SB 12 — Revises provisions relating to the Office of the Chief Information Officer within the Office of the Governor. (BDR 19-280)

- 83rd Session (2025) – 4 – (c) The Computing Services [Unit.] Division.

(f) Other units, groups, divisions or departments deemed necessary by the Chief to the extent such functions are supported by the appropriations allocated to the functions of the Office.Office.orted by 3.

3.

- *SB12* – 5 – 2.

There is hereby created an Information TechnologyTec(a) AdvisoryOne Board.member appointed by the Majority Floor Leader of the Senate from the membership of the Senate Standing Committee on Finance.

The Board consists of:

(a) One member appointed by the Majority Floor Leader of the Senate from the membership of the Senate Standing Committee on Finance.

(e)- The83rd AttorneySession General(2025) or– his5 or– her(f) designee.Five persons appointed by the Governor as follows:

(f) Five persons appointed by the Governor as follows:

2.subsection 1 serves for a term of 4 years.

Each person appointed pursuant to paragraph (f) of subsection 1 serves for a term of 4 years.

- *SB12* – 6 – Sec.

The Chief Information Officer or Deputy Chief of the Office of Information Security, at his or her discretion, may inform members of the Technological Crime Advisory Board created by NRS 205A.040, the Nevada Commission on Homeland SecuritySecurityd by created by NRS 239C.120 and the Information Technology Advisory Board created by NRS 242.122 of any breach of an information system of a state agency or elected officer or application of such an information system or unauthorized acquisition of computerized data or information that materially compromises the security, confidentiality or integrity of such an information system.

Sec.- 83rd Session (2025) – 6 – 242.191 1.RS 24Except as otherwise provided in subsection 3, the amount receivable from a state agency or officer or local governmental agency which uses the services of the Office must be determined by the Chief in each case and include:

10.

NRS 242.191 is hereby amended to read as follows:

242.191 1.

Except as otherwise provided in subsection 3, the amount receivable from a state agency or officer or local governmental agency which uses the services of the Office must be determined by the Chief in each case and include:

The Chief shall prepare and submit monthly to the state agencies and officers and local governmental agencies for which services of the Office have been performed an itemized statement of the amount receivable from each state agency or officer or local governmentalgov3. agency.

3.

- *SB12* – 7 – (a) Modifies;

(i) Retains possession of;

possession of;

- 83rd Session (2025) – 7 – (a) Modifies;

(e) Damages;

or - *SB12* – 8 – (k) Obtains or attempts to obtain access to, permits access to or causes to be accessed,  aa4.ompExcept computer,as systemotherwise orprovided networkin issubsection guilty6, of a misdemeanor.person who knowingly, willfully and without authorization:

4.

Except as otherwise provided in subsection 6, a person who knowingly, willfully and without authorization:

- 83rd Session (2025) – 8 – (b) Caused response costs, loss, injury or other damage in excess of $500;

or (c) Caused an interruption or impairment of a public service, including, without limitation, a governmental operation, a system of publicelectricity,nication communication or transportation or a supply of water, gas or electricity,  the person is guilty of a category C felony and shall be punished as provided in NRS 193.130, and may be further punished by a fine of not more than $100,000.

-(b) *SB12*The –AttChief 9GInformation –Officer (a)of Thethe AttorneyGovernor’s General.Technology Office [of the Chief Information Officer] within the Office of the Governor.

(b) The Chief Information Officer of the Governor’s Technology Office [of the Chief Information Officer] within the Office of the Governor.

- 83rd Session (2025) – 9 – (4) One or more persons who are residents of this State and who are employed by the Federal Government.

A vacancy on the Board in an appointed position must be filled in the same manner as the original appointment.

A member may be reappointed to the Board.Board.inal 4.

4.

A state agency or political subdivision of this State shall not require an officer or employee who is a member of the Board to make up the time the officer or employee is absent from work to carry out duties as a member of the BoardBoaSec. or use annual vacation or compensatory time for the absence.

- *SB12* – 10 – Sec.

NRS 205A.050 is hereby amended to read as follows:follows:nce.

The Attorney General may designate a representative to serve in his or her place on the Board or attend a meeting of the - 83rd Session (2025) – 10 – Board in his or her place.

The Chief Information Officer of the Governor’s Technology Office [of the Chief Information Officer] within the Office of the Governor may designate a representative to serve in his or her place on the Board or attend a meeting of the BoardBoa4. in his or her place.

4.inSeven members of the Board constitute a quorum.

Seven members of the Board constitute a quorum.

Coordinate and provide training and education for members of the general public, private industry and governmental agencies, including, without limitation, law enforcement agencies, concerning theprevent, statisticsdetect and methodsinvestigate of technological crimescrimes.d and how to prevent,4. detect and investigate technological crimes.

- *SB12* – 11 – 4.

- 83rd Session (2025) – 11 – Sec.

233F.010 As used in this chapter, unless the context otherwise requires, the words and terms defined in NRS [233F.015] 233F.020 to 233F.065, inclusive, have the meanings ascribed to them in those sections.secSec.

Sec.

233F.117 If a state agency other than the Network Transport Services [Group] Unit adds equipment which extends the state communications system to another location, the extension, if approved by the Chief, becomes part of the state communications system.

An approved extension of the system is subject to thethens provisions of this chapter relating to the system.

- *SB12* – 12 – Sec.

- 83rd Session (2025) – 12 – (a) Plan, carry out and administer a state telecommunications system.

When available at a competitive cost, the [Telecommunications Group] Unified Communications Unit shall use the facilities of telephone companies providing local exchange service.ser(b) Make arrangements for the installation of a central telephone switchboard or switchboards to serve the state offices in one or more buildings as may be practical or feasible.

(b) Make arrangements for the installation of a central telephone switchboard or switchboards to serve the state offices in one or more buildings as may be practical or feasible.

and (g) One member from the Governor’s Technology Office [of the Chief Information Officer] within the Office of the Governor.

- *SB12* – 13 – 5.

8.- 83rd Session (2025) – 13 – technical advisors as the Council deems necessary.tance from 9.

The members of the Council may request assistance from technical advisors as the Council deems necessary.

9.

(e) Approve or deny any agreement between the Department and a telecommunications provider proposed pursuant to NRS 408.5502, if the Council finds that the agreement is competitively neutral and nondiscriminatory;

andhat the agreement is competitively neutral and (f) Provide other assistance as requested by the Department.

and (c)for:c) Designate a website client administrator who is responsible for:(1) Determining the persons who are authorized to use the Internet website;

- *SB12* – 14 – (1) Determining the persons who are authorized to use the Internet website;

- 83rd Session (2025) – 14 – 3.

4.239.0115, information collected, maintained, stored, backed up or on file on the Internet website is confidential, not subject to subpoena or discovery and is not subject to inspection by the general public.

Except as otherwise provided in this section and NRS 239.0115, information collected, maintained, stored, backed up or on file on the Internet website is confidential, not subject to subpoena or discovery and is not subject to inspection by the general public.

Provide grants of money to local emergency planning committees to improve their ability to respond to emergencies involvinginv3.viAssist hazardouswith materials;the development of comprehensive plans for responding to such emergencies in this State;

3.

Assist with the development of comprehensive plans for responding to such emergencies in this State;

- *SB12* – 15 – 5.

- 83rd Session (2025) – 15 – 8.

andandSec. 49 U.S.C.

§§ 5101 et seq.

Sec.

Coordinate with the Investigation Division of the Department regarding gathering intelligence on and initiating investigationsinvSec. of cyber threats and incidents.

Sec.

- *SB12* – 16 – (b) The name and contact information of each operator of the unmanned aerial vehicle;

and (d)- A83rd statementSession describing(2025) the– use16 of– the unmanned aerial vehicle by the public agency.

the use of the unmanned aerial 3.

5.subsection 4 must include provisions that:tment pursuant to (a) Authorize, as a public purpose, a public agency to operate an unmanned aerial vehicle that is registered with the Department in order to conduct a scheduled inspection to ensure compliance with building or fire codes or laws, ordinances, regulations or rules adopting or establishing building or fire codes that are enforced by the public agency.

The regulations adopted by the Department pursuant to subsection 4 must include provisions that:

(a) Authorize, as a public purpose, a public agency to operate an unmanned aerial vehicle that is registered with the Department in order to conduct a scheduled inspection to ensure compliance with building or fire codes or laws, ordinances, regulations or rules adopting or establishing building or fire codes that are enforced by the public agency.

(1) Is not admissible and must not be disclosed in any judicial, administrative or other adjudicatory proceeding other than a proceeding relating to the purpose of the scheduled inspection;

andandn a (2) May not be used to establish reasonable suspicion or probable cause as the basis for the investigation or prosecution of a crime or other offense.

- *SB12* – 17 – (a) A list of countries, businesses and entities from which a public agency or law enforcement agency shall not purchase or acquire- any83rd unmannedSession aerial(2025) vehicle– or17 other– equipment or service relating to the operation of an unmanned aerial vehicle;

andandrvice (b) A list of unmanned aerial vehicles and other related equipment or services that a public agency or law enforcement agency shall not operate, purchase or acquire.

(b) Any unmanned aerial vehicle or other equipment or service relating to the operation of an unmanned aerial vehicle sold, manufactured or distributed by an entity identified by the Secretary of Defense of the United States Department of Defense pursuant to SectionDefense 1260HAuthorization ofAct thefor WilliamFiscal M.Year 2021, Public Law 116- 283, any amendments thereto or any subsequent federal law establishing such a list;

(Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Public Law 116- 283, any amendments thereto or any subsequent federal law establishing such a list;

A data collector that maintains records which contain personal information of a resident of this State shall implement and maintain reasonable security measures to protect thoseuse, recordsmodification fromor unauthorizeddisclosure.access, access, acquisition, destruction, use,2. modification or disclosure.

2.

or its successor organization, or corresponding standards adopted by the National Institute of - *SB12*83rd Session (2025) – 18 – Standards and Technology of the United States Department of Commerce.

A contract for the disclosure of the personal information of a resident of this State which is maintained by a data collector must include a provision requiring the person to whom the information is disclosed to implement and maintain reasonable security measures is to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure.

If a data collector doing business in this State accepts a payment card in connection with a sale of goods or services, the data collector shall comply with the current version of the Payment Card Industry (PCI) Data Security Standard, as adopted by the PCI Security Standards Council or its successor organization, with respect to those transactions, not later than the date for compliance set forth in the Payment Card Industry (PCI) DataDatafor Security Standard or by the PCI Security Standards Council or its successor organization.

or (b) Move any data storage device containing personal information beyond the logical or physical controls of the data collector, its data storage contractor or, if the data storage device is used by or is a component of a multifunctional device, a person who assumes the obligation of the data collector to protect personal - 83rd Session (2025) – 19 – information, unless the data collector uses encryption to ensure the security of the information.

- *SB12* – 19 – 3.

(a)(b) The databreach collector is innot compliancecaused withby thisthe section;gross negligence oron;

and (b) The breach is not caused by the gross negligence or intentional misconduct of the data collector, its officers, employees or agents.

(a) “Data storage device” means any device that stores information or data from any electronic or optical medium, including, but not limited to, computers, cellular telephones, magneticdrives, tape,and electronicthe computermedium itself.uter drives and optical computer drives,(b) and“Encryption” means the mediumprotection itself.of data in electronic or optical form, in storage or in transit, using:

(b) “Encryption” means the protection of data in electronic or optical form, in storage or in transit, using:

and (3)- Any83rd otherSession technology(2025) or– method20 identified– by the Office of Information Security of the Governor’s Technology Office [of[ofce the Chief Information Officer] within the Office of the Governor in regulations adopted pursuant to NRS 603A.217.

- *SB12* – 20 – (c) “Facsimile” means an electronic transmission between two dedicated fax machines using Group 3 or Group 4 digital formats that conform to the International Telecommunications Union T.4 or T.38 standards or computer modems that conform to the International Telecommunications Union T.31 or T.32 standards.

(e)NRS “Payment205.602.ent card” has the meaning ascribed to it in (f) “Telecommunication provider” has the meaning ascribed to it in NRS 205.602.704.027.

(f) “Telecommunication provider” has the meaning ascribed to it in NRS 704.027.

Notwithstanding any provision of law to the contrary, a person who has been appointed to or is otherwise incumbent in the position of Deputy Chief of the Office of Information Security as of July 1, 2025, is in the classified service of the State and must remain in the classified service of the State until he or she vacates the position.posSec.

Sec.

In preparing supplements to the Nevada Administrative Code, appropriately change any references to an officer, agency or other entity whose name is changed or whose responsibilities are - 83rd Session (2025) – 21 – transferred pursuant to the provisions of this act to refer to the appropriate officer, agency or other entity.

Any administrative regulations adopted by an officer or an agency whose name has been changed or whose responsibilities have been transferred pursuant to the provisions of this act to another officer or agency remain in force until amended - *SB12* – 21 – by the officer or agency to which the responsibility for the adoption of the regulations has been transferred.

Any contracts or other agreements entered into by an officer or agency whose name has been changed or whose responsibilities have been transferred pursuant to the provisions of this act to another officer or agency are binding upon the officer or agency to which the responsibility for the administration of the provisions of the contract or other agreement has been transferred.

been3. changed or whose responsibilities have been transferredas pursuant to the provisions of this act to another officer or agency remains in effect as if taken by the officer or agency to which the responsibility for the enforcement of such actions has been transferred.

Any action taken by an officer or agency whose name has been changed or whose responsibilities have been transferred pursuant to the provisions of this act to another officer or agency remains in effect as if taken by the officer or agency to which the responsibility for the enforcement of such actions has been transferred.

TEXT~~~~~ OF25 REPEALED- SECTIONS83rd 233F.015Session “Administrator”(2025) defined.

“Administrator” means the Administrator of the Division.

233F.055 “Department” defined.

“Department” means the Department of Administration.

233F.059 “Division” defined.

“Division” means the Division of Enterprise Information Technology Services of the Department.

242.013 “Administrator” defined.

“Administrator” means the Administrator of the Division.

Department of Administration.ed.

“Department” means the 242.045 “Division” defined.

“Division” means the Division of Enterprise Information Technology Services of the Department.

H - *SB12*