wa-law.org > bill > 2023-24 > SB 5518 > Substitute Bill

SB 5518 - Cybersecurity

Source

Section 1

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

Section 2

(1) There is hereby created the emergency management council (hereinafter called the council), to consist of not more than 21 members who shall be appointed by the adjutant general. The membership of the council shall include, but not be limited to, representatives of city and county governments, two representatives of federally recognized tribes, sheriffs and police chiefs, county coroners and medical examiners, the Washington state patrol, the military department, the department of ecology, state and local fire chiefs, seismic safety experts, state and local emergency management directors, search and rescue volunteers, medical professions who have expertise in emergency medical care, building officials, private industry, and the office of the superintendent of public instruction. The representatives of private industry shall include persons knowledgeable in emergency and hazardous materials management. The councilmembers shall elect a chair from within the council membership. The members of the council shall serve without compensation, but may be reimbursed for their travel expenses incurred in the performance of their duties in accordance with RCW 43.03.050 and 43.03.060 as now existing or hereafter amended.

Section 3

  1. The technology services board security subcommittee is created within the board. The membership of the technology services board security subcommittee is comprised of a subset of members appointed to the board, as determined by the chair of the technology services board. The chair may make additional appointments to the technology services board security subcommittee to ensure that relevant technology sectors are represented.

  2. The technology services board security subcommittee has the following powers and duties related to cybersecurity:

    a. Review emergent cyberattacks and threats to critical infrastructure sectors in order to identify existing gaps in state agency cybersecurity policies;

    b. Assess emerging risks to state agency information technology;

    c. Recommend a reporting and information sharing system to notify state agencies of new risks, risk treatment opportunities, and projected shortfalls in response and recovery;

    d. Recommend tabletop cybersecurity exercises, including data breach simulation exercises;

    e. Assist the office of cybersecurity created in RCW 43.105.450 in developing cybersecurity best practice recommendations for state agencies;

    1. Review the proposed policies and standards developed by the office of cybersecurity and recommend their approval to the full board;

    g. Review information relating to cybersecurity incidents and ransomware incidents to determine commonalities and develop best practice recommendations for public agencies; and

    1. Assist the agency and the military department in creating the state of cybersecurity report required in subsection (6) of this section.
  3. In providing staff support to the board, the agency shall work with the national institute of standards and technology and other federal agencies, private sector businesses, and private cybersecurity experts and bring their perspectives and guidance to the board for consideration in fulfilling its duties to ensure a holistic approach to cybersecurity in state government.

  4. To discuss sensitive security topics and information, the technology services board security subcommittee may hold a portion of its agenda in executive session closed to the public.

  5. The technology services board security subcommittee must meet quarterly. The technology services board security subcommittee must hold a joint meeting once a year with the cybersecurity advisory committee created in RCW 38.52.040(4).

  6. By December 1, 2023, and each December 1st thereafter, the military department and the agency are jointly responsible for providing a state of cybersecurity report to the governor and the appropriate committees of the legislature, consistent with RCW 43.01.036, specifying recommendations considered necessary to address cybersecurity in the state. The technology services board security subcommittee may identify as confidential, and not subject to public disclosure, those portions of the report as the technology services board security subcommittee deems necessary to protect the security of public and private cyber systems.

  7. In fulfilling its duties under this section, the agency and the technology services board security subcommittee shall collaborate with the military department and the cybersecurity advisory committee created in RCW 38.52.040(4).

  8. The reports produced and information compiled pursuant to this section are confidential and may not be disclosed under chapter 42.56 RCW.

Section 4

The reports and information, or those portions thereof that are designated confidential by the cybersecurity advisory committee under RCW 38.52.040(4) and the technology services board security subcommittee under section 3 of this act, are confidential and may not be disclosed under this chapter.

Section 5

  1. The department shall supervise and administer energy-related activities as specified in RCW 43.330.904 and shall advise the governor and the legislature with respect to energy matters affecting the state.

  2. In addition to other powers and duties granted to the department, the department shall have the following powers and duties:

    1. Prepare and update contingency plans for securing energy infrastructure against all physical and cybersecurity threats, and for implementation in the event of energy shortages or emergencies. The plans shall conform to chapter 43.21G RCW and shall include procedures for determining when these shortages or emergencies exist, the state officers and agencies to participate in the determination, and actions to be taken by various agencies and officers of state government in order to reduce hardship and maintain the general welfare during these emergencies. The department shall coordinate the activities undertaken pursuant to this subsection with other persons. The components of plans that require legislation for their implementation shall be presented to the legislature in the form of proposed legislation at the earliest practicable date. The department shall report to the governor and the legislature on probable, imminent, and existing energy shortages, and shall administer energy allocation and curtailment programs in accordance with chapter 43.21G RCW.

    2. Establish and maintain a central repository in state government for collection of existing data on energy resources, including:

      1. Supply, demand, costs, utilization technology, projections, and forecasts;

      2. Comparative costs of alternative energy sources, uses, and applications; and

      3. Inventory data on energy research projects in the state conducted under public and/or private auspices, and the results thereof.

    3. Coordinate federal energy programs appropriate for state-level implementation, carry out such energy programs as are assigned to it by the governor or the legislature, and monitor federally funded local energy programs as required by federal or state regulations.

    4. Develop energy policy recommendations for consideration by the governor and the legislature.

    5. Provide assistance, space, and other support as may be necessary for the activities of the state's two representatives to the Pacific northwest electric power and conservation planning council. To the extent consistent with federal law, the director shall request that Washington's councilmembers request the administrator of the Bonneville power administration to reimburse the state for the expenses associated with the support as provided in the Pacific Northwest Electric Power Planning and Conservation Act (P.L. 96-501).

    6. Cooperate with state agencies, other governmental units, and private interests in the prioritization and implementation of the state energy strategy elements and on other energy matters.

    7. Serve as the official state agency responsible for coordinating implementation of the state energy strategy.

    8. No later than December 1, 1982, and by December 1st of each even-numbered year thereafter, prepare and transmit to the governor and the appropriate committees of the legislature a report on the implementation of the state energy strategy and other important energy issues, as appropriate.

    9. Provide support for increasing cost-effective energy conservation, including assisting in the removal of impediments to timely implementation.

    10. Provide support for the development of cost-effective energy resources including assisting in the removal of impediments to timely construction.

    11. Adopt rules, under chapter 34.05 RCW, necessary to carry out the powers and duties enumerated in this chapter.

    12. Provide administrative assistance, space, and other support as may be necessary for the activities of the energy facility site evaluation council, as provided for in RCW 80.50.030.

    13. Appoint staff as may be needed to administer energy policy functions and manage energy facility site evaluation council activities. These employees are exempt from the provisions of chapter 41.06 RCW.

  3. To the extent the powers and duties set out under this section relate to energy education, applied research, and technology transfer programs they are transferred to Washington State University.

  4. To the extent the powers and duties set out under this section relate to energy efficiency in public buildings they are transferred to the department of enterprise services.


Created by @tannewt. Contribute on GitHub.