AB432 - Revises provisions relating to governmental administration. (BDR 19-551)

EXEMPT (Reprinted with amendments adopted on April 21, 2025) FIRST REPRINT A.B. 432 - *AB432_R1* ASSEMBLY BILL NO. 432–ASSEMBLYMEMBER YUREK MARCH 13, 2025 ____________ Referred to Committee on Government Affairs SUMMARY—Revises provisions relating to governmental administration. (BDR 19-551) FISCAL NOTE: Effect on Local Government: May have Fiscal Impact. Effect on the State: Yes. ~ EXPLANATION – Matter in bolded italics is new; matter between brackets [omitted material] is material to be omitted. AN ACT relating to governmental administration; creating and setting forth the duties of the Security Operations Center within the Office of the Chief Information Officer within the Office of the Governor; creating the Account for the Security Operations Center and prescribing the use of money in the Account; requiring the Security Operations Center to prepare an annual report that assesses the effectiveness of the Security Operations Center; establishing the Cybersecurity Talent Pipeline Program; revising the purpose of the Office; authorizing the board of trustees of a school district to use the services and equipment of the Office; making various other changes relating to the cybersecurity of governmental entities; and providing other matters properly relating thereto. Legislative Counsel’s Digest: Existing law provides that the Office of the Chief Information Officer within 1 the Office of the Governor is composed of: (1) the Administration Unit; (2) the 2 Client Services Unit; (3) the Computing Services Unit; (4) the Network Services 3 Unit, including a Network Transportation Services Group and a 4 Telecommunications Group; (5) the Office of Information Security; and (6) certain 5 other units, groups, divisions or departments deemed necessary by the Chief 6 Information Officer. (NRS 242.080) Section 12 of this bill creates the Security 7 Operations Center in the Office of the Chief Information Officer. 8 Existing law: (1) requires the Office to provide certain state agencies and 9 elected officers with all their required design of information systems; (2) authorizes 10 certain other state agencies to negotiate with the Office for its services or the use of 11 its equipment; and (3) authorizes, upon request, the Office to provide certain 12 services to state agencies not under the control of the Governor and local 13 – 2 – - *AB432_R1* governmental agencies. (NRS 242.131, 242.141) Section 15 of this bill requires the 14 Security Operations Center to provide certain state agencies and elected officers 15 with cybersecurity services, including real-time monitoring of cyberinfrastructure, 16 threat mitigation, incident response and cybersecurity enforcement. Sections 15 17 and 24 of this bill reorganize provisions that authorize certain state agencies and 18 local governmental agencies to use the equipment and services of the Office. 19 Section 15 also requires any local governmental agency which has agreed to use 20 the equipment and services of the Office to apply to the Chief to withdraw from the 21 use. Section 9 of this bill revises the definition of “local governmental agency” to 22 include the board of trustees of a school district, which has the effect of authorizing 23 the board of trustees of a school district to use the services of the Office pursuant to 24 section 15. Section 10 of this bill amends the definition of “using agency” so that 25 the term includes any state agency, state officer or local governmental agency that 26 uses the services and equipment of the Office. 27 Section 2 of this bill requires the Security Operations Center to develop certain 28 policies and procedures to: (1) combat the increasing threats to using agencies 29 posed by cybercriminals; (2) protect sensitive data in the possession of a using 30 agency; and (3) ensure a coordinated and rapid response to any cybersecurity 31 incident that affects a using agency. 32 Section 3 of this bill provides that if a using agency does not comply with the 33 cybersecurity policies and protocols developed by the Security Operations Center, 34 the Chief may impose additional oversight or audit requirements on the using 35 agency relating to cybersecurity. 36 Section 4 of this bill creates the Account for the Security Operations Center in 37 the State General Fund to be administered by the Chief. Section 4 requires the 38 money in the Account to be used for the purposes of supporting and carrying out 39 the duties of the Security Operations Center. Section 4 also authorizes the Security 40 Operations Center to serve as a fiscal agent to pool federal grant funds for the 41 purposes of cybersecurity support and infrastructure development. 42 Section 5 of this bill requires the Security Operations Center to collaborate 43 with the Nevada Office of Cyber Defense Coordination to enhance communication 44 and coordination of incident responses to cyber threats or cyberattacks on 45 information systems. 46 Section 6 of this bill requires the Security Operations Center to submit an 47 annual report to the Governor, Attorney General and the Director of the Legislative 48 Counsel Bureau for transmission to the Legislature that includes certain 49 information relating to the duties of the Security Operations Center. 50 Section 6.5 of this bill provides that the provisions of the Nevada Revised 51 Statutes relating to information services do not impair or affect existing agreements 52 with a federally recognized American Indian tribe and that any interlocal agreement 53 entered into must respect the sovereign governance of the tribe and provide for 54 jointly agreed data protocols. 55 To the extent that funding is available, section 7 of this bill requires the 56 Security Operations Center, in collaboration with the Nevada System of Higher 57 Education, to develop the Cybersecurity Talent Pipeline Program. 58 Section 8 of this bill amends the definition of “information service,” as 59 provided by the Office to a using agency, to include the real-time monitoring of 60 cyberinfrastructure, threat mitigation, incident response and cybersecurity 61 enforcement. 62 Existing law makes certain legislative determinations and declarations relating 63 to the creation and purpose of the Office. (NRS 242.071) Section 11 of this bill 64 revises these determinations and declarations to include performing information 65 services for using agencies. 66 Existing law provides that certain documents relating to homeland security that 67 are assembled, maintained, overseen or prepared by the Office to mitigate, prevent 68 – 3 – - *AB432_R1* or respond to acts of terrorism are confidential. (NRS 242.105) Section 13 of this 69 bill provides that certain documents relating to the cybersecurity of a using agency 70 are also confidential. 71 Existing law requires the Chief to adopt certain regulations relating to 72 information systems of certain state agencies. (NRS 242.111) Section 14 of this bill 73 instead requires the Chief to adopt certain regulations relating to information 74 systems of using agencies. 75 Existing law requires the Chief to advise using agencies regarding the policy 76 for information services of the Executive Branch of Government. (NRS 242.151) 77 Section 16 of this bill instead requires the Chief to advise the using agencies of the 78 policy for information services of the Office. 79 Existing law provides that all equipment of an agency or elected state officer 80 which is owned or leased by the State must be under the managerial control of the 81 Office. (NRS 242.161) Section 17 of this bill: (1) provides instead that all 82 equipment of a using agency which is owned or leased by the State must be under 83 the managerial control of the Office; (2) prohibits the Security Operations Center 84 from assuming operational control of the equipment or software systems of a using 85 agency; and (3) requires the Security Operations Center to provide standards and 86 policies for the equipment or software systems which must be agreed upon in 87 writing before the Security Operations Center provides services. 88 Section 18 of this bill provides that the Office is responsible for any application 89 of an information system which it furnishes to using agencies. 90 Section 19 of this bill requires: (1) any using agency which uses the equipment 91 or services of the Office to adhere to the regulations, standards, practices, policies 92 and conventions of the Office; and (2) each using agency to report certain 93 information relating to certain suspected incidents to the Security Operations 94 Center. 95 Existing law requires the Chief to investigate and resolve any breach of an 96 information system of a state agency or elected officer that uses the equipment or 97 services of the Office. (NRS 242.183) Section 20 of this bill requires instead that 98 the Chief, in consultation with the Security Operations Center, investigate and 99 resolve any breach of an information system of using agency. 100 Existing law provides that the amount receivable from a state agency or officer 101 or local governmental agency which uses the service of the Office must be 102 determined by the Chief. (NRS 242.191) Section 21 of this bill provides instead 103 that the amount receivable from a using agency which uses the services or 104 equipment of the Office must be determined by the Chief. 105 Section 22 of this bill requires each using agency using the services and 106 equipment of the Office to pay a fee to the Fund for Information Services. 107 THE PEOPLE OF THE STATE OF NEVADA, REPRESENTED IN SENATE AND ASSEMBLY, DO ENACT AS FOLLOWS: Section 1. Chapter 242 of NRS is hereby amended by adding 1 thereto the provisions set forth as sections 2 to 7, inclusive, of this 2 act. 3 Sec. 2. 1. The Security Operations Center shall develop 4 policies and procedures to: 5 (a) Combat the increasing threats to using agencies posed by 6 cybercriminals; 7 – 4 – - *AB432_R1* (b) Protect sensitive data in the possession of a using agency; 1 and 2 (c) Ensure a coordinated and rapid response to any 3 cybersecurity incident that affects a using agency. 4 2. The policies and procedures developed pursuant to 5 subsection 1 must include, without limitation: 6 (a) A requirement that a using agency notify the Security 7 Operations Center of any specific or immediate threat to the 8 cybersecurity of an information system operated or maintained by 9 the using agency; 10 (b) A requirement that the Security Operations Center notify 11 the appropriate law enforcement agency and prosecuting attorney 12 and any other appropriate public or private entity of any specific 13 threat to the cybersecurity of an information system of which the 14 Security Operations Center has been notified; 15 (c) A strategy for developing ongoing programs for 16 professional development in cybersecurity for the employees of a 17 using agency; and 18 (d) The use of security orchestration automation and response 19 systems to automate repetitive tasks, enhance operational 20 efficiency and standardize procedures and responses for the 21 various information technology support of using agencies. 22 Sec. 3. If a using agency does not comply with the 23 cybersecurity policies and protocols developed by the Security 24 Operations Center, the Chief may impose additional oversight or 25 audit requirements on the using agency relating to cybersecurity. 26 Sec. 4. 1. The Account for the Security Operations Center 27 is hereby created in the State General Fund. The Chief must 28 administer the Account. 29 2. The money in the Account must only be used for the 30 purposes of supporting and carrying out the duties of the Security 31 Operations Center. 32 3. The Chief may apply for and accept federal grants for the 33 purposes of this section. 34 4. The Security Operations Center may serve as a fiscal agent 35 to pool federal grant funds for the purposes of cybersecurity 36 support and infrastructure development. The Security Operations 37 Center may establish criteria for using agencies to access shared 38 resources which must ensure equitable distribution of the 39 resources and maximize competiveness for federal opportunities. 40 5. All interest earned on the money in the Account, after 41 deducting any applicable charges, must be credited to the Account. 42 6. All claims against the Account must be paid as other 43 claims against the State are paid. 44 – 5 – - *AB432_R1* 7. Any money remaining in the Account at the end of a fiscal 1 year does not revert to the State General Fund and must be carried 2 forward to the next fiscal year. 3 Sec. 5. The Security Operations Center shall collaborate with 4 the Nevada Office of Cyber Defense Coordination created by NRS 5 480.920 to enhance communication and coordination of incident 6 responses to cyber threats or cyberattacks on information systems 7 and to provide each using agency information relating to 8 emerging cyber threats and best practices for cybersecurity. 9 Sec. 6. 1. On or before January 1 of each year, the Security 10 Operations Center shall prepare a report assessing the 11 effectiveness of the Security Operations Center relating to its 12 duties. The report must include, without limitation: 13 (a) A summary of the progress made by the Security 14 Operations Center during the previous year in performing its 15 duties and exercising such powers as are conferred upon it; 16 (b) A general description of any threats or attacks responded to 17 by the Security Operations Center during the previous year, and a 18 summary of the response to the threat; 19 (c) A summary of the goals and objectives of the Security 20 Operations Center for the upcoming year; 21 (d) A summary of any issues presenting challenges to the 22 Security Operations Center; and 23 (e) Any other information that the Chief determines is 24 appropriate to include in the report. 25 2. The report required pursuant to subsection 1 must be 26 submitted not later than July 1 of each year to the Governor, 27 Attorney General and Director of the Legislative Counsel Bureau 28 for transmission to the Legislature. 29 Sec. 6.5. Nothing in this chapter shall be construed to impair 30 or affect existing agreements with a federally recognized 31 American Indian tribe. Any interlocal agreement entered into with 32 the governing body o [Text truncated for display. Full text available on LegiScan.]