SB 764 — Public bodies; security of government databases and data communications, report.

SESSION ENROLLED VIRGINIA ACTS OF ASSEMBLY ––-- 2022 SESSION CHAPTER E627 An Act to amend and reenact §§ 2.2-603, 2.2-2009, and 2.2-5514 of the Code of Virginia, relating to public bodies;

R O [S 764] Approved LApril L11, 2022 Be it enacted by the General Assembly of Virginia:

That §§ 2.2-603, 2.2-2009, and 2.2-5514 of the Code of Virginia are amended and reenacted asEas follows:

D§ A.2.2-603.

NotwithstandingAuthority any provision of law to the contrary, the agency directordirectors. of each agency in the executive branch of state government shall have the power and duty to (i) supervise and manage the department or agency and (ii) prepare, approve, and submit to the Governor all requests for appropriations and to be responsible for all expenditures pursuant to appropriations.

B.A.

TheNotwithstanding any provision of law to the contrary, the agency director of each agency in the executive branch of state government,government except those that by law are appointed by their respective boards, shall nothave proscribethe anypower agencyand employeeduty fromto discussing(i) thesupervise functions and policiesmanage of the agency,department without prior approval from his supervisor or superior,agency wBthand any(ii) personprepare, unlessapprove, theand informationsubmit to be discussed is protected from disclosure by the VirginiaGovernor Free6omall ofrequests InfC.for appB.

SubsectionThe Adirector shallof noteach beagency construedin tothe restrictexecutive branch of state government, except those that by law are appointed by their respective boards, shall not proscribe any otheragency specificemployee orfrom generaldiscussing powersthe functions and Eutiespolicies of executivethe branchagency, boardswithout grantedprior approval from his supervisor or superior, with any person unless the information to be discussed is protected from disclosure by the Virginia Freedom of Information Act (§ 2.2-3700 et seq.) or any other provision of state or federal law.

RC. D.

Subsection A shall not be construed to restrict any other specific or general powers and duties of executive branch boards granted by law.

D.

In addition to the requirements of subsection C of § 2.2-619, the director of each agency in any branch of state government shall, at the end of each fiscal year, report to (i) the Secretary of Finance and the Chairmen of the House Committee on Appropriations and the Senate Committee on Finance and Appropriations a listing and general description of any federal contract, grant, or money in excess of $1 million for which the agency was eligible, whether or not the agency applied for, accepted, and received1received such contract, grant, or money, and, if not, the reasons therefore and the dollar amount and corresponding percentage of the agency's total annual budget that was supplied by funds from the federal government and (ii) the Chairmen of the House Committees on Appropriations and Finance, and the Senate Committee on Finance and Appropriations any amounts owed to the agency from any source that are more than six months delinquent, the length of such delinquencies, and the total of all such delinquent amounts in each six-month interval.

branchF. of state government, including those appointed by their respective boards or the Board of Education, shall be responsible for securing the electronic data held by his agency or department and shall comply with the requirements of the Commonwealth's information technology security and risk-management program as set forth in § 2.2-2009.

Notwithstanding subsection D, the director of every agency and department in the executive branch of state government, including those appointed by their respective boards or the Board of Education, shall be responsible for securing the electronic data held by his agency or department and shall comply with the requirements of the Commonwealth's information technology security and risk-management program as set forth in § 2.2-2009.

The director of every department in the executive branch of state government shall report to the Chief Information Officer as described in § 2.2-2005, all known incidents that threaten the security of the Commonwealth's databases and data communications resulting in exposure of data protected by federal or state laws, or other incidents compromising the security of the Commonwealth's information shalltechnology besystems madewith to the Chiefpotential Informationto Officercause withinmajor 24disruption hoursto fromnormal whenagency theactivities. department discovered ororts should have discovered their occurrence.

Such reports shall be made to the Chief Information Officer within 24 hours from when the department discovered or should have discovered their occurrence.

To provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing tosecurity theaudits Commonwealth'sof executive,government legislative,electronic andinformation. judicial branches and independent agencies.

TheSuch CIOapplypolicies, shallstandards, workand withguidelines representativesshall ofapply to the ChiefCommonwealth's Justiceexecutive, oflegislative, theand Supremejudicial Courtbranches and Jointindependent Rulesagencies. Committee of of 3 the General Assembly to identify their needs.

The CIO shall work with representatives of the Chief Justice of the Supreme Court and Joint Rules Committee of the General Assembly to identify their needs.

of 3 1.

Such policies, standards, and guidelines shall include the expunging, in a manner as determined by the CIO, of all confidential data and personal identifying information of citizens of the of 3 Commonwealth prior to such sale, disposal, or other transfer of computers or other technology assets.

The CIO shall provide all directors of agencies and departments with all such informationEinformation, guidance, and assistance required to ensure that agencies and departments understand and adhere to the policies, standards, and guidelines developed pursuant to this section.

N H.

The CIO shall promptly notify all public bodies as defined in § 2.2-5514 of hardware, sofRware,software, of 3 or services that have been prohibited pursuant to Chapter 55.3 (§ 2.2-5514).

independentI. agencies.ion applies to the Commonwealth's executive, legislative, and judicial braOches and 2.

In1. collaboration with the heads of executive branch and independent agencies and representatives of the Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly, the CIO shall develop and annually update a curriculum and materials for training all state employees in information security awareness and in proper procedures for detecting, assessing, reporting, anE addressing information security threats.

This subsection applies to the Commonwealth's executive, legislative, and judicial branches and independent agencies.

2.

In collaboration with the heads of executive branch and independent agencies and representatives of the Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly, the CIO shall develop and annually update a curriculum and materials for training all state employees in information security awareness and in proper procedures for detecting, assessing, reporting, and addressing information security threats.

using3. the curriculum and materials developed by the CIO pursuant to subdivision 2.

EmployeesEvery shalleesstate completeagency suchshall trainingprovide withinannual 30information dayssecurity training for each of initialits employmentemployees using the curriculum and materials developed by Januarythe 31CIO eachpursuant yearto thereafter.subdivision 2.

StateEmployees agenciesshall maycomplete developsuch additional training materialswithin that30 addressdays specific needs of suchinitial agency,employment provided that such materials do not contradict the training curriculum and materialsby developedJanuary Sy31 theeach CIO.year thereafter.

7State Theagencies CIOmay shalldevelop coordinateadditional withtraining andmaterials assistthat stateaddress agenciesspecific inneeds implementingof thesuch annualagency, informati4nprovided securitythat such materials do not contradict the training requirement.curriculum and materials developed by the CIO.

RThe 4.CIO shall coordinate with and assist state agencies in implementing the annual information security training requirement.

Each4. state agency shall (i) monitor and certify the training activity of its employees to ensure compliance with the annual information security training requirement, (ii) evaluate the efficacy of the information security training program, and (iii) forward to the CIO such certification and evaluation, training program.

Each state agency shall (i) monitor and certify the training activity of its employees to ensure compliance with the annual information security training requirement, (ii) evaluate the efficacy of the information security training program, and (iii) forward to the CIO such certification and evaluation, together with any suggestions for improving the curriculum and materials, or any other aspects of the training program.

"Public body" includes any committee, subcommittee, or other entity however designated of the public body or formed to advise the public body, including those with private sector or citizen members and corporations organized by the Virginia Retirement System.seSystem. with B.

B.

Such reports shall be made to the Virginia Fusion Intelligence Center within 24 hours withfrom thewhen Chief Information Officer, as described in § 2.2-2005, or his designee at the Virginiaincident reportswas Informationdiscovered. Technologies Agency, promptly upon receipt.

The Virginia Fusion Intelligence Center shall share such reports with the Chief Information Officer, as described in § 2.2-2005, or his designee at the Virginia Information Technologies Agency, promptly upon receipt.