State Information Technology.   General.  The Consolidated Technology Services Agency, also known as WaTech, supports state agencies as a centralized provider and procurer of information technology (IT) services.  The director of WaTech is the state Chief Information Officer (CIO).  Within WaTech, the Office of the Chief Information Officer (OCIO) has primary duties related to IT for state government, which include establishing statewide enterprise architecture and standards.

Cybersecurity.  The OCIO establishes security standards and policies to ensure the integrity of the information processed in the state's IT systems.  The CIO appoints the state Chief Information Security Officer (CISO).  Each institution of higher education, the Legislature, and the judiciary must develop an IT security program (program) that is comparable to the intended outcomes of OCIO security standards and policies.  Each state agency must develop a program, ensure it adheres to OCIO security standards and policies, and obtain an independent compliance audit of the program at least once every three years.

Office of the Chief Information Officer Policies.  The OCIO policy on securing IT assets requires agencies to implement common IT security standards.  A component of this policy outlines data security requirements such as data classification.  Agencies must classify data based on the sensitivity of the data.  Data must be translated to the following classification categories:

• category 1: public information;
• category 2: sensitive information;
• category 3: confidential information; and
• category 4: confidential information requiring special handling.

Agencies must ensure any sharing of data with the public complies with OCIO policies and other applicable regulations.  When sharing category 3 and above data outside of the agency, an agreement must be in place unless otherwise prescribed by law.  Encryption standards for category 3 and 4 data are specified.  Agencies must appropriately protect information transmitted electronically.

Office of Cybersecurity.  The Office of Cybersecurity (OCS) is created within the OCIO.  The CIO appoints the CISO.  The primary duties of the OCS are specified, such as establishing security standards and policies and developing a centralized cybersecurity protocol for managing state IT assets.

 
Programs required under current law must adhere to or be comparable to security standards and policies established by the OCS rather than the OCIO.  Current independent compliance audit requirements are maintained. If the audit identifies any failure to comply with standards or any other material cybersecurity risk, the OCS must require the agency to implement a plan to resolve the failure and monitor compliance.
 
Catalog of Services.  By July 1, 2022, the OCS, in collaboration with state agencies, must develop a catalog of cybersecurity services and functions for the OCS to perform, and submit a report to the Governor and the Legislature.  The OCS shall update and publish its catalog of services and performance metrics on a biennial basis.
 
Incident Response.  In the event of a major cybersecurity incident, state agencies must report that incident to the OCS within 24 hours of discovery of the incident.  State agencies must provide the OCS with contact information for any external parties with material information related to the incident.  The OCS must investigate the incident to determine the degree of severity and must serve as the state's point of contact for all major cybersecurity incidents to the extent permitted by other state and federal requirements.
 
Report on Data Governance.  The OCS, in collaboration with the Office of Privacy and Data Protection and the Office of the Attorney General, shall research existing best practices for data governance and data protection, including model terms for data sharing contracts, and submit a report to the Legislature by December 1, 2021.

Data Sharing Agreements.  Before an agency shares or requests category 3 or higher data, a written data sharing agreement that conforms to OCS policies must be in place.  This requirement does not limit audit authorities of the State Auditor.

• Modifies the primary duties of the OCS by clarifying what the established security standards and policies must address.
• Adds primary duties related to creating a model incident response plan, collaborating with agencies in developing standards, addressing the highest level of security required to protect confidential information, and specifying standards the office must rely upon when performing its duties.
• Authorizes the OCS to require agencies to implement a plan to resolve failures identified in required audits or reviews and specifies a process to monitor compliance.
• Specifies that the report to the legislature on the catalog of services must also include services required to protect confidential information processed in the state's IT systems.
• Qualifies that the OCS must facilitate an enterprise incident response and serve as the point of contact for all major cybersecurity incidents to the extent permitted by other state and federal requirements.
• Adds new sections requiring written data sharing agreements to be in place prior to the sharing category 3 or higher data between agencies.
• Requires the OCS, in collaboration with the OPDP and the Office of the Attorney General, to report on best practices for data governance.

The committee recommended a different version of the bill than what was heard.  PRO:  Cybersecurity should not be decentralized.  This bill provides a strong new tool for privacy protections that will not interfere with Constitutional requirements relative to audits.  This bill enables collaboration and improves the state's cybersecurity posture by providing clear guidelines and targets.