SB 69 — Revises provisions relating to emergencies and cybersecurity. (BDR 19-350)

2.(a) The Division;

and subdivision.response agency that provides services to the political 2.

-posts *SB69_R2*that –are 7located –within (f)the Thepolitical subdivision;mmand (g) A depiction of the location of oneeach orpolice morestation, emergencysheriff’s responseoffice commandand postsfire station that areis located within the political subdivision;

(g) A depiction of the location of each police station, sheriff’s office and fire station that is located within the political subdivision;

- 80th Session (2019) – 7 – 3.

Each political subdivision shall review its response plan at least once each year and, as soon as practicable after the review is completed but not later than December 31 of each year, file with the Division and each response agency that provides services to thethe(a) politicalAny subdivision:revised response plan resulting from the review;

(a) Any revised response plan resulting from the review;

An officer, employee or other person to whom the plan is entrusted suchby athe planentity except:whomwith whom it is filed shall not disclose the contents of (a)such Upon the lawful order of a courtplan ofexcept: competent jurisdiction;

or(a) relatedUpon emergency;the lawful order of a court of competent jurisdiction;

ornecessary(b) As is reasonably necessary in the case of an act of terrorism (c)or Pursuantrelated toemergency; the provisions of NRS 239.0115.

or (c) Pursuant to the provisions of NRS 239.0115.

In reviewing and updating the plan, the development committee shall consult with the director of the local organization for emergency management or, if there is no local organization for emergency management, with the Chief of the DivisionSafety ofor Emergencyhis Managementor her designee.nt of the Department of Public Safety2. or his or her designee.

2.

On or before July 1 of each year, the board of trustees of the school district that established the committee or the governing body of the charter school that established the committee shall - *SB69_R2* – 8 – submit for approval to the Division of Emergency Management of the Department of Public Safety the plan updated pursuant to subsection 1.

(a)- Post80th aSession notice(2019) of– the8 completion– of each review and update that its development committee performs pursuant to subsection 1 at each school in its school district or at its charter school;

and (3)] The local organization for emergency management, if any;any(f) Upon request, provide a copy of each plan developed pursuant to NRS 388.243 and each plan updated pursuant to subsection 1 to a local agency that is included in the plan and to an employee of a school who is included in the plan;

pursuant(g) to NRS 388.243 and each plan updated pursuant tod subsection 1 to a local agency that is included in the plan and to an emp(g) Provide a copy of each deviation approved pursuant to NRS 388.251 as soon as practicable to:

and (h) At least once each year, provide training in responding to a crisis and training in responding to an emergency to each employeeemployeea of the school district or of the charter school, including, without limitation, training concerning drills for evacuating and securing schools.

The board of trustees of each school district and the governing body of each charter school may apply for and accept - *SB69_R2* – 9 – gifts, grants and contributions from any public or private source to carry out the provisions of NRS 388.229 to 388.266, inclusive.

Sec.- 80th Session (2019) – 9 – 394.1688 1.

5.Each development committee shall, at least once:

NRSeach 394.1688year, isreview herebyand amendedupdate toas readappropriate asthe follows:plan that it developed pursuant to NRS 394.1687.

394.1688 1.

Each development committee shall, at least once each year, review and update as appropriate the plan that it developed pursuant to NRS 394.1687.

(b) File with the Department a copy of the notice provided pursuantpur(c) Post a copy of NRS 388.253 and 394.168 to paragraph394.1699, (a);inclusive, at the school;

(c)(d) PostRetain a copy of each plan developed pursuant to NRS 388.253394.1687, andeach 394.168plan updated pursuant to 394.1699,subsection inclusive,1 atand theeach school;deviation approved pursuant to NRS 394.1692;

(d) Retain a copy of each plan developed pursuant to NRS deviation approved pursuant to NRS 394.1692;ection 1 and each (e) [Provide] On or before July 1 of each year, provide a copy updatedof pursuanteach toplan subsectiondeveloped 1pursuant to:RSto NRS 394.1687 and each plan (1)updated Eachpursuant localto publicsubsection safety1 agencyto: in the county in which the school is located;

(1) Each local public safety agency in the county in which the school is located;

(f) Upon request, provide a copy of each plan developed pursuant to NRS 394.1687 and each plan updated pursuant to subsection 1 to a local agency that is included in the plan and to an employee of the school who is included in the plan;

- *SB69_R2*80th –Session 10(2019) – (4)10 The– local organization for emergency management, if any;

(4) The local organization for emergency management, if (5) A local agency that is included in the plan;

The Governor may in case of invasion, disaster, insurrection, riot, breach of the peace, or imminent danger thereof, or other substantial threat to life or property, or upon a request for assistance from a political subdivision or governmental utility, as defined in NRS 239C.050, that has experienced a significant cybersecurity incident, order into active service of the State for such a period, to such an extent and in such a manner as he or she deemsdeemssuch necessary all or any part of the Nevada National Guard.

The authority of the Governor includes the power to order the Nevada National Guard or any part thereof to function under the operational control of the United States Army, Navy or Air Force commander in charge of the defense of any area within the State which is invaded or attacked or is or may be threatened with invasion or attack.adedattack. 2.

In2. case of the absence of the Governor from the State, or if it civil officer making a requisition for troops may, if the civil officer deems the necessity imminent and not admitting of delay, serve a copy of the requisition, together with a statement of the Governor’s absence or the impossibility of immediately communicating with the Governor, upon the following officers in this order:

In case of the absence of the Governor from the State, or if it is impossible to communicate immediately with the Governor, the civil officer making a requisition for troops may, if the civil officer deems the necessity imminent and not admitting of delay, serve a copy of the requisition, together with a statement of the Governor’s absence or the impossibility of immediately communicating with the Governor, upon the following officers in this order:

(b)(c) AdjutantOther General;officers designated in a chain of command prescribed by Office regulations.

and (c) Other officers designated in a chain of command prescribed by Office regulations.

(a)- The80th furtheranceSession of(2019) the– organization,11 maintenance,– discipline or training of the Nevada National Guard;Guard;n, maintenance, discipline (b) The welfare of the public;

- *SB69_R2* – 11 – (b) The welfare of the public;

The Division is the State Agency for Emergency Management and the State Agency for Civil Defense for the purposes of the Compact ratified by the LegislatureDirector pursuantof toEmergency NRSManagement 415.010.and the State’s Director ofs Civil Defense for the purposes of that Compact.

The Chief is the State’s Director of Emergency Management and the State’s Director of Civil Defense for the purposes of that Compact.

The Chief may employ technical, clerical, stenographic and other personnel as may be required, and may make such expenditures therefor and for other expenses of his or her office within the appropriation therefor, or from other money made available to him or her for purposes of emergency management, as may3.may be necessary to carry out the purposes of this chapter.

The3. Chief, subject to the direction and control of the Director, shall carry out the program for emergency management in organizations for emergency management within the State, maintain liaison with and cooperate with agencies and organizations of other states and of the Federal Government for emergency management and carry out such additional duties as may be prescribed by the Director.

4.The Chief, subject to the direction and control of the Director, shall carry out the program for emergency management in this state.

The Chief shall coordinate the activities of all organizations for emergency management within the State, maintain liaison with and cooperate with agencies and organizations of other states and of the Federal Government for emergency management and carry out such additional duties as may be prescribed by the Dir4.

(b)- Prepare80th stateSession and(2019) local– governmental12 agencies,– private organizations and other persons to be capable of respondingrespondingte appropriately if an emergency or disaster occurs by fostering the adoption of plans for emergency operations, conducting exercises to - *SB69_R2* – 12 – test those plans, training necessary personnel and acquiring necessary resources;

In addition to any other requirement concerning the program of emergency(a) managementMaintain inan thisinventory State,of any state or local services, equipment, supplies, personnel and other resources related to participation in the ChiefNevada shall:Intrastate Mutual Aid System established pursuant to NRS 414A.100;

(a) Maintain an inventory of any state or local services, equipment, supplies, personnel and other resources related to participation in the Nevada Intrastate Mutual Aid System established pursuant to NRS 414A.100;

[and] (c) Coordinate with state agencies, local governments, Indian tribes or nations and special districts to use the personnel and equipment of those state agencies, local governments, Indian tribes or nations and special districts as agents of the State during abesa response to a request for mutual aid pursuant to NRS 414.075 or 414(d)414A.130 Provide[.] notice:;

(1)and On(d) orProvide beforenotice: February 15 of each year to the governing body of each political subdivision of whether the political subdivision has complied with the requirements of NRS 239C.250;

(1) On or before February 15 of each year to the governing subdivision has complied with the requirements of NRS 239C.250;

(3) On or before February 15 of each year to the Governor of whether each governmental utility described in subsection 1 of NRS 239C.050 has complied with the requirements of NRS 239C.270;

(4)- On80th orSession before(2019) February– 1513 of– each year to the governing body of each governmental utility described in subsection 2 ofofng NRS 239C.050 of whether each such governmental utility has complied with the requirements of NRS 239C.270;

(5) On or before August 15 of each year to the Superintendent of Public Instruction of whether each board of - *SB69_R2* – 13 – trustees of a school district, governing body of a charter school or governing body of a private school has complied with the requirements of NRS 388.243 or 394.1687, as applicable;

The Division shall develop a written guide for the preparation and maintenance of an emergency response plan to assist a person or governmental entity that is required to file a plan pursuant to NRS 239C.250, 239C.270, 388.243, 394.1687 or 463.790.

(1) A public school or charter school pursuant to NRS 388.243;

or public school or charter school pursuant to NRS (2) A private school pursuant to NRS 394.1687;

and plan(d) pursuantEach toresort NRShotel 463.790.iredrequired to adopt an emergency response Sec.plaSec.

8.8.antNRS 463.790 is hereby amended to read as follows:

NRS 463.790 is hereby amended to read as follows:

2.- 80th Session (2019) – 14 – include:e emergency response plan required by subsection 1 must (a) A drawing or map of the layout of all areas within the building or buildings and grounds that constitute a part of the resort hotel and its support systems and a brief description of the purpose or use for each area;

The emergency response plan required by subsection 1 must include:

(a) A drawing or map of the layout of all areas within the building or buildings and grounds that constitute a part of the resort hotel and its support systems and a brief description of the purpose or use for each area;

- *SB69_R2* – 14 – (c) The location and inventory of emergency response equipment and resources;

(f) The location of one or more site emergency response commandcom(g) posts;A description of any special equipment needed to respond to an emergency at the resort hotel;

(g) A description of any special equipment needed to respond to an emergency at the resort hotel;

Each resort hotel shall review its emergency response plan at least once each year and, as soon as practicable after the review is completed but not later than November 1 of each year, file with each local fire department and local law enforcement agency locatedwhose andjurisdiction withincludes the Divisionarea ofin Emergencywhich Management:rtthe resort hotel is (a)located Anyand revisedwith emergency response plan resulting from the rev(b)Division Aof writtenEmergency certificationManagement: that the most recent emergency response plan filed pursuant to this subsection or subsection 1 is the current emergency response plan for the resort hotel.

review;

or revised emergency response plan resulting from the (b) A written certification that the most recent emergency response plan filed pursuant to this subsection or subsection 1 is the current emergency response plan for the resort hotel.

An officer, employee or other person to whom the - 80th Session (2019) – 15 – plan is entrusted by the department, agency or Division shall not disclose the contents of such a plan except:

or (b)involving Aspublic ishealth reasonablyor necessarysafety.in in the case of an emergency involving5. public health or safety.

5.

- *SB69_R2* – 15 – (a) The sheriff’s office of a county;

and (d) For postincident activity that includes a discussion regarding lessons learned and any analytics associated with the cybersecurity incident.

(a) Any revised cybersecurity incident response plan resulting from the review;

orcybersecurityor incident response plan resulting (b) A written certification that the most recent cybersecurity incident response plan filed pursuant to this subsection or subsection 1 is the current cybersecurity incident response plan for the political subdivision.

Except as otherwise provided in NRS 239.0115, a cybersecurity incident response plan filed pursuant to the requirements of this section, including any revisions adopted - 80th Session (2019) – 16 – thereto, is confidential and must be securely maintained by the Office.

(a)(b) UponAs theis lawfulreasonably ordernecessary ofin athe courtcase of competentan jurisdiction;act ofdiction;

(b) As is reasonably necessary in the case of an act of terrorism or related emergency;

480.902 As used in NRS 480.900 to 480.950, inclusive, and section 9 of this act, unless the context otherwise requires, the - *SB69_R2* – 16 – words and terms defined in NRS 480.904 to 480.912, inclusive, have the meanings ascribed to them in those sections.

[(c)]standards 3.and guidelines] best practices for preparing for andegies, mitigating risks to, and otherwise protecting, the security of information systems that are operated or maintained by state agencies.

Develop[(d) [andCoordinate update,performance asaudits necessary,and strategies,assessments standardsof andthe guidelines]information bestsystems practicesof forstate preparingagencies forto anddetermine, mitigatingwithout riskslimitation, to,adherence to the regulations, standards, practices, policies and otherwiseconventions protecting,of the securityDivision of informationEnterprise systemsInformation Technology Services of the Department of Administration that are operatedidentified orby maintainedthe byDivision stateas agencies.security-related.

[(d)(e) Coordinate performancestatewide auditsprograms andfor assessmentsawareness ofand thetraining informationregarding systemsrisks of state agencies to determine, without limitation, adherence to the regulations,security standards, practices, policies and conventions of theinformation Divisionsystems of Enterprise Information identified by the Division as security-related.stration that are (e) Coordinate statewide programs for awareness and training operated or maintained by state agencies.ationagencies. systems that are 2.

Upon2. review of an information system that is operated or maintained by a state agency, the Office may make recommendations to the state agency and the Division of Enterprise Information Technology Services regarding the security of the information system.] Sec.

Upon review of an information system that is operated or maintained by a state agency, the Office may make - 80th Session (2019) – 17 – recommendations to the state agency and the Division of Enterprise Information Technology Services regarding the security of the information system.] Sec.

480.9261.0.9Establish Thepartnerships Officewith: shall:

1.

Establish partnerships with:

- *SB69_R2* – 17 – 2.

Sec.

11.7.

NRS 480.928 is hereby amended to read as follows:

The Office shall establish policies and proceduresprocedures: for:

for:

(c) The Office to notify state agencies, appropriate law enforcement and prosecuting authorities and any other appropriate public or private entity of any specific threat to the security of an information system of which the Office has been notified;

and (d) The Administrator to convene a cybersecurity incident response team appointed pursuant to subsection 2 upon notification of- the80th OfficeSession (2019) – 18 – system.Office of a specific threat to the security of an information system.2.

2.

- *SB69_R2* – 18 – Sec.

12.

NRS 480.930 is hereby amended to read as follows:

The Office shall prepare and make publiclypubliclylows: available a statewide strategic plan that outlines policies, procedures, best practices and recommendations for preparing for and mitigating risks to, and otherwise protecting, the security of information systems in this State and for recovering from and otherwise responding to threats to or attacks on the security of information systems in this State.

available a statewide strategic plan that outlines policies, procedures, best practices and recommendations for preparing for and mitigating risks to, and otherwise protecting, the security of information systems in this State and for recovering from and otherwise responding to threats to or attacks on the security of information systems in this State.

(b) Ensuring the safety of, and the continued delivery of essential services to, the people of this State in the event of a threat to or attack on the security of an information system in this State;

(d) Investing in technologies, infrastructure and personnel for pro(e) Enhancing the voluntary sharing of information and any other collaboration among state agencies, local governments, regarding protecting the security of information systems.esystems; entities 3.

and (e) Enhancing the voluntary sharing of information and any other collaboration among state agencies, local governments, - 80th Session (2019) – 19 – agencies of the Federal Government and appropriate private entities regarding protecting the security of information systems.

3.

4.information set forth in the statewide strategic plan.use of the 5.

A private entity may, in its discretion, make use of the information set forth in the statewide strategic plan.

5.

- *SB69_R2* – 19 – (a) A summary of the progress made by the Office during the previous year in executing, administering and enforcing the provisions of NRS 480.900 to 480.950, inclusive, and section 9 of this act and performing such duties and exercising such powers as are conferred upon it pursuant to NRS 480.900 to 480.950, inclusive, and section 9 of this act and any other specific statute;

(b) A general description of any threat during the previous year to the security of an information system that prompted the Administrator to convene a cybersecurity incident response team pursuant to NRS 480.928, and a summary of the response to thetheam threat;

Any record of a state agency, including the Office, or a local government , including, without limitation, a - 80th Session (2019) – 20 – record obtained from a private entity, which identifies the detection of, the investigation of or a response to a suspected or confirmed publicthreat recordto andor mayattack beon disclosedthe bysecurity theof Administratoran onlyinformation tosystem is not a anotherpublic staterecord agencyand ormay localbe government,disclosed aby cybersecuritythe incidentAdministrator only to response team appointed pursuant to NRS 480.928 and appropriateappropriateent law enforcement or prosecuting authorities and only for the purposes of preparing for and mitigating risks to, and otherwise protecting, the security of information systems or as part of a criminal investigation.

H~~~~~ 19 - *SB69_R2*80th Session (2019)