This section adds a new section to an existing chapter 43.105. Here is the modified chapter for context.
The office of cybersecurity is created within the office of the chief information officer.
The director shall appoint a state chief information security officer, who is the director of the office of cybersecurity.
The primary duties of the office of cybersecurity are:
To establish security standards and policies to ensure the confidentiality, availability, and integrity of the information transacted, stored, or processed in the state's information technology systems and infrastructure;
To develop a centralized cybersecurity protocol for protecting and managing state information technology assets;
To detect and respond to levels of security incidents consistent with information security standards and policies;
To ensure the continuity of state business and information resources that support the operations and assets of state agencies in the event of a security incident;
To provide formal guidance to agencies on leading practices and standards to ensure a whole government approach to cybersecurity;
To serve as a resource for local and municipal governments in Washington in the area of cybersecurity;
To develop a service catalog of cybersecurity services to be offered to state and local governments;
To define core services that must be managed by agency information technology security programs; and
To perform all other matters and things necessary to carry out the purposes of this chapter.
Each state agency, institution of higher education, the legislature, and the judiciary must develop an information technology security program.
[Empty]
Each state agency information technology security program must adhere to the office of cybersecurity's security standards and policies. Each state agency must review and update its program annually, certify to the office of cybersecurity that its program is in compliance with the office of cybersecurity's security standards and policies, and provide the office of cybersecurity with a list of the agency's cybersecurity business needs and agency program metrics.
The office shall require a state agency to obtain an independent compliance audit of its information technology security program and controls at least once every three years to determine whether the state agency's information technology security program is in compliance with the standards and policies established by the agency and that security controls identified by the state agency in its security program are operating efficiently.
In the case of institutions of higher education, the judiciary, and the legislature, each information technology security program must be comparable to the intended outcomes of the office of cybersecurity's security standards and policies.
This section adds a new section to an existing chapter 43.105. Here is the modified chapter for context.
By July 1, 2022, the office of cybersecurity, in collaboration with state agencies, shall develop a catalog of cybersecurity services and functions for the office of cybersecurity to perform and submit a report to the legislature and governor. The report must include, but not be limited to:
Cybersecurity services and functions to include in the office of cybersecurity's catalog of services that should be performed by the office of cybersecurity;
Core capabilities and competencies of the office of cybersecurity;
Security functions which should remain within agency information technology security programs; and
A recommended model for accountability of agency security programs to the office of cybersecurity.
The office of cybersecurity shall update and publish its catalog of services and performance metrics on a biennial basis. The office of cybersecurity shall use data and information provided from agency security programs to inform the updates to its catalog of services and performance metrics.
To ensure alignment with enterprise information technology security strategy, the office of cybersecurity shall develop a process for reviewing and evaluating agency proposals for additional cybersecurity services consistent with RCW 43.105.255.
This section adds a new section to an existing chapter 43.105. Here is the modified chapter for context.
In the event of a major cybersecurity incident, state agencies must report that incident to the office of cybersecurity within 24 hours of discovery of the incident.
State agencies must provide the office of cybersecurity with contact information for any external parties who have material information related to the cybersecurity incident.
Once a cybersecurity incident is reported to the office of cybersecurity, the office of cybersecurity must investigate the incident to determine the degree of severity and coordinate incident response.
The chief information security officer or the chief information security officer's designee shall serve as the state's point of contact for all cybersecurity incidents.
The office of cybersecurity must create policy to implement this section.
The office of privacy and data protection, in collaboration with the office of the attorney general, shall research and examine existing best practices for data governance and data protection including but not limited to model terms for data sharing contracts and adherence to privacy principles.
The office of privacy and data protection must submit a report of its findings and identify specific recommendations to the governor and the appropriate committees of the legislature by December 1, 2021.
This section expires December 31, 2021.