Student Aid Commission seeks operations funding and cybersecurity chief as agency faces rising costs and fraud risks

The subcommittee reviewed the California Student Aid Commission’s (CSAC) state operations requests, including a proposal for a chief information security officer (CISO) and an augmentation for rising operating expenses and equipment (OE&E).

Amin Singh of the Department of Finance explained the governor’s budget treats CSAC as a mission‑critical agency and proposed restoring most of a prior vacancy‑savings control reduction (leaving a net reduction equivalent to about 1.5 positions) while funding two CSAC requests: $230,000 ongoing for a CISO position and a revised OE&E package that originally totaled $1.9 million one‑time and $3.4 million ongoing (DOF said May revision will lower those amounts to $1.4M one‑time and $3.0M ongoing after an accounting correction).

LAO analyst Natalie Gonzales said CSAC’s staffing has grown from 14.5 permanent positions in 2014–15 to 53.5 today, but many positions remain vacant and CSAC reports it cannot meet workload needs. LAO recommended the Legislature approve the CISO request—because CSAC holds large volumes of sensitive personally identifiable information and has reported more attempted financial‑aid fraud—but asked CSAC to provide additional documentation before the Legislature acted on the larger OE&E and staffing request: specifically, (1) what workload CSAC cannot cover today, (2) programmatic impacts of unmet workload, and (3) cost estimates to resolve each workload shortfall.

CSAC Deputy Director Jake Bremner described operational pressures: the agency administers more than $3 billion in aid and serves over 520,000 students while maintaining critical software and contracts, supporting new program launches and responding to changes to federal and state application formats. Bremner said inflation and rising vendor costs have crowded out personal‑service funding and forced CSAC to delay IT refreshes and reduce IT consulting staff. He warned that more cuts to operations could increase call‑center wait times, delay program implementation and payment timelines, and reduce outreach and fraud monitoring capacity. Bremner added CSAC has seen greater attempted intrusion and fraud efforts and cited the CISO position as central to a state cybersecurity roadmap alignment and to safeguarding student data.

Members asked for follow‑up documentation; the committee established a quorum and took no final action on the CSAC package at the hearing, holding the issue open for staff follow‑up and LAO analysis before any appropriation decision in the May revision.

Ending: The subcommittee held CSAC’s operations request open and asked CSAC to provide the detailed workload and impact information LAO requested; the CISO request had LAO support and may move forward if CSAC supplies the requested documentation supporting the OE&E request.