SB 1459 — Administration of state government; prohibited applications and websites.

RECONVENED SESSION REENROLLED REPRINT VIRGINIA ACTS OF ASSEMBLY –– CHAPTER 768R An Act to amend and reenact § 2.2-2009 of the Code of Virginia and to amend the Code of Virginia by adding in Chapter 55.3 of Title 2.2 a section numbered 2.2-5514.1, relating to administration of state government;

E N [S 1459] R Approved AprilO 12, 2023 Be it enacted by the General Assembly of Virginia:

L § 2.2-2009.

E A.

To provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards,standarDs, and guidelines for assessing security auditsrisks, ofdetermining governmentthe electronicappropriate information.security measures and performing to the Commonwealth's executive, legislative, and judicial branches and independent agencies.

SuchThe policies,CIOapply standards,shall andwork guidelineswith shallrepresentatives applyof to the Commonwealth'sChief executive,Justice legislative,of andthe judicialSupreme branchesCourt and independentJoint agencies.Rules Committee of the General Assembly to identify their needs.

The CIO shall work with representatives of the Chief Justice of the Supreme Court and Joint Rules Committee of the General Assembly to identify their needs.

In developing and updating such policies, standards, and guidelines, the CIO shall designate a government entity to oversee, plan, and coordinatecoSrdinate the conduct of periodic security audits of all executive branch agencies and independent agencies.agenci1s.

The CIO shall coordinate these audits with the Auditor of Public Accounts and the Joint Legislative Audit and Review Commission.

The Chief Justice of the Supreme Court and the Joint Rules Committee of thethedit General Assembly shall determine the most appropriate methods to review the protection of electronic information within their branches;

2 2.

Such policies, standards, and guidelines shall include requirements that (i) any state employee or other authorized user of a state technology asset provide passwords or other means of authentication to use a technology asset and access a state-owned or state-operated or computer network or database and (ii) a digital rights management system or other means of authenticating and controlling an individual's ability to access electronic records be utilized to limit access to and use of electronic records that contain confidential information to authorized individuals;

All agencies in the Commonwealth shall cooperate with the CIO, including (i) providing the CIO with information required to create and implement a Commonwealth risk management program, (ii) creating an agency risk management program, and (iii) complying with all other risk management activities;

andandisk management 5.

The CIO shall annually report to the Governor, the Secretary, and General Assembly on the results of security audits, the extent to which security policy, standards, and guidelines have been adopted by executive branch and independent agencies, and a list of those executive branch agencies and independent agencies that have not implemented acceptable security and risk management regulations, policies, standards, and guidelines to control unauthorized uses, intrusions, or other security threats.

Upon review of the security audit results in question, the CIO may take action to suspend the executive branch agency's or independent agency's information technology projects pursuant to subsection B of § 2.2-2016.1, limit additional information technology investments pending acceptable corrective actions, and recommend to thethe2. Governor and Secretary any other appropriate actions.

2.Executive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated of 3 costs.

Executive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated costs.

of 3 C.

"WeChat"of means3 the multipurpose social media, messaging, and payment application developed by Tencent Holdings Ltd.

multipurpose social media, messaging, and payment application developed bR B.

Except as provided in subsection C, no employee or agent of any public body or person or entity contracting with any such public body shall download or use any application, including TikTok or WeChat, or access any website developed by ByteDance Ltd.

(i) on any ofor 3 government-issued device or government-owned or government-leased equipment, including mobile E phones, desktop computers, laptop computers, tablets, or other devices capable of connecting totoNthe themaintained Internet,by orthe (ii)Commonwealth.ed while connected to any wired or wireless Internet network owned, operated, ororR maintainedC. by the Commonwealth.

C.The Superintendent of State Police or the chief law-enforcement officer of the appropriatO locality purpose of allowing any employee, agent, person, or entity to participate in any law-enforcemenL-related matters.

TheL SuperintendentE ofD State Police or the chief law-enforcement officer of the appropriate locality or institution of higher education may grant an exception to the provisions of subsection B forE the2 purpose of allowing any employee, agent, person, or entity to participate in any law-enforcement-related matters.