Department of Technology: information security officer basic training.

Existing law establishes, within the Government Operations Agency, the Department of Technology. Under existing law, the department is required to improve the governance and implementation of information technology by standardizing reporting relationships, roles, and responsibilities for setting information technology priorities. Existing law requires the head, or head's designee, of each state entity to appoint an information security officer, who reports to the chief information officer of that entity. Existing law requires the department to develop specific qualification criteria for an information security officer. Existing law establishes, within the department, the Office of Information Security under the supervision of the Chief of the Office of Information Security. Under existing law, the chief is required, among other things, to establish an information security program, as prescribed. This bill would require every information security officer appointed on or after January 1, 2021, to complete, within the first 3 months of appointment, a basic training course for information security officers that is offered by the office. The bill would also require the Chief of the office to create and provide that basic training course for information security officers.