California AB 869: Surplus state property.

Bill Text

• 

• 

• 

• 

• 

• 
 Bill Text - AB-869 State agencies: information security: Zero Trust architecture.

• 

• skip to content

• home

• accessibility

• FAQ

• feedback

• sitemap

• login

• x

 Quick Search:

 Bill Number
 Bill Keyword

• 

• 

• 

• 

• 

• Home

• Bill Information

• California Law

• Publications

• Other Resources

• My Subscriptions

• My Favorites

• Bill Information
 >>

• Bill Search
 >>

• Text

 Bill Text

 PDF2
 Bill PDF

 |Add To My Favorites |Track Bill | Version: 02/19/25 - Introduced

 AB-869 State agencies: information security: Zero Trust architecture.(2025-2026)

 Text

 >>

 Votes

 >>

 History
 >>

 Bill Analysis
 >>

 Today's Law As Amended
 >>

 Compare Versions
 >>

 Status
 >>

 Comments To Author

 >>

 Track Bill
 >>

 Add To My Favorites
 >>

 SHARE THIS:

 Date Published: 02/19/2025 09:00 PM

AB869:v99#DOCUMENTBill Start

 CALIFORNIA LEGISLATURE—
 2025–2026 REGULAR SESSION

 Assembly Bill

No. 869

Introduced by Assembly Member Irwin

February 19, 2025

 An act to add Section 11549.45 to the Government Code, relating to state government. 

LEGISLATIVE COUNSEL'S DIGEST

AB 869, as introduced, Irwin.
 State agencies: information security: Zero Trust architecture.

Existing law establishes the Office of Information Security within the Department of Technology for the purpose of ensuring the confidentiality, integrity, and availability of state systems and applications and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state. Existing law requires specified state entities to implement the policies and procedures issued by the office. Existing law additionally authorizes the office to conduct, or require to be conducted, an independent security assessment of every state agency, department, or office, as specified. Existing law requires every state agency, as specified, to certify, by February 1 annually, to the office that the agency is in compliance with all adopted policies, standards, and procedures and to include a plan of action and milestones,
 as specified.

This bill would require every state agency, as specified, and subject to specified exceptions, to implement Zero Trust architecture for all data, hardware, software, internal systems, and essential third-party software, including for on-premises, cloud, and hybrid environments, to achieve prescribed levels of maturity based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model, as defined, by specified dates. In implementing Zero Trust architecture, the bill would require state agencies to prioritize the use of solutions that comply with, are authorized by, or align to federal guidelines, programs, and frameworks and, at a minimum, prioritize multifactor authentication for access to all systems and data, enterprise endpoint detection and response solutions, and robust logging practices, as specified. The bill would require the office’s chief to develop or revise uniform technology policies, standards, and procedures for use by
 all state agencies in Zero Trust architecture to achieve specified maturity levels on all systems in the State Administrative Manual and Statewide Information Management Manual. The bill would require the chief to update requirements for existing annual reporting activities to collect information relating to the progress state agencies are making to increase internal defenses of agency systems. The bill would authorize the chief to update existing annual reporting activities to include how a state agency is progressing with respect to specified goals. The bill would also state the Legislature’s intent that the bill’s provisions be implemented in a manner consistent with the state’s timely compliance with requirements that are conditions to receipt of federal funds. The bill would also make related legislative findings and declarations.

Digest Key

 Vote:
 MAJORITY 
 Appropriation:
 NO 
 Fiscal Committee:
 YES 
 Local Program:
 NO 

Bill Text

The people of the State of California do enact as follows:

SECTION 1.

 The Legislature finds and declares the following:

(a) Recent cyber breaches have had wide-ranging consequences and demand a state-level response. Cyber defense requires greater speed and agility to mitigate cyber threats, limit the impact of data breaches, and better protect the state’s workforce and residents. These attacks not only significantly impact institutions financially, but they also erode public trust and confidence in government.

(b) To better defend against cyber threats, the Legislature intends for state agencies to embrace technologies and practices outlined in Executive Order 14028 on Improving the Nation’s Cybersecurity. At a minimum, this includes
 formalizing Zero Trust as the desired model for security. Zero Trust is a security architecture requiring all users, whether in or outside the organization’s network, to be a