State cybersecurity officials would monitor agencies and protect sensitive systems

The Security Operations Center must provide cybersecurity services and develop policies for agencies that use the Governor’s Technology Office. Required users include state agencies and elected state officers. Other state agencies, local governments, and school districts may use the Office’s services under an agreement. Services include real-time monitoring, threat mitigation, incident response, and cybersecurity enforcement. Using agencies must follow the Office’s rules and report certain suspected incidents within 24 hours after discovery. The Center may impose added oversight or audits when a using agency does not follow its cybersecurity policies. The act states that these provisions become effective upon passage and approval.

Meetings between executive-branch agencies or officers and the Legislature about specified cybersecurity or essential-service threats must be closed. The rule covers threats to public facilities, essential services, public access to services or facilities, and cybersecurity controls or information involving critical infrastructure. Meeting materials, minutes, and recordings would be confidential and unavailable to the public, subpoenas, and discovery. People who attend may not disclose information or materials to anyone outside the Executive Department or Legislature. The general Open Meeting Law would not apply to these meetings. The act states that these meeting and confidentiality rules become effective upon passage and approval.

Using agencies must pay the Office for technology services, while the act provides cybersecurity funding and loans for the Governor’s Technology Office. Fees apply to each using agency that uses the Office’s services or equipment. The appropriations support cybersecurity investments and shortfalls in three Technology Office divisions. The Chief sets fees high enough to cover the full cost of services, including overhead, and agencies must budget for them. Cybersecurity investment appropriations total $6,458,457 for fiscal year 2025–2026 and $3,420,682 for fiscal year 2026–2027. The division loans must be repaid through annual installments beginning July 1, 2027, and fully repaid by the end of fiscal year 2030–2031. Unused investment funds must revert by September 18, 2026, or September 17, 2027, depending on the fiscal year; loan repayment begins July 1, 2027.