New Mexico 2023 Regular Session Status: Enacted 1 D cosponsors

SB 280 — CYBERSECURITY ACT

Last action — Signed

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. ✓
    Passed Senate
  4. ✓
    Passed House
  5. ✓
    To Executive
  6. 6
    Enacted

This bill has been enacted into law. Introduced January 30, 2023. Enacted.

Signed by Governor Michelle Lujan Grisham (Democratic) on April 04, 2023.

Prognosis

Advancing 54% · moderate confidence

Where this bill stands today.

Odds of enactment

High

How often bills like it became law.

  • Enacted

    Current position in the legislative process.

  • 2 sponsors

    2 primary, 0 co-sponsors signed on.

  • Single-party support

    Sponsorship is currently within one party (1 D).

Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.

Bill Text

What changed in the latest version

264 added · 462 removed

Plain-language change summary

The updated version of Bill SB 280 establishes a new Cybersecurity Office, which will be responsible for managing and protecting the state's information systems. It also creates the position of a State Chief Information Security Officer to oversee cybersecurity efforts and a Cybersecurity Advisory Committee to provide guidance. These changes are important because they aim to enhance the state's defenses against cyber attacks, ultimately protecting sensitive information and critical assets from potential threats. Additionally, the bill includes provisions for exempting certain discussions from open meeting laws to allow for more secure handling of sensitive cybersecurity matters.

→
Previous
Latest
SENATE FINANCE COMMITTEE SUBSTITUTE FOR SENATE RULES COMMITTEE SUBSTITUTE FOR SENATE BILL 280 56TH LEGISLATURE - STATEOFNEWMEXICO- FIRST SESSION, 2023 This document may incorporate amendments proposed by a committee, but not yet adopted, as well as amendments that have been adopted during the current legislative session.
AN ACT RELATING TO CYBERSECURITY;
The document is a tool to show amendments in context and cannot be used for the purpose of adding amendments to legislation.
h g o AN ACT t hr g e i k RELATING TO CYBERSECURITY;
h r i s CREATING THE CYBERSECURITY OFFICE;
CREATING THE CYBERSECURITY OFFICE;
h , t, CREATING THE POSITION OF STATE CHIEF INFORMATION SECURITY e u g e b l e e h OFFICER;
CREATING THE POSITION OF STATE CHIEF INFORMATION SECURITY OFFICER;
CREATING THE CYBERSECURITY ADVISORY n d d i = = o h COMMITTEE;
CREATING THE CYBERSECURITY ADVISORY COMMITTEE;
PROVIDING EXEMPTIONS TO THE OPEN MEETINGS ACT AND l ] b ,d i a º e INSPECTION OF PUBLIC RECORDS ACT;
PROVIDING EXEMPTIONS TO THE OPEN MEETINGS ACT AND INSPECTION OF PUBLIC RECORDS ACT;
REQUIRING REPORTS HAFCº ;
REQUIRING REPORTS.
r i = r t e w d m a n o MAKING AN APPROPRIATION»HAFC .
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:
d m :
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e e a n e d r e l u [ A d SFC/SRC/SB 280 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF NEW MEXICO:
[NEW MATERIAL] SHORT TITLE.--This act may be cited as the "Cybersecurity Act".
SHORT TITLE.--This act may be cited as the "Cybersecurity Act".
[NEW MATERIAL] DEFINITIONS.--As used in the Cybersecurity Act:
DEFINITIONS.--As used in the Cybersecurity Act:
"information security" means acts, practices or systems that eliminate or reduce the risk that legally protected information or information that could be used to h facilitate criminal activity is accessed or compromised through g o physical or electronic means;
"information security" means acts, practices or systems that eliminate or reduce the risk that legally SFC/SRC/SB 280 protected information or information that could be used to Page 1 facilitate criminal activity is accessed or compromised through physical or electronic means;
t hr g e i k D.
D.
"information technology" means computer h r i s hardware, storage media, networking equipment, physical h , t, devices, infrastructure, processes and code, firmware, software e u g e b l e e h and ancillary products and services, including:
"information technology" means computer hardware, storage media, networking equipment, physical devices, infrastructure, processes and code, firmware, software and ancillary products and services, including:
n d d i = = o h (1) systems design and analysis;
(1) systems design and analysis;
l ] b ,d i a º e (2) development or modification of hardware or r i = r t e w d m a n o solutions used to create, process, store, secure or exchange d m :
(2) development or modification of hardware or solutions used to create, process, store, secure or exchange electronic data;
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 2 - e a n e d r e l u [ A d SFC/SRC/SB 280 electronic data;
(3) information storage and retrieval;
(3) information storage and retrieval systems;
(4) voice, radio, video and data communications;
(4) voice, radio, video and data communication systems;
[NEW MATERIAL ] CYBERSECURITY OFFICE CREATED-- SECURITY OFFICER--DUTIES AND POWERS.-- A.
CYBERSECURITY OFFICE CREATED--SECURITY OFFICER--DUTIES AND POWERS.-- A.
The "cybersecurity office" is created and is administratively attached to the department of information technology.
The "cybersecurity office" is created and is administratively attached to the department of information SFC/SRC/SB 280 Page 2 technology.
The office shall be managed by the security h officer.
The office shall be managed by the security officer.
g o B.
B.
Except as required by federal law, the t hr g e cybersecurity office shall oversee, in a fiscally responsible i k h r i s manner, cybersecurity- and information security-related h , t, functions for agencies and may:
Except as required by federal law, the cybersecurity office shall oversee, in a fiscally responsible manner, cybersecurity- and information security-related functions for agencies and may:
e u g e b l (1) adopt and implement rules establishing e e h n d d i minimum security standards and policies to protect agency = = o h l ] b ,d i a º e information technology systems and infrastructure and provide r i = r t e w d appropriate governance and application of the standards and m a n o d m :
(1) adopt and implement rules establishing minimum security standards and policies to protect agency information technology systems and infrastructure and provide appropriate governance and application of the standards and policies across information technology resources used by agencies to promote the availability, security and integrity of the information processed, transacted or stored by agencies in the state's information technology infrastructure and systems;
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 3 - e a n e d r e l u [ A d SFC/SRC/SB 280 policies across information technology resources used by agencies to promote the availability, security and integrity of the information processed, transacted or stored by agencies in the state's information technology infrastructure and systems;
(4) as reasonably necessary to perform its monitoring and detection duties, obtain agency system logs to support monitoring and detection pursuant to Paragraph (3) of this subsection;
(4) as reasonably necessary to perform its monitoring and detection duties, obtain agency system event SFC/SRC/SB 280 Page 3 logs to support monitoring and detection pursuant to Paragraph (3) of this subsection;
h (5) in coordination with state and federal g o cybersecurity emergency management agencies as appropriate, t hr g e i k create a model incident-response plan for public bodies to h r i s adopt with the cybersecurity office as the incident-response h , t, coordinator for incidents that:
(5) in coordination with state and federal cybersecurity emergency management agencies as appropriate, create a model incident-response plan for public bodies to adopt with the cybersecurity office as the incident-response coordinator for incidents that:
e u g e b l e e h (a) impact multiple public bodies;
(a) impact multiple public bodies;
n d d i = = o h (b) impact more than ten thousand l ] b ,d i a º e residents of the state;
(b) impact more than ten thousand residents of the state;
r i = r t e w d (c) involve a nation-state actor;
(c) involve a nation-state actor;
or m a n o d m :
or (d) involve the marketing or transfer of confidential data derived from a breach of cybersecurity;
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 4 - e a n e d r e l u [ A d SFC/SRC/SB 280 (d) involve the marketing or transfer of confidential data derived from a breach of cybersecurity;
(10) establish minimum data classification policies and standards and design controls to support compliance with classifications and report on exceptions;
(10) establish minimum data classification SFC/SRC/SB 280 Page 4 policies and standards and design controls to support compliance with classifications and report on exceptions;
h (11) develop and issue cybersecurity awareness g o policies and training standards and develop and offer t hr g e cybersecurity training services;
(11) develop and issue cybersecurity awareness policies and training standards and develop and offer cybersecurity training services;
and i k h r i s (12) establish a centralized cybersecurity and h , t, data breach reporting process for agencies and political e u g e b l subdivisions of the state.
and (12) establish a centralized cybersecurity and data breach reporting process for agencies and political subdivisions of the state.
e e h n d d i SECTION 4.
SECTION 4.
[NEW MATERIAL ] STATE CHIEF INFORMATION = = o h l ] b ,d i a º e SECURITY OFFICER--QUALIFICATIONS.--The position of "state chief r i = r t e w d information security officer" is created.
STATE CHIEF INFORMATION SECURITY OFFICER--QUALIFICATIONS.--The position of "state chief information security officer" is created.
Show all 77 changed rows (37 more)
Previous
Latest
The security officer m a n o d m :
The security officer shall be a classified position in accordance with rules promulgated pursuant to the Personnel Act.
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 5 - e a n e d r e l u [ A d SFC/SRC/SB 280 shall be a classified position in accordance with rules promulgated pursuant to the Personnel Act.
[NEW MATERIAL ] CYBERSECURITY ADVISORY COMMITTEE CREATED--MEMBERSHIP--DUTIES.-- A.
CYBERSECURITY ADVISORY COMMITTEE CREATED-- MEMBERSHIP--DUTIES.-- A.
and (2) have authority over the hiring, supervision, discipline and compensation of the security officer.
and (2) have authority over the hiring, supervision, discipline and compensation of the security SFC/SRC/SB 280 Page 5 officer.
The security officer or the security officer's h designee shall chair and be an advisory nonvoting member of the g o cybersecurity advisory committee;
The security officer or the security officer's designee shall chair and be an advisory nonvoting member of the cybersecurity advisory committee;
provided that the security t hr g e i k officer shall be recused from deliberations concerning h r i s supervision, discipline or compensation of the security officer h , t, and the secretary of information technology shall chair those e u g e b l e e h deliberations.
provided that the security officer shall be recused from deliberations concerning supervision, discipline or compensation of the security officer and the secretary of information technology shall chair those deliberations.
n d d i = = o h (1) the secretary of information technology or l ] b ,d i a º e the secretary's designee;
(1) the secretary of information technology or the secretary's designee;
r i = r t e w d m a n o (2) the principal information technology staff d m :
(2) the principal information technology staff person for the administrative office of the courts or the director's designee;
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 6 - e a n e d r e l u [ A d SFC/SRC/SB 280 person for the administrative office of the courts or the director's designee;
(5) three members appointed by the Sfl1º security officer»Sfl1 Sfl1ºchair of the board of directors of the New Mexico association of counties»Sfl1 who represent county governmental agencies and who are experienced with cybersecurity issues;
(5) three members appointed by the chair of the board of directors of the New Mexico association of counties who represent county governmental agencies and who are experienced with cybersecurity issues;
(6) three members appointed by the Sfl1º security officer»Sfl1 Sfl1ºchair of the board of h directors of the New Mexico municipal league»Sfl1 who represent g o municipal governmental agencies and who are experienced with t hr g e cybersecurity issues;
SFC/SRC/SB 280 Page 6 (6) three members appointed by the chair of the board of directors of the New Mexico municipal league who represent municipal governmental agencies and who are experienced with cybersecurity issues;
provided that only one member may i k h r i s represent a home rule municipality;
provided that only one member may represent a home rule municipality;
and h , t, (7) three members appointed by the governor e u g e b l who may represent separate agencies other than the department e e h n d d i = = o h of information technology and are experienced with l ] b ,d i a º e cybersecurity issues.
and (7) three members appointed by the governor who may represent separate agencies other than the department of information technology and are experienced with cybersecurity issues.
r i = r t e w d C.
C.
The cybersecurity advisory committee may invite m a n o d m :
The cybersecurity advisory committee may invite representatives of unrepresented county, municipal or tribal agencies or other public entities to participate as advisory members of the committee as it determines that their participation would be useful to the deliberations of the committee.
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 7 - e a n e d r e l u [ A d SFC/SRC/SB 280 representatives of unrepresented county, municipal or tribal agencies or other public entities to participate as advisory members of the committee as it determines that their participation would be useful to the deliberations of the committee.
E.
SFC/SRC/SB 280 Page 7 E.
Pursuant to the Cybersecurity Act or other h statutory authority, the security officer may issue orders u » r regarding the compliance of agencies with guidelines or t h g e recommendations of the cybersecurity advisory committee;
Pursuant to the Cybersecurity Act or other statutory authority, the security officer may issue orders regarding the compliance of agencies with guidelines or recommendations of the cybersecurity advisory committee;
l i h r i s however, compliance with those guidelines or recommendations by h , e h non-executive agencies or county, municipal or tribal t u g e b l governments shall be strictly voluntary.
however, compliance with those guidelines or recommendations by non-executive agencies or county, municipal or tribal governments shall be strictly voluntary.
e e , gh n d d i = = o h F.
F.
The cybersecurity advisory committee shall hold l ] b ,d i a º r its first meeting on or before August 16, 2023 and shall meet e r = t e w d every two months at minimum after that;
The cybersecurity advisory committee shall hold its first meeting on or before August 16, 2023 and shall meet every two months at minimum after that;
provided that the m a n o d m :
provided that the security officer shall have the discretion to call for more frequent meetings as circumstances warrant.
b r e t º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 8 - e a n e d r e l u [ A d SFC/SRC/SB 280 security officer shall have the discretion to call for more frequent meetings as circumstances warrant.
The reports to legislative committees shall be in executive session, and any materials connected with the report presentations are exempt from the Inspection of Public Records Act.
The reports to legislative committees shall be in executive session, and any SFC/SRC/SB 280 Page 8 materials connected with the report presentations are exempt from the Inspection of Public Records Act.
h u » r H.
H.
The members of the cybersecurity advisory t h g e committee shall receive no pay for their services as members of l i h r the committee, but shall be allowed per diem and mileage i s h , e h pursuant to the provisions of the Per Diem and Mileage Act.
The members of the cybersecurity advisory committee shall receive no pay for their services as members of the committee, but shall be allowed per diem and mileage pursuant to the provisions of the Per Diem and Mileage Act.
t u g e b l All per diem and contingent expenses incurred by the e e , gh n d d i cybersecurity office shall be paid upon warrants of the = = o h l ] b ,d i a º r secretary of finance and administration, supported by vouchers e r = t e w d of the security officer." m a n o d m :
All per diem and contingent expenses incurred by the cybersecurity office shall be paid upon warrants of the secretary of finance and administration, supported by vouchers of the security officer." SECTION 6.
b r e t º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 9 - e a n e d r e l u [ A d SFC/SRC/SB 280 SECTION 6.
all references in law to the chief information security officer of the department of information technology shall be deemed to be references to the state chief information security officer;
all references in law to the chief information security officer of the department of information technology shall be deemed to be references to the state chief SFC/SRC/SB 280 Page 9 information security officer;
and h D.
and D.
the chief information security officer for the g o department of information technology shall become the initial t hr g e i k state chief information security officer.
the chief information security officer for the department of information technology shall become the initial state chief information security officer.
h r i s HAFCº SECTION 7.
SECTION 7.
APPROPRIATION.--Three hundred thousand h , t, dollars ($300,000) is appropriated from the general fund to the e u g e b l e e h cybersecurity office for expenditure in fiscal year 2024 for n d d i = = o h staff and operations of the office and expenses of the l ] b ,d i a º e cybersecurity advisory committee.
EFFECTIVE DATE.--The effective date of the provisions of this act is July 1, 2023.
Any unexpended or r i = r t e w d m a n o unencumbered balance remaining at the end of fiscal year 2024 d m :
SFC/SRC/SB 280 Page 10 8 25
b e d s º o t n = .225620.2AIC March 17, 2023 (1:14am) s k m e - 10 - e a n e d r e l u [ A d SFC/SRC/SB 280 shall revert to the general fund.»HAFC SECTION HAFCº 8.»HAFC HAFCº7.»HAFC EFFECTIVE DATE.--The effective date of the provisions of this act is July 1, 2023.
- 11 - » g o » r h t i k l i g t h s , e h t l i w l b l e e , g n d l h = = b , a l º d i a r e r = , a t e d m a n o d m :
b r e t º o t n = .225620.2AIC March 17, 2023 (1:14am) s k em e e a n e d r e l u [ A d
⬇ Download PDF
View plain text versions (5)

Action History

  1. Signed

  2. Senate concurred in House amendments

  3. passed House

  4. DO PASS, as amended, committee report adopted

  5. DO PASS committee report adopted

  6. Sent to House Judiciary Committee & House Appropriations & Finance Committee

  7. passed Senate

  8. floor substitute adopted (1 amendment)

  9. DO NOT PASS, replaced with committee substitute

  10. DO NOT PASS, replaced with committee substitute

  11. Sent to Senate Rules Committee & Senate Finance Committee

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

2 sponsors · 0 co-sponsors · 110 not signed on

Sponsors (2)

Co-sponsors (0)

None.

Not signed on (110)

110 members have not signed on to this bill.

Show all 110 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

public-safety technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 280?
SB 280 is sponsored by Sariñana, Debra M. and Michael Padilla (Democrat).
What is the current status of SB 280?
This bill has been enacted into law. Introduced January 30, 2023. Enacted.
Where can I track SB 280?
Track SB 280 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 280

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 280

Last checked for changes 2 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →