(a) There is in state government, in the Department of
Technology, the Office of Information Security. The purpose of the
Office of Information Security is to ensure the confidentiality,
integrity, and availability of state systems and applications, and to
promote and protect privacy as part of the development and
operations of state systems and applications to ensure the trust of
the residents of this state.
(b) The office shall be under the direction of a chief, who shall
be appointed by, and serve at the pleasure of, the Governor. The
chief shall report to the Director of Technology, and shall lead the
Office of Information Security in carrying out its mission.
(c) The duties of the Office of Information Security, under the
direction of the chief, shall be to provide direction for information
security and privacy to state government agencies, departments, and
offices, pursuant to Section 11549.3.
(d) (1) Unless the context clearly requires otherwise, whenever
the term "Office of Information Security and Privacy Protection"
appears in any statute, regulation, or contract, it shall be deemed
to refer to the Office of Information Security, and whenever the term
"executive director of the Office of Information Security and
Privacy Protection" appears in statute, regulation, or contract, it
shall be deemed to refer to the Chief of the Office of Information
Security.
(2) All employees serving in state civil service, other than
temporary employees, who are engaged in the performance of functions
transferred from the Office of Information Security and Privacy
Protection to the Office of Information Security, are transferred to
the Office of Information Security. The status, positions, and rights
of those persons shall not be affected by their transfer and shall
continue to be retained by them pursuant to the State Civil Service
Act (Part 2 (commencing with Section 18500) of Division 5), except as
to positions the duties of which are vested in a position exempt
from civil service. The personnel records of all transferred
employees shall be transferred to the Office of Information Security.
(3) The property of any office, agency, or department related to
functions transferred to the Office of Information Security is
transferred to the Office of Information Security. If any doubt
arises as to where that property is transferred, the Department of
General Services shall determine where the property is transferred.
(4) All unexpended balances of appropriations and other funds
available for use in connection with any function or the
administration of any law transferred to the Office of Information
Security shall be transferred to the Office of Information Security
for the use and for the purpose for which the appropriation was
originally made or the funds were originally available. If there is
any doubt as to where those balances and funds are transferred, the
Department of Finance shall determine where the balances and funds
are transferred.
(a) The chief shall establish an information security
program. The program responsibilities include, but are not limited
to, all of the following:
(1) The creation, updating, and publishing of information security
and privacy policies, standards, and procedures for state agencies
in the State Administrative Manual.
(2) The creation, issuance, and maintenance of policies,
standards, and procedures directing state agencies to effectively
manage security and risk for both of the following:
(A) Information technology, which includes, but is not limited to,
all electronic technology systems and services, automated
information handling, system design and analysis, conversion of data,
computer programming, information storage and retrieval,
telecommunications, requisite system controls, simulation, electronic
commerce, and all related interactions between people and machines.
(B) Information that is identified as mission critical,
confidential, sensitive, or personal, as defined and published by the
office.
(3) The creation, issuance, and maintenance of policies,
standards, and procedures directing state agencies for the
collection, tracking, and reporting of information regarding security
and privacy incidents.
(4) The creation, issuance, and maintenance of policies,
standards, and procedures directing state agencies in the
development, maintenance, testing, and filing of each state agency's
disaster recovery plan.
(5) Coordination of the activities of state agency information
security officers, for purposes of integrating statewide security
initiatives and ensuring compliance with information security and
privacy policies and standards.
(6) Promotion and enhancement of the state agencies' risk
management and privacy programs through education, awareness,
collaboration, and consultation.
(7) Representing the state before the federal government, other
state agencies, local government entities, and private industry on
issues that have statewide impact on information security and
privacy.
(b) All state entities defined in Section 11546.1 shall implement
the policies and procedures issued by the office, including, but not
limited to, performing both of the following duties:
(1) Comply with the information security and privacy policies,
standards, and procedures issued pursuant to this chapter by the
office.
(2) Comply with filing requirements and incident notification by
providing timely information and reports as required by the office.
(c) (1) The office may conduct, or require to be conducted, an
independent security assessment of every state agency, department, or
office. The cost of the independent security assessment shall be
funded by the state agency, department, or office being assessed.
(2) In addition to the independent security assessments authorized
by paragraph (1), the office, in consultation with the Office of
Emergency Services, shall perform all the following duties:
(A) Annually require no fewer than thirty-five (35) state entities
to perform an independent security assessment, the cost of which
shall be funded by the state agency, department, or office being
assessed.
(B) Determine criteria and rank state entities based on an
information security risk index that may include, but not be limited
to, analysis of the relative amount of the following factors within
state agencies:
(i) Personally identifiable information protected by law.
(ii) Health information protected by law.
(iii) Confidential financial data.
(iv) Self-certification of compliance and indicators of unreported
noncompliance with security provisions in the following areas:
(I) Information asset management.
(II) Risk management.
(III) Information security program management.
(IV) Information security incident management.
(V) Technology recovery planning.
(C) Determine the basic standards of services to be performed as
part of independent security assessments required by this
subdivision.
(3) The Military Department may perform an independent security
assessment of any state agency, department, or office, the cost of
which shall be funded by the state agency, department, or office
being assessed.
(d) State agencies and entities required to conduct or receive an
independent security assessment pursuant to subdivision (c) shall
transmit the complete results of that assessment and recommendations
for mitigating system vulnerabilities, if any, to the office and the
Office of Emergency Services.
(e) The office shall report to the Department of Technology and
the Office of Emergency Services any state entity found to be
noncompliant with information security program requirements.
(f) (1) Notwithstanding any other law, during the process of
conducting an independent security assessment pursuant to subdivision
(c), information and records concerning the independent security
assessment are confidential and shall not be disclosed, except that
the information and records may be transmitted to state employees and
state contractors who have been approved as necessary to receive the
information and records to perform that independent security
assessment, subsequent remediation activity, or monitoring of
remediation activity.
(2) The results of a completed independent security assessment
performed pursuant to subdivision (c), and any related information
shall be subject to all disclosure and confidentiality provisions
pursuant to any state law, including, but not limited to, the
California Public Records Act (Chapter 3.5 (commencing with Section
6250) of Division 7 of Title 1), including, but not limited to,
Section 6254.19.
(g) The office may conduct or require to be conducted an audit of
information security to ensure program compliance, the cost of which
shall be funded by the state agency, department, or office being
audited.
(h) The office shall notify the Office of Emergency Services,
Department of the California Highway Patrol, and the Department of
Justice regarding any criminal or alleged criminal cyber activity
affecting any state entity or critical infrastructure of state
government.