| TO: | Honorable Rodney Ellis, Chair, Senate Committee on Government Organization |
| FROM: | John S. O'Brien, Director, Legislative Budget Board |
| IN RE: | HB2233 by Corte, Frank (Relating to information technology security practices of state agencies.), Committee Report 2nd House, Substituted |
The bill would require that the Department of Information Resources establish standards for protection of state information resources; performing risk assessments; implementing of physical security and disaster recovery of computer systems.
The bill would require that the Department of Information Resources rank state agencies annually in order of priority for vulnerability assessments; conduct an annual statewide assessment of information technology security resources and practices and submit a report to the governor, lieutenant governor, the speaker of the house of representatives, and the state auditor's office no later than December 31 of each year.
The bill would require a state agency to promptly investigate, document, and report to the Department of Information Resources each suspected or confirmed computer incident that involves sensitive, confidential, or personally identifiable information; is critical in natures; or could be propagated to other state systems. The bill would also require state agencies to contact the Department of Information Resources and appropriate law enforcement and investigated authorities immediately if criminal activity is suspected regarding a computer incident.
The bill would require DIR to adopt rules to implement the investigation, documentation and reporting of computer incidents to DIR by state agencies.
| Source Agencies: | 308 State Auditor's Office, 313 Department of Information Resources, 405 Department of Public Safety
|
| LBB Staff: | JOB, MN, ES, MS, EP, KJG, RC
|