ARTICLE 6.4. Cybersecurity [8592.30. - 8592.50.]

Cal. Government Code - GOV 6.4.

in effect

Cal. Government Code - GOV § 8592.30. Section 8592.30.

As used in this article, the following definitions shall apply: (a) “Critical infrastructure controls” means networks and systems controlling assets so vital to the state that the incapacity or destruction of those networks, systems, or assets would have a debilitating impact on public health, safety, economic security, or any combination thereof. (b) “Critical infrastructure information” means information not customarily in the public domain pertaining to any of the following: (1) Actual, potential, or threatened interference with, or an attack on, compromise of, or incapacitation of critical infrastructure controls by either physical or computer-based attack or other similar conduct, including, but not limited to, the misuse of, or unauthorized access to, all types of communications and data transmission systems, that violates federal, state, or local law or harms public health, safety, or economic security, or any combination thereof. (2) The ability of critical infrastructure controls to resist any interference, compromise, or incapacitation, including, but not limited to, any planned or past assessment or estimate of the vulnerability of critical infrastructure. (3) Any planned or past operational problem or solution regarding critical infrastructure controls, including, but not limited to, repair, recovery, reconstruction, insurance, or continuity, to the extent it is related to interference, compromise, or incapacitation of critical infrastructure controls. (c) “Department” means the Department of Technology. (d) “Office” means the Office of Emergency Services. (e) “Secretary” means the secretary of each state agency as set forth in subdivision (a) of Section 12800. (f) “State agency” or “state agencies” means the same as “state agency” as set forth in Section 11000.

Cal. Government Code - GOV § 8592.35. Section 8592.35.

(a) (1) On or before July 1, 2018, the department shall, in consultation with the office and compliance with Section 11549.3, update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency to secure its critical infrastructure controls and critical infrastructure information. (2) In updating the standards in paragraph (1), the department shall consider, but not be limited to considering, all of the following: (A) Costs to implement the standards. (B) Security of critical infrastructure information. (C) Centralized management of risk. (D) Industry best practices. (E) Continuity of operations. (F) Protection of personal information. (b) Each state agency shall provide the department with a copy of its updated Technology Recovery Plan. (c) Each state agency shall, as part of its Technology Recovery Plan, provide the department with an inventory of all critical infrastructure controls, and their associated assets, in the possession of the agency.

Cal. Government Code - GOV § 8592.40. Section 8592.40.

(a) Each state agency shall report on its compliance with the standards updated pursuant to Section 8592.35 to the department in the manner and at the time directed by the department, but no later than July 1, 2019. (b) At the request of the department, any local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, may submit a Technology Recovery Plan, as specified by Section 8592.35, to the department. (c) The department, in conjunction with the office, may provide suggestions for a state agency or local entity that provided a Technology Recovery Plan pursuant to subdivision (b) to improve compliance with the standards developed pursuant to Section 8592.35, if any, to the head of the state agency and the secretary responsible for the state agency or the head of the local entity. For a state agency that is not under the responsibility of a secretary, the department shall provide any suggestions to the head of the state agency and the Governor.

Cal. Government Code - GOV § 8592.45. Section 8592.45.

The information required by subdivisions (b) and (c) of Section 8592.35, the report required by subdivision (a) of Section 8592.40, the plan authorized by subdivision (b) of Section 8592.40, and any public records relating to any communication made pursuant to, or in furtherance of the purposes of, subdivision (c) of Section 8592.40 are confidential and shall not be disclosed pursuant to any state law, including, but not limited to, the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1).

Cal. Government Code - GOV § 8592.50. Section 8592.50.

(a) (1) The office shall direct the California Cybersecurity Integration Center to prepare a strategic, multiyear outreach plan that focuses on ways to assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity and that includes, but is not limited to, all of the following: (A) A description of the need for greater cybersecurity outreach and assistance to the food and agriculture sector and the water and wastewater sector. (B) The goal of the outreach plan. (C) Methods for coordinating with other state and federal agencies, nonprofit organizations, and associations that provide cybersecurity services or resources for the food and agricultural sector and the water and wastewater sector. (D) An estimate of the funding needed to execute the outreach plan. (E) Potential funding sources for the funding needed by the California Cybersecurity Integration Center for the plan. (F) A plan to evaluate the success of the outreach plan that includes quantifiable measures of success. (2) The office shall submit the outreach plan prepared pursuant to this subdivision to the Legislature, pursuant to Section 9795, no later than January 1, 2024. The requirement for submitting a report imposed by this paragraph is inoperative on January 1, 2028, pursuant to Section 10231.5. (b) (1) The office shall direct the California Cybersecurity Integration Center to evaluate options for providing entities in the food and agriculture sector or the water and wastewater sector with grants or alternative forms of funding to improve cybersecurity preparedness. Upon completion of the evaluation, the office shall submit a report to the Legislature, pursuant to Section 9795, no later than January 1, 2024, that includes, but is not limited to, all of the following: (A) A summary of the evaluation performed by the California Cybersecurity Integration Center. (B) The specific grants and forms of funding for improved cybersecurity preparedness, including, but not limited to, the following: (i) Current overall funding level. (ii) Potential funding sources. (C) Potential voluntary actions that do not require funding and assist the food and agriculture sector and the water and wastewater sector in their efforts to improve cybersecurity preparedness. (2) The requirement for submitting a report imposed by this subdivision is inoperative on January 1, 2028, pursuant to Section 10231.5.

Source: CA Legislative Counsel Bulk DataURL: https://downloads.leginfo.legislature.ca.gov/pubinfo_2025.zipFetched: 6/27/2026