AB 432 — Revises provisions relating to governmental administration. (BDR 19-551)

If a using agency does not comply with the cybersecurity policies and protocols developed by the Security Operations Center, the Chief may doimpose oneadditional oversight or moreaudit ofrequirements on the following:using agency relating to cybersecurity.

Sec.

4.

ImposeThe additionalAccount oversightfor orthe auditSecurity requirementsOperations onCenter theis usinghereby agencycreated relatingin tothe cybersecurity.State General Fund.

The Chief must administer the Account.

RestrictThe money in the usingAccount agency’smust accessonly tobe used for the equipmentpurposes of thesupporting Officeand untilcarrying out the usingduties agencyof isthe backSecurity inOperations compliance.Center.

ChargeThe theChief usingmay agencyapply an additional amount for theand usingaccept agency’sfederal continuedgrants usefor of the equipmentpurposes and services of thethis Office.section.

Sec.

The ChiefSecurity mayOperations applyCenter formay andserve acceptas federala grantsfiscal foragent purposesto ofpool supportingfederal andgrant carryingfunds outfor the dutiespurposes of thecybersecurity Securitysupport Operationsand Center.infrastructure development.

The Security Operations Center may establish criteria for using agencies to access shared resources which must ensure equitable distribution of the resources and maximize competiveness for federal opportunities.

5.

All interest earned on the money in the Account, after deducting any applicable charges, must be credited to the Account.

6.

All claims against the Account must be paid as other claims against the State are paid.

- *AB432_R1* – 5 – 7.

Any money remaining in the Account at the end of a fiscal year does not revert to the State General Fund and must be carried forward to the next fiscal year.

- *AB432* – 5 – (d) A summary of any issues presenting challenges to the Security Operations Center;

6.5.

Nothing in this chapter shall be construed to impair or affect existing agreements with a federally recognized American Indian tribe.

Any interlocal agreement entered into with the governing body of an Indian tribe, group of tribes, organized segment of a tribe or any organization representing two or more such entities must respect sovereign governance and provide for jointly agreed data protocols.

Sec.

To the extent that funding is available:

The Program must,must without limitation, develop a system for the career development of students in the field of computer science or cybersecurity.

The Program must,must without limitation, provide opportunities for students within the Nevada System of Higher Education who are majoring - *AB432_R1* – 6 – in a field related to cybersecurity to obtain working experience in the Security Operations Center.

The Legislature hereby determines and declares that the creation of the Office of the Chief Information Officer within the Office of the Governor is necessary for the secure, coordinated, orderly and economical processing of data and - *AB432* – 6 – information in State Government, to ensure the secure and economical use of information systems and to prevent the unnecessary proliferation of equipment and personnel among the various state agencies.

(b) To provide technical advice [butbut not administrative control]control of the information systems within the [state] using agencies .

- *AB432_R1* – 7 – (c) The Computing Services Unit.

and - *AB432* – 7 – (4) Plans used to re-establish security and service with respect to an information system after security has been breached or service has been interrupted.

- *AB432_R1* – 8 – 3.

- *AB432* – 8 – Sec.

The policy for the information systems of [the Executive Branch of Government, excluding the Nevada System of Higher Education and the Nevada Criminal Justice Information System,] using agencies, as that policy relates, but is not limited, to such items as standards for systems and programming and criteria for selection, location and use of information systems to meet the requirements of [state] using agencies and officers at[at] in the least[least cost toto] best interests of the State;State [;] and using agencies;

The effective administration of the Office, including, without limitation, security to prevent unauthorized access to - *AB432_R1* – 9 – information systems and plans for the recovery of systems and applications after they have been disrupted;

- *AB432* – 9 – (d) The Department of Transportation;

(l) Any otherlocal stategovernmental agency;agency.

and (m) Any local governmental agency.

- *AB432_R1* – 10 – (a) If the Legislature is in regular or special session, obtain the approval of the Legislature by concurrent resolution.

Any local governmental agency which has entered into an agreement to use the equipment and services of the Office and desires to withdraw substantially from that use must apply to the Chief for approval.

The application must set forth the justification for the withdrawal.

5.

The effective administration and use of the computer facility, including security to prevent unauthorized access to data, - *AB432* – 10 – information and plans for the recovery of systems and applications after they have been disrupted.

3.

The Security Operations Center shall not assume operational control of the equipment or software systems of a - *AB432_R1* – 11 – using agency.

Before providing services, the Security Operations Center shall provide to the using agency standards and policies for the equipment or software systems of the using agency which must be agreed upon in writing.

(a) Unauthorized[Unauthorized access to an information system or application of an information system of the Office used by the [state]state using agency ;or elected state officer;

[orand] electedA statedata officer;]breach; and - *AB432* – 11 – (b) Noncompliance with the regulations, standards, practices, policies and conventions of the Office that is identified by the Office as security-related,  to the Office of Information Security of the Office and Security Operations Center within 24 hours after discovery of the suspected incident.

(b) A distributed denial of service incident;

(c) A ransomware incident;

(d) Any other incident that disrupts the delivery or essential services for more than 1 business day or directly affects life or property;

or (e) Noncompliance with the regulations, standards, practices, policies and conventions of the Office that is identified by the Office as security-related, - *AB432_R1* – 12 –  to the Office of Information Security of the Office and Security Operations Center within 24 hours after discovery of the suspected incident.

The report submitted pursuant to subsection 2 must contain the following information:

(a) The date and time of the incident;

(b) The type of incident;

(c) The type of information system or data affected by the incident;

(d) The known and projected impact of the incident to the using agency;

(e) Whether law enforcement, a regulatory body or any other entity that could be affected by the incident has been notified, as applicable;

and (f) Any additional resources needed by the using agency to respond to the incident, as applicable.

4.

The Chief may establish a uniform reporting system if the Office and Security Operations Center are organizationally collocated.

5.

The Chief Information Officer or Chief of the Office of Information Security, at his or her discretion, may inform members of the Technological Crime Advisory Board created by NRS 205A.040, the Nevada Commission on Homeland Security created by NRS 239C.120 and the Information Technology Advisory Board created by NRS 242.122 of any breach of an information system of a [state] using agency [or elected officer] or application of such an information system or unauthorized acquisition of computerized - *AB432_R1* – 13 – data or information that materially compromises the security, confidentiality or integrity of such an information system.

(a) The annual expense, including depreciation, of operating and maintaining the Network Services Unit,Unit [,] and the cybersecurity services provided by the Security Operations Center, distributed among the agencies in proportion to the services performed for each agency.

(b) TheA annualservice expensecharge ofin an amount determined by distributing the cybersecuritymonthly servicesinstallment providedfor bythe construction costs of the Securitycomputer Operationsfacility Center,among including,the withoutagencies limitation,in real-timeproportion monitoring,to incidentthe responseservices andperformed securityfor enforcement.each agency.

- *AB432* – 12 – (c) A service charge in an amount determined by distributing the monthly installment for the construction costs of the computer facility among the agencies in proportion to the services performed for each agency.

- *AB432_R1* – 14 – TEXT OF REPEALED SECTION 242.141Governor’s Servicescontrol providedand local governmental agencies.not undeTo facilitate the economical processing of data or information throughout the State Government, the Office may provide service for agencies not under Governor’sthe control andof localthe governmentalGovernor, agencies.upon the request of any such agency.

ToThe facilitateOffice themay economicalprovide processingservices, ofincluding, datawithout orlimitation, informationpurchasing throughoutservices, theto Statea Government,local thegovernmental Officereduced maycosts provideto service for agencies not under the controlState offor theequipment Governor,and uponservices.l theresult requestin ofH any- such*AB432_R1* agency.

The Office may provide services, including, - *AB432* – 13 – agency upon request, if provision of such services will result in reduced costs to the State for equipment and services.

H - *AB432*