State Information Technology. General. The Consolidated Technology Services Agency, also known as WaTech, supports state agencies as a centralized provider and procurer of information technology (IT) services. The director of WaTech is the state Chief Information Officer (CIO). Within WaTech, the Office of the Chief Information Officer (OCIO) has primary duties related to IT for state government, which include establishing statewide enterprise architecture and standards.
Cybersecurity. The OCIO establishes security standards and policies to ensure the integrity of the information processed in the state's IT systems. The CIO appoints the state Chief Information Security Officer (CISO). Each institution of higher education, the Legislature, and the judiciary must develop an IT security program (program) that is comparable to the intended outcomes of OCIO security standards and policies. Each state agency must develop a program, ensure it adheres to OCIO security standards and policies, and obtain an independent compliance audit of the program at least once every three years.
Office of the Chief Information Officer Policies. The OCIO policy on securing IT assets requires agencies to implement common IT security standards. A component of this policy outlines data security requirements such as data classification. Agencies must classify data based on the sensitivity of the data. Data must be translated to the following classification categories:
Agencies must ensure any sharing of data with the public complies with OCIO policies and other applicable regulations. When sharing category 3 and above data outside of the agency, an agreement must be in place unless otherwise prescribed by law. Encryption standards for category 3 and 4 data are specified. Agencies must appropriately protect information transmitted electronically.
Office of Cybersecurity. The Office of Cybersecurity (OCS) is created within the OCIO. The CIO appoints the CISO. The primary duties of the OCS are specified, such as establishing security standards and policies and developing a centralized cybersecurity protocol for managing state IT assets.
Programs required under current law must adhere to or be comparable to security standards and policies established by the OCS rather than the OCIO. Current independent compliance audit requirements are maintained. If the audit identifies any failure to comply with standards or any other material cybersecurity risk, the OCS must require the agency to implement a plan to resolve the failure and monitor compliance.
Catalog of Services. By July 1, 2022, the OCS, in collaboration with state agencies, must develop a catalog of cybersecurity services and functions for the OCS to perform, and submit a report to the Governor and the Legislature. The OCS shall update and publish its catalog of services and performance metrics on a biennial basis.
Incident Response. In the event of a major cybersecurity incident, state agencies must report that incident to the OCS within 24 hours of discovery of the incident. State agencies must provide the OCS with contact information for any external parties with material information related to the incident. The OCS must investigate the incident to determine the degree of severity and must serve as the state's point of contact for all major cybersecurity incidents.
Report on Data Governance. The OCS, in collaboration with the Office of Privacy and Data Protection and the Office of the Attorney General, shall research existing best practices for data governance and data protection, including model terms for data sharing contracts, and submit a report to the Legislature by December 1, 2021.
Data Sharing Agreements. Before an agency shares or requests category 3 or higher data, a written data sharing agreement that conforms to OCS policies must be in place. This requirement does not limit audit authorities of the State Auditor.
Independent Security Audit. The Office of Financial Management must contract for an independent security evaluation audit of state agency IT. The independent audit team must include legislative members, who must be updated on the progress of the audit. The security evaluation must be submitted to the fiscal committees of the Legislature by August 31, 2022.
The committee recommended a different version of the bill than what was heard. PRO: Cybersecurity should not be decentralized. This bill provides a strong new tool for privacy protections that will not interfere with Constitutional requirements relative to audits. This bill enables collaboration and improves the state's cybersecurity posture by providing clear guidelines and targets.