IE11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Governor Signs Bill Requiring IT Security Assessments for State Agencies

AB 670 by Assemblymember Jacqui Irwin, D-Thousand Oaks, will require the California Office of Information Security (OIS) to conduct no fewer than 35 security assessments of state agencies, departments and offices annually.

With the Oct. 11 deadline approaching for Jerry Brown to act on legislation, the governor announced Tuesday he has signed dozens of bills – including four that Techwire has been following closely:

AB 670 by Assemblymember Jacqui Irwin, D-Thousand Oaks, will require the California Office of Information Security (OIS) to conduct no fewer than 35 security assessments of state agencies, departments and offices annually. Currently the security office, a division of the Department of Technology, is authorized to conduct its own security assessments, but it’s not required. Only a few were done each year. Assessments through OIS usually take one to two days with costs ranging between $10,000 and $40,000 depending on the size and depth of the assessment, according to a legislative analysis.

AB 670 authorizes the California Military Department’s security assessment team to perform these audits, Irwin said Tuesday.

“This legislation improves cybersecurity preparedness by ensuring the risk assessments are regularly performed on state networks that contain the most sensitive information,” Irwin said in a statement this afternoon. “This bill addresses the problem identified by the recent State Auditor report, that compliance with existing security controls is lacking and there is no enforcement. AB 670 ensures more frequent use of this vital tool to protect public safety and our economy.”

AB 670 goes into effect on Jan. 1, 2016.

Read more about AB 670 in this earlier Techwire story.

Brown also signed other tech-related legislation:

Connected televisions. AB 1116 by the Assembly Committee on Privacy and Consumer Protection

This privacy-focused bill forbids operating a voice recognition feature within a connected TV unless the user is prominently informed at the time of setup or installation.

Automated license plate recognition (ALPR) system data use. SB 34 by Senator Jerry Hill, D-San Mateo

The bill mandates operators of ALPR systems to keep specified records of access and require that ALPR information only be used for authorized purposes, among other requirements.

Invasion of privacy via drones. AB 856 by Assemblymember Ian Calderon, D-Whittier, clarifies that it’s trespassing for paparazzi to fly a drone over private property.


Reporting from Techwire contributing writer Robin Epley was used in this report.

Matt Williams was Managing Editor of Techwire from June 2014 through May 2017.