Cybersecurity strategy incident response standards.

(1) The California Emergency Services Act sets forth the duties of the Office of Emergency Services with respect to specified emergency preparedness, mitigation, and response activities within the state. Existing law establishes the Department of Technology under the supervision of the Director of Technology who is also known as the State Chief Information Officer, and generally requires the Department of Technology to be responsible for the approval and oversight of information technology projects by, among other things, consulting with state agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs. Existing law establishes the Office of Information Security, within the Department of Technology, under the direction of a chief who reports to the Director of Technology. This bill would require the Department of Technology, in consultation with the Office of Emergency Services and compliance with the information security program required to be established by the chief of the Office of Information Security, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. The bill would require each state agency to provide its updated Technology Recovery Plan and report on its compliance with these updated standards to the department, as specified, and authorize the department, in consultation with the Office of Emergency Services, to provide suggestions for a state agency to improve compliance with these standards. The bill would define terms for its purposes and make legislative findings in support of its provisions. The bill would prohibit public disclosure of reports and public records relating to the cybersecurity strategies of state agencies, as specified. (2) Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.