Senate panel advances substitute for SB254 to expand Office of Cybersecurity authority and committee makeup

Senator Michael Padilla moved the committee substitute for Senate Bill 254, telling the Senate Rules Committee the measure renames and expands the Office of Cybersecurity, clarifies which state networks fall under the office's authority and adjusts membership of the state cybersecurity committee so the state chief information security officer is a voting member.

The substitute adds a definition of "state operated or state owned telecommunications network," which the sponsor said refers to networks controlled by the Department of Information Technology (DUIT) and seeks to clarify that the Office of Cybersecurity will not have regulatory authority over networks that are wholly independent of DUIT. Padilla said the change was made at the request of a stakeholder listed in the hearing packet and to address a request from the Administrative Office of the Courts for clarity about judicial networks.

Raja Sambandhan, identified in committee as the state's chief information security officer, said the office now supports 76 executive-branch agencies on a voluntary basis and provides voluntary cybersecurity support for school districts, higher-education institutions, municipalities, counties and some water and wastewater systems. Sambandhan said the office has been expanding since it was created and that it is engaged in both defensive cybersecurity work and in advising on industrial control systems for critical utilities.

Members queried the fiscal impacts of the substitute. Senator Townsend asked about a fiscal note referencing the Per Diem and Mileage Act and who would be eligible for per diem. Sambandhan said the per diem applies to advisory committee members physically present at meetings and noted most meetings have been held remotely. Committee members also discussed the substitute language that allows the governor to appoint members who will enable the committee to meet current federal cybersecurity grant stakeholder requirements; Padilla said that change will help the state remain eligible for federal funding.

Senator Block asked about the use of the word “minimum” in the bill’s cybersecurity controls language. Padilla and Sambandhan defended the choice, saying the bill establishes baseline standards agencies must meet to transact with the state while allowing agencies to adopt stronger controls.

The committee considered motions on a do-not-pass for the underlying SB254 and a do-pass on the Senate Rules Committee substitute. After no recorded opposition, the committee recorded the motion in favor—Senator Padilla secured a do-pass on the committee substitute and the committee advanced the substitute under the committee's procedures.

No public witnesses were listed in the hearing packet as formal supporters or opponents; a small number of people in the room indicated support or opposition at the chair's invitation. The substitute language shown to the committee restored the Director of the Legislative Council Service to the committee, and placed appointment flexibility in the governor to meet federal grant composition rules.

The committee did not take a roll-call vote listing individual tallies in the transcript excerpt; the chair announced the substitute had a do-pass out of committee. The record shows members asked for additional information on fiscal implications and on which networks would remain exempt (for example, judicial networks not controlled by DUIT).