SB 426 — Banning use of certain products and platforms deemed unsafe or high risk on government systems

SB426 HFATSFA CapitoTakubo 3-6Casto#1 3264 Delegate3-11Viglianco Capito 7888 Senator Takubo moved to amend the billHouse amendment by striking out theeverything titleafter andthe substitutingenacting thereforclause aand newinserting title,in tolieu readthereof asthe follows:Eng.following:

SenateARTICLE Bill6B. No.

426CYBER --SECURITY “APROGRAM. Bill to amend the Code of West Virginia, 1931, as amended, by adding thereto a new section, designated §5A-6B-4a, relating to regulating, restricting, or banning high-risk technology platforms, services, applications, programs, or products on government networks, devices, and systems;

adding §5A-6B-4a. legislative findings related to national security threats and threats to critical state government networks and infrastructure, including election systems, posed by untrustworthy and high-risk platforms, services, applications, programs, or products;

authorizingHigh-risk the Chief Information Security Officer to identify high-risk platforms, services, applications, programs, and productsproducts. and to develop statewide standards regulating their use on government networks, devices, and systems;

requiring(a) certainThe governmentLegislature entitieshereby finds and declares that it is in the best interest of the citizens of West Virginia and to adoptnational security to enact measures designed to safeguard against untrustworthy and enforcehigh-risk thosetechnology standards;and to block such technology from interfering with or damaging critical state networks and infrastructure, including, without limitation, election systems.

recommendingThe use of certain information and communication technologies and services can create opportunities for hostile actors to exploit vulnerabilities and take adverse action against the legislativeUnited States or allies, which could directly or indirectly affect the safety and judicialsecurity branchesof West Virginia citizens, and such use also creates opportunities for adversaries to adoptexploit vulnerabilities and enforcetake thoseadverse standards;action against state or local government networks and infrastructure within or connected to West Virginia.

authorizingAs the promulgationthreat landscape evolves, West Virginia shall work in cooperation with the federal government to implement appropriate safeguards to defend government networks in West Virginia and in the United States from technology threats posed by hostile actors.(b) Notwithstanding the provision of legislative§5A-6B-1(b) of this code, all state agencies and emergencyinstrumentalities, rulesincluding towithout facilitatelimitation agencies within the purposeexecutive, legislative, and judicial branches, all constitutional officers, local government entities as defined by §7-1-1 or §8-1-2 of this section;code, county boards of education as defined by §18-1-1 of this code, and all state institutions of higher education as defined by §18B-1-2 of this code, shall enforce statewide standards developed by the Chief Information Security Officer regarding high-risk technology platforms, services, applications, programs, or products.

andAdditionally, requiringall thegovernment Chiefentities Informationsubject Securityto Officerthis providesubsection anmust, annualconsistent reportwith onthose threatsstandards posedand byany untrustworthyother andapplicable high-riskstate platforms,or services,federal applications,law, programs,restrict, orremove, products,ban andor theotherwise actionsblock requiredaccess to mitigatehigh-risk thosetechnology threatsplatforms, toservices, theapplications, Jointprograms, Interimor Committeeproducts on Governmentall Operations. AdoptedRejected government systems, services, networks, devices, or locations.

For purposes of this subsection, high-risk technology platforms, services, applications, programs, or products are those designated as such in the Statewide Cybersecurity Standard published and maintained by the Chief Information Security Officer:

Provided, That any standards developed by the Chief Information Security Officer regarding high-risk technology platforms, services, applications, programs, or products shall contain exceptions permitting, in appropriate circumstances, the use of those platforms, services, applications, programs, or products for law enforcement activities, national security interests and activities, security research, investigative efforts authorized by this code, and for other purposes related to actual or potential litigation involving the state or one of its agencies or officers:

Provided, however, that the Chief Information Security Officer shall develop standards and requirements designed to mitigate the risk of the authorized use of a high-risk platform, service, application, program, or product pursuant to the exceptions set forth in this section:

Provided, further that the Chief Information Security Officer shall, after consultation with the affected entities, exempt law enforcement agencies and other instrumentalities from the provisions of this section to the extent that the use of high-risk technology platforms, services, applications, programs, or products is determined to be necessary to performance of their official duties.

 (C) The Secretary of the Department of Administration may propose rules for legislative approval in accordance with the provisions of §29A-3-1 et seq.

of this code and may also promulgate emergency rules pursuant to the provisions of §29A-3-15 of this code when necessary to facilitate:

(1) completion of the duties imposed on the Chief Information Security Officer by this section, and (2) enforcement of the standards referenced in this section.(d) The Chief Information Security Officer will provide an annual report by June 1 of each year on threats posed by untrustworthy and high-risk platforms, services, applications, programs, or products, and the actions required to mitigate those threats to the Joint Interim Committee on Government Operations.   AdoptedRejected