, and receiving of information about both of the following: | |
| 60 | 59 | ||
| 61 | 60 | (A) A security vulnerability relating to information systems owned or controlled by an agency (including Internet of Things devices owned or controlled by an agency). | |
| 62 | 61 | ||
| 63 | 62 | (B) The resolution of that security vulnerability. | |
| 64 | 63 | ||
| 65 | 64 | (2) For a contractor providing to an agency an information system (including an Internet of Things device) and any subcontractor thereof at any tier providing that information system to that contractor, on both of the following: | |
| 66 | 65 | ||
| 67 | 66 | (A) Receiving information about a potential security vulnerability relating to the information system. | |
| 68 | 67 | ||
| 69 | 68 | (B) Disseminating information about the resolution of a security vulnerability relating to the information system. | |
| 70 | 69 | ||
| 71 | 70 | (c) In June 2021, NIST published Draft NIST Special Publication 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines to comply with the requirements of Public Law 116-207. | |
| 72 | 71 | ||
| 73 | 72 | (d) Section 6 of Public Law 116-207 requires all federal agencies, by December 4, 2022, to develop and oversee the implementation of policies, principles, standards, or guidelines as may be necessary to address security vulnerabilities of information systems consistent with the standards published by NIST. | |
| 74 | 73 | ||
| 75 | - | SEC. 2. Section 11549.3.5 is added to the Government Code, to read:11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 74 | + | SEC. 2. Section 11549.3.5 is added to the Government Code, to read:11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 76 | 75 | ||
| 77 | 76 | SEC. 2. Section 11549.3.5 is added to the Government Code, to read: | |
| 78 | 77 | ||
| 79 | 78 | ### SEC. 2. | |
| 80 | 79 | ||
| 81 | - | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 80 | + | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 82 | 81 | ||
| 83 | - | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 82 | + | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 84 | 83 | ||
| 85 | - | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 84 | + | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b).(2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b).(b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023.(c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time.(2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 86 | 85 | ||
| 87 | 86 | ||
| 88 | 87 | ||
| 89 | - | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b). | |
| 88 | + | 11549.3.5. (a) (1) All state agencies, as defined in Section 11000, shall review and implement the National Institute of Standards and Technology (NIST) guidelines established pursuant to Section 5 of Public Law 116-207 no later than July 1, 2023. A state agencys review and implementation of the guidelines may include modifying terms and structures applicable to federal entities to appropriately apply to a state agency. agency, including establishing procedures for receiving vulnerability information and resolving reported vulnerabilities. Any state agency may elect to satisfy this requirement by implementing the standards and procedures published pursuant to subdivision (b). | |
| 90 | 89 | ||
| 91 | 90 | (2) Notwithstanding paragraph (1), a state agency or state entity, as defined in subdivision (e) of Section 11546.1, shall satisfy the requirement to implement the guidelines by implementing the standards and procedures published pursuant to subdivision (b). | |
| 92 | 91 | ||
| 93 | 92 | (b) The chief shall review the NIST guidelines established pursuant to Section 5 of Public Law 116-207 and shall create, update, and publish any appropriate standards or procedures in the State Administrative Manual and State Information Management Manual to apply the NIST guidelines published pursuant to Section 5 of Public Law 116-207 to state agencies and state entities no later than April 1, 2023. | |
| 94 | 93 | ||
| 95 | 94 | (c) (1) Upon request by any state agency or state entity, the office shall provide assistance in implementing the guidelines referred to in subdivision (a) or the standards and procedures in subdivision (b). A state agency may withdraw their request and discontinue any assistance from the office at any time. | |
| 96 | 95 | ||
| 97 | 96 | (2) Upon request by any state agency or state entity, the office and the California Cybersecurity Integration Center shall provide operational and technical assistance on reporting, coordinating, publishing, and receiving information about cybersecurity vulnerabilities of information systems. A state agency may withdraw their request and discontinue any operational or technical assistance from the office or the center at any time. | |
| 98 | - | ||
| 99 | - | (d) This section shall apply to the University of California only to the extent that the Regents of the University of California, by resolution, make any of its provisions applicable to the university. |