Information security.

(1) Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires each state agency and certain designated state entities, on or before February 1 of each year, to submit to the Department of Technology a summary of their actual and projected information technology and telecommunications costs and a summary of their actual and projected information security costs, as specified. This bill would, instead, require each state agency to comply with those provisions and would define state agency for these purposes to mean every state office, officer, department, division, bureau, board, and commission, except for the California State University. (2) Existing law establishes the Office of Information Security within the Department of Technology, headed by the Chief of the Office of Information Security. Existing law requires the chief to establish an information security program and requires that program to include specified responsibilities, including coordinating the activities of state agency information security officers for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards. Existing law requires specified state entities to implement and comply with the policies and procedures issued by the office. This bill would require each state agency to comply with the policies and procedures issued by the Office of Information Security, and would define state agency for these purposes to mean every state office, officer, department, division, bureau, board, and commission, except for the California State University.