Pennsylvania SB 373: An Act amending Title 71 (State Government) of the Pennsylvania Consolidated Statutes, in boards and offices, providing for information technology and security.

Bill Text

PRINTER'S NO. 321
THE GENERAL ASSEMBLY OF PENNSYLVANIA
SENATE BILL
No. 373
Session of
2025
INTRODUCED BY PHILLIPS-HILL, BROWN, STEFANO, CULVER, DUSH AND
LAUGHLIN, MARCH 6, 2025
REFERRED TO COMMUNICATIONS AND TECHNOLOGY, MARCH 6, 2025
AN ACT
Amending Title 71 (State Government) of the Pennsylvania
Consolidated Statutes, in boards and offices, providing for
information technology and security.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Part V of Title 71 of the Pennsylvania
Consolidated Statutes is amended by adding a chapter to read:
CHAPTER 43
INFORMATION TECHNOLOGY
Subchapter
A. General Provisions (Reserved)
C. Security
SUBCHAPTER A
GENERAL PROVISIONS
(Reserved)
SUBCHAPTER C
SECURITY
Sec.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

4351. Statewide security standards.
4352. Security standards and risk assessments.
4353. Assessment of compliance with security standards.
4354. Joint Cybersecurity Oversight Committee.
§ 4351. Statewide security standards.
(a) Establishment.--
(1) The Chief Information Officer within the Office of
Administration shall establish a Statewide set of standards
for information technology security to maximize the
functionality, security and interoperability of the
Commonwealth's distributed information technology assets,
including:
(i) Data classification.
(ii) Management.
(iii) Communications.
(iv) Encryption technologies.
(2) The standards under this subsection shall conform to
the industry's best practices and standards regarding
information technology security.
(b) Review and revision.--The Chief Information Officer
shall review and revise the security standards annually as
necessary. As part of this function, the Chief Information
Officer shall review periodically existing security standards
and practices in place among the various State agencies to
determine whether those standards and practices meet Statewide
security and encryption requirements.
(c) Assumption of responsibilities.--The Chief Information
Officer may assume the direct responsibility of providing for
the information technology security of a State agency that fails
to adhere to security standards adopted under this chapter.
20250SB0373PN0321 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

§ 4352. Security standards and risk assessments.
(a) Authorization to operate.--Notwithstanding any other
provision of law and except as otherwise provided by this
chapter, all information technology security goods, software or
services purchased using taxpayer money, or for use by a State
agency or in a public facility, shall require an authorization
to operate by the head of the State agency in accordance with
security standards under this chapter. No information technology
system or service may be operated by, or in support of, a State
agency without an authorization to operate.
(b) Standards.--The Chief Information Officer within the
Office of Administration shall define a risk-based set of
control standards that identify specific security and privacy
protections for all information technology and information
technology services in line with the specific threats and risks
to the residents of this Commonwealth and State agency
operations.
(c) Assessments.--
(1) The Chief Information Officer shall conduct risk
assessments to identify compliance and operational and
strategic risks to the information technology network and
agency operations.
(2) The assessments may include methods such as
penetration testing, social-engineered security threats or
similar assessment methodologies.
(3) The Chief Information Officer may contract with
another party to perform the assessments.
(4) The following assessment reviews shall be performed
prior to the information security audit under subsection (e)
and the assessment shall be performed consistent with the
20250SB0373PN0321 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

Federal information processing standards:
(i) Identity management.
(ii) Security incident management.
(iii) Network perimeter security.
(iv) Systems development.
(v) Project management.
(vi) Information technology risk management.
(vii) Data management.
(viii) Vulnerability management.
(5) Detailed reports of the risk and security issues
identified in the assessments shall be reported to the Chief
Information Officer and shall be kept confidential.
(6) The agency head, in consultation with the Office of
Administration, shall identify corrective or mitigating
actions as needed.
(d) Interim authority to operate.--If the agency head
determines that the information technology system or service is
needed, the agency head may seek authorization from the Chief
Information Officer for a period not longer than 180 days to
implement the corrective or mitigating actions.
(e) Security audit.--
(1) The Chief Information Officer shall contract with an
independent certified information security auditor or ent