SB 129 — CYBERSECURITY ACT CHANGES

[and ] (12) adopt and implement rules to establish a h g centralized cybersecurity and data breach reporting process forSFC/SHPAC/SB o129 tPage hr5 for agencies and political subdivisions of the state;

g e i k h r (13) approve agency cybersecurity and i s h information security requests for proposals and invitations for , t, e u g bids that are subject to the Procurement Code, prior to final e b l e e h approval;

n d d i = = o h l ] b ,d (14) approve agency cybersecurity and i a º e r i = r information security contracts and amendments to those tcontracts, eincluding wsole dsource mcontracts aand nprice oagreements, dprior mto :final approval.

b e d s º o t n = .228048.1AIC February 15, 2024 (10:09am) s k m e - 6 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 contracts, including sole source contracts and price agreements, prior to final approval.

The security officer may issue orders HJCºtoto agencies»HJCagencies: :

h u (1) regarding agency compliance with rules, » r t h policies, standards or controls issued by cybersecurity officeSFC/SHPAC/SB g129 ePage l6 ioffice guidelines or recommendations of the cybersecurity advisory h r i s h , committee;

and e h t u g (2) necessary to protect the state's digital e b l e e , gh assets from imminent threat.

n d d i = = o h l ] b ,d D.

Public bodies that receive general fund iappropriations aused ºfor rinformation etechnology rresources =shall appropriationsadopt usedand forimplement cybersecurity, information technologysecurity resourcesand tprivacy epolicies, wstandards dand mprocedures abased nupon ono dless mthan :moderate-impact security control baselines, frameworks and standards issued by the national institute of standards and technology.

b r e t º o t n = .228048.1AIC February 15, 2024 (10:09am) s k m e - 7 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 HJCºand that are not subject to the jurisdiction of the security officer»HJC shall adopt and implement cybersecurity, information security and privacy policies, standards and procedures based upon no less than moderate-impact security control baselines, frameworks and standards issued by the national institute of standards and technology.

A public HJCºbodybody thator is not under the jurisdiction of the security officer»HJC HJCºor another branch h u of government»HJCgovernment may voluntarily comply with the rules, » r t h standards, orders and other requirements of the Cybersecurity g e l i Act and participate in the cybersecurity and information h r i s h , security programs offered by the cybersecurity office." e h t u g SECTION 4.

Section 9-27A-5 NMSA 1978 (being Laws 2023, e b l e e , gh Chapter 115, Section 5) is amended to read:

nSFC/SHPAC/SB d129 dPage i7 = = o h l ] b ,d "9-27A-5.

CYBERSECURITY ADVISORY COMMITTEE CREATED-- i a º r e r = MEMBERSHIP--DUTIES.-- tA. e w d m a n o d m :

b r e t º o t n = .228048.1AIC February 15, 2024 (10:09am) s k m e - 8 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 A.

The security officer or the security officer's designee shall chair and be [an advisory nonvoting ] a voting member of the cybersecurity advisory committee;

provided that the security officer shall be recused from deliberations and voting on matters concerning supervision, discipline or h g compensation of the security officer, and [the secretary of o t hr information technology shall chair] the committee shall select g e i k h r an alternate person who is not an employee of the cybersecurity i s h office to chair those deliberations and votes.

The remaining , t, e u g members of the committee consist of:

e b l e e h (1) the secretary of [information technology ] n d d i = = o h l ] b ,d homeland security and emergency management or the secretary's i a º e r i = r designee;

t(2) ethe wprincipal dinformation mtechnology aSFC/SHPAC/SB n129 oPage d8 mstaff :person for the administrative office of the courts or the staff person's designee;

b e d s º o t n = .228048.1AIC February 15, 2024 (10:09am) s k m e - 9 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 (2) the principal information technology staff person for the administrative office of the courts or the [director's ] staff person's designee;

(6) three members appointed by the chair of the board of directors of the New Mexico municipal league who represent municipal governmental agencies and who are h g experienced with cybersecurity issues;

provided that only one o t hr member may represent a home rule municipality;

[and ] g e i k h r (7) [three members appointed by the governor i s h who may represent separate agencies other than the department , t, e u g of information technology and are experienced with e b l e e h cybersecurity issues] one member appointed by the governor who n d d i = = o h l ] b ,d has experience with cybersecurity issues for public education i a º e r i = r institutions;

and t(8) eone wmember dappointed mby athe ngovernor owho dhas mexperience :with cybersecurity issues for public health institutions.

b e d s º o t n = .228048.1AIC February 15, 2024 (10:09am) s k m e - 10 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 (8) one member appointed by the governor who has experience with cybersecurity issues for public health institutions.

The cybersecurity advisory committee may invite representatives of unrepresented county, municipal or tribal SFC/SHPAC/SB 129 Page 9 agencies or other public entities to participate as advisory members of the committee as it determines that their participation would be useful to the deliberations of the committee.

(1) an information system owned or operated by h u a public entity;

or » r t h (2) a cybersecurity solution implemented by a g e l i public entity.

hE. r i s h , [E.

Pursuant to the Cybersecurity Act or other e h t u g statutory authority, the security officer may issue orders e b l e e , gh regarding the compliance of agencies with guidelines or n d d i = = o h l ] b ,d recommendations of the cybersecurity advisory committee;

i a º r e r = however, compliance with those guidelines or recommendations by t e w d m a n o d m :

b r e t º o t n = .228048.1AIC February 15, 2024 (10:09am) s k m e - 11 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 non-executive agencies or county, municipal or tribal governments shall be strictly voluntary.

F.] E.

[G.] F.

The cybersecurity advisory committee shall present a report to the legislative finance committee and the appropriate legislative interim committee concerned with information technology at those committees' November 2023 SFC/SHPAC/SB 129 Page 10 meetings and to the governor by November 30, 2023 regarding the status of cybersecurity preparedness within agencies and elsewhere in the state.

On or before October 30, 2024 and on h g or before October 30 of each subsequent year, the cybersecurity o t hr office shall present updated reports to the legislative g e i k h r committees and the governor.

The reports to legislative i s h committees shall be in executive session, and any materials , t, e u g connected with the report presentations are exempt from the e b l e e h Inspection of Public Records Act.

n d d i = = o h l ] b ,d [H.] G.

The members of the cybersecurity advisory i a º e r i = r committee shall receive no pay for their services as members of tthe ecommittee, wbut dshall mbe aallowed nper odiem dand mmileage :pursuant to the provisions of the Per Diem and Mileage Act.

bAll eper ddiem sand ºcontingent oexpenses tincurred nby =the .228048.1AICcybersecurity Februaryoffice 15,shall 2024be (10:09am)paid supon kwarrants mof e - 12 - e a n e d r e l u [ A d SFC/SHPAC/SB 129 the committee,secretary butof shallfinance be allowed per diem and mileageadministration, pursuantsupported toby thevouchers provisions of the Persecurity Diemofficer." andSFC/SHPAC/SB Mileage129 Act.Page 11 25

All per diem and contingent expenses incurred by the cybersecurity office shall be paid upon warrants of the secretary of finance and administration, supported by vouchers of the security officer." - 13 - » g o » r h t i k l i g t h s , e h t l i w l b l e e , g n d l h = = b , a l º d i a r e r = , a t e d m a n o d m :

b r e t º o t n = .228048.1AIC February 15, 2024 (10:09am) s k em e e a n e d r e l u [ A d