Director of Technology: state baseline security controls.

Existing law establishes within the Government Operations Agency the Department of Technology, under the supervision of the Director of Technology, also known as the State Chief Information Officer. Existing law requires the director to, among other things, advise the Governor on the strategic management and direction of the state's information technology resources and provide technology direction to agency and department chief information officers to ensure the integration of statewide technology initiatives. Existing law further requires the director to produce an annual information technology performance report that assesses and measures the state's progress toward specified goals. This bill would require the director to develop, tailor, and subsequently review and revise baseline security controls for the state based on emerging industry standards and baseline security controls published by the National Institute of Standards and Technology. The bill would require state agencies to comply with, and prohibit state agencies from tailoring their individual baseline security controls to fall below, the state baseline security controls. The bill would require that the director's annual information technology performance report also assess and measure the state's progress toward developing, tailoring, and complying with the state baseline security controls.