HSB 15

This bill creates a cybersecurity unit under the office of the chief information officer. The office shall be administered by the chief information officer. _____ The bill defines “cybersecurity incident” to mean a violation, or imminent threat of violation, of computer security policies, acceptable use policies, or cybersecurity practices. The bill provides that the cybersecurity unit shall be responsible for managing and coordinating cyber and computer security for the state and political subdivisions of the state. Annually or at the request of the general assembly, the unit will provide a report including the number of cybersecurity incidents since the last report and updated recommendations for cybersecurity practices. If a request is made by the general assembly, the unit shall provide a report within days of the receipt of the request. The bill provides a reporting mechanism and criteria for the state or political subdivisions of the state to inform the cybersecurity unit of cybersecurity incidents. Cybersecurity incidents shall be reported to the office no later than days following an incident. The bill provides that the office shall provide information to political subdivisions or businesses operating in the state regarding cybersecurity incidents. The information shall include the nature of the cybersecurity attack, the actors perpetrating the attack, and other relevant information businesses or political subdivisions should be aware of to protect information systems. The office shall establish reporting procedures required by rule and distribute the procedures to the state and political subdivisions of the state.