CYBER SORT SECURITY IS CALLED TO
ORDER. WHEN I GO OVER A FEW
HOUSEKEEPING ITEMS- WELCOME TO
THIS INFORMATIONAL HEARING OF
THE ASSEMBLY SELECT COMMITTEE ON
CYBER SECURITY WHETHER YOU ARE
HERE IN PERSON WATCHING
VIRTUALLY OR ON THE PHONE LINES
I AM GRATEFUL THAT YOU HAVE
JOINED US HERE TODAY. THIS IS
OUR SECOND HEARING OF THE.
TWENTY TWENTY ONE TWENTY TWO
LEGISLATIVE SESSION. IT IS ALSO
A CONTINUATION OF A SERIES OF
HEARINGS WE'VE HELD OVER PRIOR
YEARS THAT HAVE WELCOMED. THE
STATE AUDITOR TO BETTER INFORM
OUR OVERSIGHT OVER CALIFORNIA
CYBER SECURITY. BEFORE WE BEGIN
TO HEAR FROM OUR THREE PANELS I
WILL GO OVER SOME KEY ELEMENTS
OF THE STRUCTURE OF TODAY'S
HEARING WE HAVE A STRICT MASK
GRANT MANDATE FOR THOSE WHO ARE
ATTENDING TODAY AS- IT IS AS
DOES THE ENTIRE CAPITAL. SOME OF
OUR PANELISTS WILL BE JOINING US
IN PERSON TODAY WHILE OTHERS
WILL JOIN US IN VIRTUALLY. THERE
WILL BE A FEW DIFFERENT OPTIONS
FOR THE PUBLIC TESTIMONY TODAY
AT THE END OF THE HEARING IF ANY
MEMBER OF THE PUBLIC IN THE ROOM
OULD LIKE TO PROVIDE PUBLIC
COMMENT PLEASE RAISE YOUR HAND
WHEN I CALL FOR PUBLIC COMMENTS
I WILL ASK YOU TO APPROACH THE
MICROPHONE AT THE APPROPRIATE
TIME. IN ADDITION TO BEING ABLE
TO TESTIFY FROM INSIDE THE
HEARING ROOM WILL ALSO BE USING
AT&T MODERATED TELEPHONE SERVICE
THROUGH WHICH ANY WITNESS MAY
PROVIDE PUBLIC COMMENT. THERE
MAY BE A SLIGHT DELAY SO AGAIN I
ASK ALL INVOLVED TO BE PATIENT
THE PUBLIC TOLL FREE NUMBER TO
CALL IN FOR THIS HEARING IS ONE
EIGHT EIGHT EIGHT. SIX SIX EIGHT
SIX NINE EIGHT FOUR. THE ACCESS
CODE IS. ONE THREE ONE FIVE ONE
TWO SIX. YOU CAN ALSO FIND THIS
NUMBER ON THE ASSEMBLY WEBSITE
ASSEMBLY DOT CA DOT GOV AS WELL
AS ON YOUR TV OR MONITOR SCREEN
. IF YOU'RE CALLING AND PLEASE
PLAN TO DO SO AS A BIG- AT WHEN
THE COMMITTEE MEMBER COMMENTS.
COME UP AT THE END OF OUR
DISCUSSION OF THE AUDITOR'S
RECOMMENDATIONS THAT'S ITEM FOR
ON THE AGENDA. THE OPERATOR ON
THE LINE WILL GIVE YOU
INSTRUCTIONS ABOUT HOW TO BE
PLACED IN THE QUEUE. PLEASE NOTE
THAT WE ARE ACCEPTING WRITTEN
PUBLIC COMMENTS- YOU CAN CONTACT
MY CAPITOL OFFICE AT.
916-319-2044 TO GET THE
APPROPRIATE EMAIL ADDRESS. THANK
YOU FOR YOUR PATIENCE AND
PARTICIPATION. NOW ON TO THE
TOPIC OF TODAY'S HEARING THE
RECENT STATE AUDITOR'S REPORT
ENTITLED STATE HIGH RISK UPDATE
INFORMATION SECURITY THE
CALIFORNIA DEPARTMENT OF
TECHNOLOGIES INADEQUATE
OVERSIGHT LIMITS THE STATE'S
ABILITY TO ENSURE INFORMATION
SECURITY. BEFORE I MAKE SOME
OPENING REMARKS I WOULD LIKE TO
INVITE ASSEMBLY MEMBER SALAS. TO
MAKE SOME OPENING REMARKS AS
CHAIR OF THE JOINT LEGISLATIVE
AUDIT COMMITTEE. ASSEMBLY MEMBER
SALAS. THANK YOU OUT OF HERE
PROCEEDS YOU- INVITING B. AS FOR
THE JOINT LEGISLATIVE AUDIT
COMMITTEE WE KNOW THAT WE'VE
DONE A COUPLE OF HIGH RISK
ADULTS OF A OUR CYBER SECURITY
NOT ONLY BACK IN TWENTY NINETEEN
BUT EVEN RECENTLY AS OF THIS
YEAR'S REPORT THAT CAME OUT- YOU
KNOW I THINK THAT OBVIOUSLY
COMPUTERS AND CYBER SECURITY IS
AT THE FOREFRONT OF WHAT WE DO
EVERY SINGLE DAY. I'M REALLY
INTERESTED IN SEEING WHAT
PROGRESS HAS BEEN MADE SINCE- I
ATTENDED THE TWENTY NINETEEN
HEARING- WITH THE STATE AUDITOR
OF THE HIGHER RISK- PROGRAM BUT
ALSO- TO JUST UNDERSTAND WHAT
ARE WE DOING ABOUT CYBER
SECURITY HOW ARE WE HARDENING
OUR SYSTEMS OUT OF SERVICE FOR
THE SAY SPECIALLY THOSE WITH
INTO THIS AGE WHERE THE STATE IS
LOOKING TO INVEST IN OUR
INFRASTRUCTURE. AS WE BECOME
MORE RELIANT ON THE ELECTRIC
GRID- WHAT WE DO IS ACTUALLY
HIGHER THAN THAT AND PREVENTING
OURSELVES FROM CYBER ATTACKS
SOME OF THE THINGS THAT WE'VE
SEEN ACROSS THE WORLD-
CONTINUING WITH TO INCREASE I
KNOW FOR ME SPECIFICALLY HERE
INSTEAD OF CALIFORNIA I KNOW I
HAD LOCAL SCHOOL DISTRICTS WHO
HAVE. BEEN HELD TO RANSOM WHERE-
BECAUSE OF SOME THE CYBER
ATTACKS AND YOU KNOW HOW TO
FIGURE OUT WHAT. THE CALIFORNIA
. DEPARTMENT OF SEXUAL IS DOING
TO PROVIDE BEST. FOR NOT ONLY
OUR SCHOOLS. BUT JUST ALL OF OUR
STATE AGENTS. ALL OF OUR TO. ARE
WHAT'S THE PLAN. HOWEVER WE-
HARDING THAT SISTER AND THEN
WHAT ARE WE GONNA DO TO
HOPEFULLY PREVENT THESE ATTACKS
IN THE FUTURE AND SO I
APPRECIATE THE OPPORTUNITY TO BE
HERE THIS MORNING. AND
APPRECIATE YOUR LEADERSHIP AND
I'M SURE THANK YOU. THANK YOU.
VERY MUCH CHAIR SALAS AS WE
BEGIN TODAY'S HEARING. I WANT TO
MAKE A FEW OPENING REMARKS
MYSELF THE CYBER SECURITY OF ANY
ORGANIZATION IS TO IS A
DIFFICULT AND EVER DEVELOPING
RESPONSIBILITY. DEFENDING THE
STATE OF CALIFORNIA'S NETWORK
AND COMPUTER INFRASTRUCTURE IS
NO SMALL FEAT. WITH THE
FEDERATED IN STRUCTURE OF
HUNDREDS AND- HUNDREDS OF
RESPONSIBLE STATE ENTITIES AND
HUNDREDS OF THOUSANDS OF
ENDPOINTS TO PROTECT. ADDRESSING
THREATS IS NOT ALWAYS A SIMPLE
TASK. AND NEW THREATS EMERGE AND
ARE IDENTIFIED BY SECURITY
PROFESSIONALS EVERY DAY. BUT
CYBER SECURITY IS NOT A LUXURY
IT IS A NECESSITY. THAT IS WHY
THE STATE AUDITOR HAS BEEN
REPORTING ON THE STATE'S ASSESS
DEFICIENCIES SINCE TWENTY
THIRTEEN. AS A HIGH RISK ISSUE
AND THIS COMMITTEE HAS BEEN
HOLDING HEARINGS TO UNDERSTAND
HOW TO ADDRESS THEM. DUE TO THE
LEGISLATIVE DEADLINES I'VE
ALREADY INTRODUCED AB TWENTY ONE
THIRTY FIVE AND AB TWENTY ONE
NINETY. WHICH ARE VEHICLES FOR
THE AUDITORS LEGISLATIVE
RECOMMENDATIONS FROM THIS
REPORT. I WANT TO NOTE HOWEVER
THAT I'M VERY INTERESTED TO
LEARN MORE TODAY FROM BOTH THE
AUDITOR'S OFFICE CDT AND THE
PUBLIC TO UNDERSTAND HOW TO MOVE
FORWARD AND REFINE THESE
LEGISLATIVE PROPOSALS. AS I HAVE
EVEN. QUESTIONS ABOUT THE
SUFFICIENCY OF THE
RECOMMENDATIONS SO NOW I WOULD
LIKE TO- GO TO THE AUDITOR'S
REPORT. AND I WOULD LIKE TO
WELCOME AT THE STATE AUDITOR
FROM THE STATE AUDITOR'S OFFICE
ACTING STATE AUDITOR MIKE TILTON
AN AUDIT PRINCIPAL BEN WARD. TO
COME UP THANK YOU GENTLEMEN. AND
WE WILL LISTEN TO YOUR PREPARED
REMARKS AND THEN OPEN THE- THE
PANEL TO QUESTIONS FROM MEMBERS.
ALL RIGHT A GOOD MORNING MADAM
CHAIR MISTER SALAS- AS WELL AS
OTHER MEMBERS OF THE COMMITTEE-
JUST FOR THE RECORD I'M MIKE
TILDEN AND THE ACTING CALIFORNIA
STATE AUDITOR. AND JOINING ME IS
MISTER BEN WAR HE IS THE AUTHOR
PRINCIPLE IN OUR DATA ANALYTICS
UNIT. SO I JUST WANT TO PROVIDE
A LITTLE BIT OF BACKGROUND
INFORMATION- WE HAVE BEEN TAKING
A LOOK AT THE STATUS OF THE
INFORMATION SECURITY OF STATE
ENTITIES AS YOU SAID SINCE TWO
THOUSAND THIRTEEN. AND SINCE
THEN WE'VE ISSUED FIVE DIFFERENT
REPORTS WHERE WE'VE REPORTED ON
CONTINUING DEFICIENCIES WITH THE
STATE'S INFORMATION SECURITY IN
OUR MOST RECENT REPORT THAT WE
ISSUED LAST MONTH. WE FOCUS ON
CD TEASE OVERSIGHTS OF THE
INFORMATION SECURITY- ENTITIES
THAT REPORT TO THE EXECUTIVE
BRANCH OR THE GOVERNOR THESE ARE
THE REPORTING- DEPARTMENTS. AND
WE ALSO TOOK A LOOK AT THE OTHER
DEPARTMENTS THAT ARE NOT THAT
ARE NOT- REQUIRED TO COMPLY WITH
C. T. T.'S POLICIES AND
GUIDANCE. AND REALLY ASSESS
THERE THE- REALLY THE CONDITION
OF THEIR SECURITY SYSTEMS AND
WHETHER OR NOT THEY'RE COMPLYING
WITH THEIR OWN- STANDARDS AND
FRAMEWORKS. SO WHAT I WANTED TO
DO FIRST IS WALK THROUGH. THE
FINDINGS AND THE RECOMMENDATIONS
RELATED TO THE REPORTING
ENTITIES AND KIND OF TALK YOU
THROUGH WHAT WE FOUND. SOME OF
OUR RECOMMENDATIONS THERE AND
THEN I'M GONNA WALK THROUGH THE
RESULTS OF OUR WORK RELATED TO
THE NON REPORTING ENTITIES AND
TALK ABOUT THOSE RECOMMENDATIONS
- SO THE FIRST THING THAT WE
FOUND IN OUR AUDIT IS THAT CDT
STILL DOESN'T HAVE. A COMPLETE
UNDERSTANDING OF THE STATUS OF
THE STATE'S INFORMATION SECURITY
SO THAT'S- THAT'S BEEN A LONG
STANDING PROBLEM. IN ONE OF THE
THINGS I WANT TO TALK ABOUT. IF
YOU LOOK AT PAGE TWO OF THE
HEARING DOCUMENT THAT I BELIEVE
THE SERGEANT PASSED OUT. IT
BASICALLY SHOWS THE FOUR YEAR
OVERSIGHT. CYCLE THAT CD T. USES
THIS IS THEIR- PRIMARY MECHANISM
FOR OVERSEEING THE REPORTING
ENTITIES. AND THE CONDITION OF
THEIR INFORMATION SECURITY. AND
THERE ARE TWO KEY COMPONENTS
THERE ONE CDT USES THE
EVALUATIONS OF THEIR OWN
COMPLIANCE AUDITS THAT THEY
CONDUCT. AS WELL AS THE RESULTS
OF TECHNICAL SECURITY
ASSESSMENTS THAT ARE GENERALLY
PERFORMED BY THE CALIFORNIA
MILITARY DEPARTMENT. THE USE
THAT INFORMATION TO CONDUCT THIS
SCORE IT'S KNOWN AS A MATURITY
METRIC AND WHAT IT DOES IS IT
PROVIDES A NUMBER THAT REALLY.
DESCRIBES AND SUMMARIZES EACH
ENTITY IS THE STATUS OF THEIR
INFORMATION SECURITY
DEVELOPMENT. SO IT'S A VERY
IMPORTANT CALCULATION. BUT WE
FOUND. YOU KNOW WERE INTO REALLY
THE FOURTH YEAR OF THE OVERSIGHT
CYCLE AND SO AT THIS POINT CD T.
SHOULD HAVE COMPLETED AUDITS.
AND CALCULATED MATURITY METRICS
FOR THIRTY NINE ENTITIES BUT
THEY REALLY ONLY COMPLETED
THIRTEEN AUDITS. AND THEY'VE
ONLY CALCULATE EIGHTEEN OF THESE
IMPORTANT MATURITY METRICS. AND
SO WHAT'S HAPPENING THERE IS
NGUYEN CDT ESTABLISH THIS FOUR
YEAR OVERSIGHT LIFECYCLE THE
PLAN WAS THAT THEY HAD THE BAND
WITH OR THE RESOURCES TO REVIEW.
THIRTEEN ENTITIES A YEAR AND
THAT'S HOW THEY CAME UP WITH THE
IDEA THAT. THEY COULD LOOK AT
THE FIFTY TWO HIGHEST RISK
REPORTING ENTITIES OVER THE
FIRST FOUR YEARS. BUT WHAT'S
HAPPENED OVER THE FIRST THREE
YEARS OF THE LIFE CYCLES ARE
ONLY AVERAGING TEN COMPLIANCE
AUDITS A YEAR SO THEY'VE GOTTEN
BEHIND- SO OUR RECOMMENDATION
THERE IS PRETTY STRAIGHTFORWARD
IN THAT IS THAT. CD T. REALLY
NEEDS TO INCREASE THEIR CAPACITY
TO COMPLETE THESE COMPLIANCE
AUDITS OF THE HIGHER RISK
ENTITIES IN A MORE TIMELY
MANNER. AND SO IN OUR
CONVERSATIONS WITH CDT WHAT
THAT'S PROBABLY GONNA REQUIRE IS
THEY'RE GONNA NEED TO HIRE MORE
STAFF OR THE NEED TO- SECURE
SOME ADDITIONAL CONTRACTED AUDIT
SUPPORT. I DID WANT TO POINT OUT
THAT THE FOUR YEAR- OVERSIGHT
LIFECYCLE THOSE TWO COMPONENTS
THE COMPLIANCE SITES IN THE
TECHNICAL SECURITY ASSESSMENTS.
THE TECHNICAL SECURITY
ASSESSMENTS THOSE ARE REQUIRED
BY STATE LAW. TO HAPPEN THIRTY
FIVE DEPARTMENTS EVERY YEAR HAVE
TO HAVE ONE OF THESE TECHNICAL.
SECURITY ASSESSMENTS AND AS I
SAID THE CALIFORNIA MILITARY
DEPARTMENT IS GENERALLY
PERFORMING THOSE EVALUATIONS AND
THOSE ARE HAPPENING AND
HAPPENING AS REQUIRED SO THAT'S
NOT PART OF THE DELAY THE DELAY
IS REALLY ABOUT CITIES
COMPLIANCE AUDITS. SECOND THING
I WANT TO TALK ABOUT IS THAT.
FOR THOSE ENTITIES THAT ARE ARE
UNDER CD TEASE PURVIEW AS WE
SHOW ON PAGE THREE. THOSE
ENTITIES RELIEVE THEIR
PERFORMANCE HAS REALLY NOT
IMPROVED AND THEY'RE CONTINUING
TO FALL BELOW BOTH FEDERAL
STANDARDS AND STATE STANDARDS.
SO LET ME TALK ABOUT THE FEDERAL
STANDARDS FIRST. EVERY YEAR
REPORTING ENTITIES ARE REQUIRED
TO. CONDUCT THIS FEDERAL SELF
ASSESSMENTS OF THEIR INFORMATION
SECURITY. IT'S CALLED THE NATION
WIDE REVIEW AND THE PRIMARY
REASON. THAT THE STATE I THINK
REQUIRES THESE ENTITIES TO
CONDUCT THE SELF ASSESSMENT. IS
THAT IT'S OF IT'S A MECHANISM
FOR THE STATE TO GET FEDERAL
GRANTS FOR INFORMATION SECURITY
. BUT WHEN WE LOOK AT THE
RESULTS OF THE SELF ASSESSMENTS
WE FOUND OVER THE LAST THREE
YEARS. STATE DEPARTMENTS ARE
REALLY FALLING BELOW THOSE
FEDERAL MINIMUM STANDARDS IN
AGAIN. THAT'S BEEN CONSISTENT
OVER THE LAST THREE YEARS
THEY'RE NOT HITTING THOSE
FEDERAL BENCHMARKS. THE OTHER
THING THAT WE LOOKED OUT AND WE
DEPICT ON PAGE THREE IS THESE
MATURITY METRICS THAT I TALKED
ABOUT EVEN THOUGH CDT HAS ONLY
CONDUCTED- SEVENTEEN OF THOSE
FOR REPORTING ENTITIES FOR
ELEVEN OF THOSE THEY'VE
SUBSEQUENTLY CONDUCTED FOLLOW UP
REVIEWS OR THEY'VE HAD
SUBSEQUENT TECHNICAL SECURITY
ASSESSMENTS. SO WHEN THAT
HAPPENS THE RECALCULATE THE
MATURITY METRICS SO WE LOOKED AT
THAT. BECAUSE IT WE HOPE TO SEE
IS THAT OVER TIME THE MATURITY
METRIC SCORES WOULD BE IMPROVING
BUT UNFORTUNATELY WE DIDN'T SEE
THAT. WHEN YOU LOOK AT THE
GRAPHIC OF THOSE ELEVEN ENTITIES
THAT HAVE HAD. MORE THAN ONE-
CALCULATION THE MATURITY METRIC
SCORE ONLY THREE SHOWED ANY
IMPROVEMENT. AND FOR SIX OF THE
ELEVEN THEIR SCORES ACTUALLY
DECLINED WHICH IS. WHICH IS
OBVIOUSLY DISAPPOINTING. THE
OTHER THING I WANT TO TALK ABOUT
IS. THESE TECHNICAL SECURITY
ASSESSMENTS WE LOOK AT A HUNDRED
THIRTY FIVE OF THOSE BECAUSE WE
WANTED TO KIND OF ISOLATE THAT
AND FIGURE OUT. ARE THE
DEPARTMENTS ARE THE IMPROVING
FROM THE STANDPOINT OF THESE
MORE TECHNICAL SECURITY
ASSESSMENTS. SO WE LOOK AT THESE
FOR THE PERIOD OF JANUARY. TWO
THOUSAND EIGHTEEN TO MARCH
TWENTY TWENTY TWENTY TWENTY ONE
. AND WE FOUND THAT ON AVERAGE
THE STATE ENTITIES ARE SCORING.
FIFTY FOUR OUT OF A HUNDRED
POSSIBLE POINTS. AND THE
CALIFORNIA MILITARY DEPARTMENT.
THEY BASICALLY ARE INDICATING
THAT A SCORE OF NINETY OR HIGHER
IS THE DESIRED RANGE SO
OBVIOUSLY. THESE REPORTING
ENTITIES ARE WAY BELOW THAT
THRESHOLD AND AGAIN OVER THIS.
THREE YEAR PERIOD THAT WE LOOKED
AT THEIR PERFORMANCE REALLY
REMAINED FLAT. SO THE OTHER
THING I WANTED TO POINT OUT IS
THAT THE INFORMATION THAT CD T.
DOES HAVE ON THE PERFORMANCE OF
REPORTING ENTITIES THEY'RE
REALLY NOT DOING A GOOD JOB OF
PROVIDING THAT INFORMATION TO
THE LEGISLATURE. THEY'RE NOT
PROVIDING INFORMATION ON THE ON
THE MATURITY METRIC SCORES OR
HOW THOSE ARE CHANGING AND
THEY'RE ALSO NOT PROVIDING ANY
INFORMATION ON. THE STATE
DEPARTMENT'SPERFORMANCE ON
THESE FEDERAL SELF ASSESSMENTS.
YOUR RECOMMENDATION AND THAT
AREAS OF THE LEGISLATURE SHOULD
REQUIRE CDT TO CONFIDENTIALLY
SUBMIT AN ANNUAL STATEWIDE
INFORMATION SECURITY STATUS
REPORT. IN THAT STATUS REPORT
SHOULD INCLUDE THESE MATURITY
METRIC SCORES AND THE RESULTS OF
THE SELF REPORTED EVALUATIONS-
IN THAT INFORMATION WE THINK
NEEDS TO BE GOING TO THE
APPROPRIATE- LEGISLATIVE
LEADERSHIP. SO IN THE AREA OF
THE NON REPORTING ENTITIES. I
THINK SIMILAR TO WHAT WE
REPORTED BACK IN TWO THOUSAND
NINETEEN WE'RE STILL FINDING
THAT THESE NON REPORTING
ENTITIES ARE NOT COMPLIANT WITH
THEIR OWN SHOWS AN INFORMATION
SECURITY STANDARDS.
UNFORTUNATELY WHEN WE WHEN WE
SURVEY THIRTY TO THESE NON
REPORTING ENTITIES WE FOUND THAT
ONLY FOR THESE ENTITIES HAD
ACHIEVED FULL COMPLIANCE WITH
THEIR CHOSEN INFORMATION
SECURITY STANDARDS WHICH IS
WHICH IS NOT GOOD. AND WE ALSO
FOUND THAT THREE OF THESE NON
REPORTING ENTITIES HAD NOT EVEN
ADOPTED ANY INFORMATION SECURITY
FRAMEWORK OR STANDARDS AT ALL.
AND SO I THINK CONSISTENT WITH
WHAT WE SET BACK IN TWO THOUSAND
NINETEEN. WE FOUND THAT THE NON
REPORTING ENTITIES THERE
CURRENTLY IS NO COMPREHENSIVE
EXTERNAL OVERSIGHT MECHANISM
OTHER INFORMATION SECURITY
STATUS. AND WE FOUND THAT WHEN
THERE IS THIS EXTERNAL OVERSIGHT
IT IMPROVES INFORMATION SECURITY
PERFORMANCE. SO GIVEN THAT
BACKDROP AND JUST THE FACT THAT
THE NON REPORTING ENTITIES HAVE
REALLY FOR THEIR PERFORMANCE HAS
REMAINED STAGNANT THEY REALLY
HAVEN'T MADE ANY PROGRESS IN THE
LAST TWO YEARS. IN TERMS OF
IMPROVING THEIR INFORMATION
SECURITY SO GIVEN THAT WE LOOKED
AT A COUPLE OF- OF DIFFERENT
OPTIONS FOR. IMPROVING THAT AND
ONE OF THOSE WAS WE CONSIDERED
HAVING MAKING A RECOMMENDATION
THAT MAYBE CD T. SHOULD START
MONITORING THE PERFORMANCE OF
THE NON REPORTING ENTITIES- BUT
THE DISADVANTAGE OF THAT IS AS I
JUST DESCRIBED. THE CD TEES
OVERSIZED REPORTING ENTITIES
THEMSELVES HAS SO FAR BEEN
INADEQUATE AND I'M NOT SURE THEY
HAVE THE RESOURCES TO TAKE ON
THIS ADDITIONAL RESPONSIBILITY-
IN ADDITION AS I SAID BEFORE C.
T. DOESN'T REALLY HAVE THE
AUTHORITY TO REQUIRE. NON
REPORTING ENTITIES TO COMPLY
WITH THEIR WITH THEIR STANDARDS
. AND FINALLY IT'S MY
UNDERSTANDING THAT IN THE PAST
THE NON REPORTING ENTITIES HAVE
EXPRESSED CONCERNS ABOUT
REPORTING TO CD T. THAT SOMEHOW
IT WOULD IMPEDE ON THEIR
INDEPENDENCE. SO GIVEN ALL THAT.
WHAT WE THINKS MAKE SENSE FOR
THE LEGISLATURE REQUIRE NON
REPORTING ENTITIES EVERY NOT
REPORTING ENTITY. TO FORMALLY
ADOPT INFORMATION SECURITY
STANDARDS AND A FRAMEWORK
BECAUSE WE'RE STILL SEEING SOME
ENTITIES LIKE SAID THAT HAVE NOT
YET DONE THAT. AND THAT ALSO
EVERY NON REPORTING ENTITY
SHOULD ANNUALLY PROVIDE AN
UPDATE ON ITS COMPLIANCE WITH
ITS ADOPTED STANDARDS- TO
LEGISLATIVE LEADERSHIP IN
ADDITION TO THAT I THINK TO
FURTHER STRENGTHEN- THE
OVERSIGHT OF THE NON REPORTING
ENTITIES. IS WE THINK THE
LEGISLATURE REQUIRE THEM TO HAVE
AN AUDIT OF THEIR INFORMATION
SECURITY AT LEAST EVERY THREE
YEARS. AND WE FEEL THAT THE
LEGISLATURE MOVES FOR WITH
RECOMMENDATION. THEN REALLY IT
WOULD HAVE A SORT OF A STATE
WIDE VIEW OF HOW ALL THE STATE%
ENTITIES ARE DOING IN TERMS OF
THEIR INFORMATION SECURITY
BECAUSE THAT WOULD GIVE THE
LEGISLATURE INFORMATION ON. HOW
THE NON REPORTING ENTITIES ARE
DOING ANY FOR OTHER RICK
RECOMMENDATION IS IMPLEMENTED
FOR THE REPORTING ENTITIES YOU
HAVE THAT FULL BASICALLY THAT
FULL. SCOPE OF INFORMATION ON
HOW ALL THE STATE'S ENTITIES ARE
DOING IN TERMS OF PROTECTING
THEIR DATA. SO WITH THAT I'M
HAPPY TO ANSWER ANY QUESTIONS
THAT YOU MIGHT HAVE OR DRILL
DOWN INTO ANY AREA IN MORE
DETAIL THANK YOU- THANK YOU MR
TELL THEM OR ARE YOU SPEAKING
THIS REPORT- YEAH I I'M HERE TO
HELP YOU OKAY- ALL RIGHT AND I
JUST WANNA SAY I I'D HAVE TO SAY
THIS WITH THE NON REPORTING
ENTITIES ITS NOT LIKE WE HAVEN'T
BEEN TRYING FOR THE LAST FIVE
YEARS. SO WE WILL CONTINUE AND
PERHAPS THIS TIME THE LIGHT WILL
GO ON AYE I WOULD ALSO LIKE TO.
WELCOME ASSEMBLY MEMBER- VOEPEL
AND SO I HAVE BECAUSE WE'RE
GOING TO HAVE YOU- ANSWER
QUESTIONS AT THE END BUT I DO
HAVE ONE OF ONE QUESTION- FOR
RIGHT NOW. SO OF REGARDING
CALIFORNIA'S GENERAL
CYBERSECURITY POSTURE YOUR OUR
AUDIT FOCUSED ON ASSESSING
AGAINST OUR OWN- POLICY AND
STANDARDS CAN YOU COMMENT ON HOW
CALIFORNIA COMPARES TO OTHER
STATES- I MEAN PUTTING PUTTING
ANOTHER WHERE WE FALLING BEHIND
BECAUSE CALIFORNIA- POLICY- IS
TO MEET HIGH STANDARDS WHILE OUR
PEERS. DO NOT MEET THOSE HIGH
STANDARDS OR DO WE FALL BEHIND
OUR PEERS WHO HAVE ALSO ADOPTED
THESE HIGH STANDARDS I DON'T
KNOW IF YOU'VE LOOKED AT THAT
BUT- AT LEAST START WITH THAT
ONE SURE I THINK I CAN GET
STARTED WITHOUT SHORTER ONE MY
UNDERSTANDING AND MISTER WORKING
OUT TO THIS. IS THAT I MEAN THE
STATE STANDARDS THAT ARE IN THE
SAN MANUEL THEY CLOSELY MIRROR
THERE AT THE RELEVANT THIS
STANDARDS AS WELL AS
INTERNATIONAL STANDARDS SO WHEN
WE LOOK AT THE DIFFERENT
STANDARDS THAT ARE OUT THERE. AT
THE STATE LEVEL AT THE NATIONAL
LEVEL AND EVEN AT THE
INTERNATIONAL LEVEL. THERE ARE
BROADLY COMPARE A BULL SO WE
DIDN'T REALLY HAVE ANY CONCERNS
WITH THE PARTICULAR STANDARDS
THAT CDT IS REQUIRING THE
REPORTING. ENTITIES TO COMPLY
WITH. DID YOU HAVE ANY DOUBT THE
STORE. YES- SO WHEN WE AT THE
NEW WIDE REVIEW. WE IS THE
FEDERAL SELF ASSESSMENT THAT- IS
PART OF RECEIVING GRANT FUNDING.
SO THE FEDERAL GOVERNMENT PUTS
OUT INFORMATION RELATED TO HOW
ENTITIES OR HOW GOVERNMENTS DO
ACROSS LIKE A BROAD RANGE. AND
WE FOUND THAT WE PERFORM FAIRLY
COMPARABLY WITH OTHER STATE-
GOVERNMENTS AREN'T ON THAT
REVIEW SO. I WOULD SAY THIS IS A
CHALLENGE FOR A LOT OF PEOPLE-
AND IT BUT WE'RE FOLLOWING VERY
SIMILAR STANDARDS A LOT OF THE
STANDARDS ARE CLOSELY MIRROR.
EACH OTHER AND- FOR PERFORMING
ABOUT THE SAME WHICH IS
UNFORTUNATELY BELOW THAT
FEDERALLY RECOMMENDED LEVEL.
THANK YOU. ASSEMBLY MEMBER SALAS
. THANK YOU APPRECIATED THAT YOU
KNOW JUST LOOKING AFTER GRAPHIC
HERE. AND THE OF THE FIFTY TWO
ENTITIES THE TO RATIFIED IN THE
HIGHER RISK- PROVIDE STANDING IS
THAT THERE'S A HUNDRED AND EIGHT
ENTITIES. RIGHT AND SO YOU HAVE
FIFTY TWO WE ACTUALLY HAVE DATA
ON AND THEN ON THE FIFTY TWO- C.
D. T. ONLY COMPLETED THIRTY ONE
OF THE THIRTY NINE OUT ITS
SHOULD HAVE FINISHED. AND THEN
IT ONLY DID MATURITY METRIC
SCORES FOR ONLY SEVENTEEN OF
THOSE. SO THEY'VE DONE LESS THAN
HALF THE WORK THAT THEY NEEDED
TO DO ONE HUNDRED AND EIGHT. AND
EVEN OF THOSE THEY'VE DONE EVEN
LESS WORK. IN TERMS OF THE AUDIT
NOW WHEN YOU WERE GOING THROUGH
ALL OF THIS AND POINTING ALL OF
THIS OUT JUST BY THE METRICS.
WHAT WAS THE REASON CDT GAVE FOR
NOT BEING ABLE TO. MEET THE
EXPECTATIONS. HI MISTER SALAS
ONE OF THE THINGS THAT CDT
MENTIONED IS THAT WHEN THEY
INITIALLY DEVELOPED THE FOUR
YEAR HIGH RISK CYCLE MINOR
SAYING IS THE INCLUDED SOME NON
REPORTING ENTITIES IN THAT SCOPE
AND APPARENTLY WHEN THEY PLAN
OUT THESE AUDITS THE PLAN THESE
THINGS I GUESS MONTHS IN ADVANCE
THE COME UP WITH AN AUDIT PLAN.
IN ONE OTHER EXPLANATIONS WAS
THAT WHEN IT CAME DOWN TO
CONDUCT THE AUDIT SOME OF THESE
NON REPORTING ENTITIES THAT WERE
LIKE A PART OF THEIR AUDIT PLAN
DECIDED NOT TO PARTICIPATE AND
SO CITIES EXPLANATION WAS THAT
BECAUSE THAT HAPPENED LATE IN
THE GAME THEY DIDN'T HAVE TIME
TO LINE UP OTHER- BASICALLY
OTHER DEPARTMENTS FOR AN AUDIT
SO THAT WAS ONE OF THE
EXPLANATIONS THAT THEY HAD. AND
THEN OTHERWISE OUR UNDERSTANDING
WAS THEY JUST REALLY WEREN'T
STAFFED UP TO DO THIRTEEN OF
THESE A YEAR WHICH WAS THEIR
ORIGINAL PLAN OVER THE FIRST
THREE YEARS OF THIS FOUR YEAR
LIFE CYCLE THEY'RE AVERAGING
ONLY TEN SO WE TALK TO THEM
ABOUT THAT AND ASK THEM IS IT A
QUESTION OF DO THEY NEED MORE
STAFF DO THEY NEED CONTRACTED
STAFF. AND- THEY THEY THEY KIND
OF RESPONDED THAT THE- I DON'T
KNOW THAT THEY REALLY HAD A
GREAT EXPLANATION FOR WHY THEY
WEREN'T ON PASTY EVERYTHING TO
ADD TO THAT MISTER WORD SO-
THERE IS THE NON REPORTING ISSUE
THAT. CAUSE SOME DELAYS ANOTHER
DELAY ESPECIALLY THE DISCREPANCY
BETWEEN THE THIRTY ONE AUDITS IN
THE EIGHTEEN MATURITY METRICS
SEVENTEEN OF WHICH WERE
REPORTING ENTITIES THAT WAS
LARGELY BECAUSE BECAUSE THERE
WAS A CHANGE IN THE AUDIT
REQUIREMENTS SO ALTHOUGH THE
MATURITY METRIC SCORING WAS
ESTABLISHED BEFORE THE FOUR YEAR
CYCLE STARTED. IT INCLUDED- NEW
CONTROLS BASED ON A REVISION OF
NESS THEY INCLUDED PRIVACY
CONTROLS- THOSE CONTROLS WEREN'T
INCLUDED IN THAT FIRST YEAR
AUDIT PROGRAM SO THEY FINISHED
THE NUMBER OF AUDITS- NINE
AUDITS THAT. THEY ACTUALLY CAN'T
CALCULATE THE MATURITY METRICS
ON EVEN THOUGH THE CRITERIA WAS
ESTABLISHED BEFORE THE AUDITS-
AND THAT'S CAUSED A DELAY. IN
AND WE RECOMMEND THAT THEY GO
BACK IN. AND SCORE THOSE ON THE
PRIVACY CONTROL SO THAT THEY'RE
ABLE TO CALCULATE THE MATURITY
METRICS RATHER PRODUCT NIGHT-
PRECIADO BUT YOU KNOW. WE HAVE A
AND EIGHT REPORTING ENTITIES AND
THEN WHEN I EVEN TALKING ABOUT
THE NON REPORTING ENTITIES AND I
DON'T WANT TO FUSE THE TWO. BUT
EVEN OF YOU KNOW YOU'RE TALKING
ABOUT THE NON REPORTING ENTITIES
EVEN OF THOSE. YOU KNOW. THEY'VE
ONLY YOU ONLY HAVE PARTIAL
INFORMATION FOR TWENTY FOUR OF
THEM. RIGHT AND THAT'S NOT EVEN
COUNTING ALL OF THEM SO I'M JUST
CURIOUS TO SEE WHAT THEY TOLD.
THE STATE AUDITOR'S OFFICE WHY
THEY WEREN'T COMPLIANT WHAT THE
ISSUE WAS YOU ASKED IF IT WAS
STAFFING- I DON'T THINK IT WAS A
DEFINITIVE ANSWER. AS TO WHY
THAT WAS- WOULD WE CALL THEM UP
I'D LOVE TO FOLLOW UP ON THAT
QUESTION. BUT BUT NO I
APPRECIATE THAT THE- YEAH I DID
WANT TO ASK- FOR THE NON. THE
NON COMPLIANT REPORTING. WHO'S
ULTIMATELY RESPONSIBLE IS CVT
RESPONSIBLE BECAUSE I KNOW IN
THE PAST I THINK AND PASSED
HEARING THEY SAID- THEY MAKE
RECOMMENDATIONS BUT WERE YOU
GUYS ABLE TO LOOK INTO- HOW DO
WE- BRIDGE THAT GAP. SO MY
UNDERSTANDING IS THAT CD T.
DOESN'T HAVE RESPONSIBILITY FOR
OVERSEEING THE NON REPORTING
ENTITIES. I MEAN THESE ARE
LARGELY- CONSTITUTIONAL OFFICERS
AND THE JUDICIAL BRANCH- SO
THEY'RE NOT REQUIRED TO FOLLOW
THE CDC'S REQUIREMENTS THEIR
POLICIES THEIR PROCEDURES. SO I
THINK THE WAY I MEAN IN OUR
DISCUSSIONS WITH C. T. THEY JUST
THEY REALLY DON'T HAVE
RESPONSIBILITY AT THE MOMENT
OVER THIS NOT REPORTING ENTITIES
. PRODUCT THANK YOU AND JUST ONE
FINAL QUESTION IF I MAY- YOU
MENTIONED EARLIER MR TELL THEM
ABOUT THE PRIVACY AND SECURITY
OF YOU KNOW CALIFORNIANS OF. IN
YOUR AUDIT WERE YOU ABLE TO
IDENTIFY HOW MANY TIMES- THERE
WAS POSSIBLE DATA BREACHES ARE
THERE WAS AN ACTUAL DATA BREACH.
AND HE DRIVES AND THAT'S PART OF
THE METRIC BUT HOW MANY TIMES IS
THAT CORRECTED YOU KNOW ARE WE
ARE IS A DEPARTMENT DOING IS CD
T. DOING EVERYTHING IN. YOUR
OPINION THAT THEY NEED TO DO TO
PROTECT CALIFORNIA'S PRIVACY. SO
WE HAVE SOME INFORMATION A
REPORT ABOUT SOME- EVENTS THAT
HAPPENED SOME CYBER SECURITY
EVENTS THAT HAPPENED I THINK IN
THE PRIVATE SECTOR AND THE
PUBLIC SECTOR- BUT MR WORKING
PROBABLY HAD MORE DETAIL HERE MY
UNDERSTANDING FROM WHAT WE DID.
IS WE WERE REALLY LOOKING AT.
THE POLICIES AND PROCEDURES AND
TO THE EXTENT TO WHICH THE
REPORTING IN THE NON REPORTING
ENTITIES HAD POLICIES AND
PROCEDURES. IN PLACE THAT WOULD
PROPEL PROTECT THEIR
INFORMATIONAL DATA. BUT I DON'T
BELIEVE THAT WE DID ANY DRILL
DOWN WORK OR DENSIFIED ANY
ACTUAL- CYBER SECURITY EVENTS IS
THAT CORRECT MR WORD YET SO WE
DIDN'T SPECIFICALLY LOOK AT THE-
THE RESPONSE TO CYBER SECURITY
EVENTS OR OR THE FREQUENCY OF
OCCURRENCE- WE PRIMARILY FOCUSED
ON. CD'S OVERSIGHT WHICH
INCLUDES THOSE POLICIES AND
PROCEDURES ARE EVALUATED THROUGH
THE- AUDIT PROGRAMS ALSO HIGHLY
TECHNICAL- MILITARY ASSESSMENTS.
THERE ARE HIGHLY TECHNICAL BUT
WE DIDN'T GO IN AND EVALUATE
THAT WE LOOKED AT WHAT WAS BEING
DONE TO EVALUATE. AND ENTITIES
AND ARE THEY ARE THEY IMPROVING
ARE THEY NOT AND WE FOUND THAT
THEY WERE NOT IT SO YOU'RE
LOOKING AT THE POLICY AND
GUIDELINES AS OPPOSED TO HOW
MANY RANSOMWARE ATTACKS. OR FOR
INSTANCE YOU KNOW LIKE I- SEMI
OPEN COMMENTS I HAD A SCHOOL
JUST THAT WAS A SUBJECT TO ONE
OF THOSE AND YOU KNOW WE READ
ABOUT IT IN THE NATIONAL NEWS AS
WELL WHETHER IT WAS A- COLONIAL
COLONIAL- PIPELINE RANSOMWARE
FOR INSTANCE. OR ANY OF THE
OTHERS- YOU KNOW OBVIOUSLY WE
CARE A LOT ABOUT DATA PROTECTING
PEOPLE'S PRIVACY. RIGHT EDT. AND
ALL OF THE FRAUD THAT'S
OCCURRING THERE SO. JAI THAT
THEY COULD NOT ENTER. ASSEMBLY
MEMBER VOEPEL. MADAM CHAIR
AMOUNT. WAS SCHEDULED IN TO BE
HERE- AS PART OF THE JOINT
LEGISLATIVE AUDIT COMMITTEES SO
I GUESS I'M IT FOR THEM JUST BY
DEFAULT. SO I HAVE GREAT RESPECT
. FOR THE CALIFORNIA STATE
AUDITORS YOU DID A EXCELLENT JOB
HERE QUANTIFYING THE DATA. NOW
HERE'S WHAT I'M GONNA KIND OF
GET OFF INTO THE DEEP END SO
PLEASE INDULGE ME. WITHIN FORTY
EIGHT HOURS I COULD PUT TOGETHER
. A HACKER GROUP THAT COULD GET
INTO ANY. CYBER SECURITY THAT
THE STATE OF CALIFORNIA HAS
TRUST ME IF THAT WOULD BE
CONSIDERED AN AUDIT THAT WOULD
BE GREAT SO THE POINT I'M MAKING
IS IT'S LIKE IN A MILITARY
MILITARY HAS WAR GAMES IN ORDER
TO TEST THEIR SYSTEMS THEN THEY
DO. A QUICK AND DIRTY BRIEFING
TO FIND OUT WHAT WENT WRONG WHAT
WENT RIGHT. WHAT I RECOMMEND. IS
WE FOLLOW UP MADAM CHAIR. WITH
THE LEGAL PACKING COMMITTEE TO
HACK KINDLE THE SYSTEMS. AND
THAT WAY YOU KNOW. WHERE THE
WEAKNESSES ARE IT BECOMES REAL
LIFE TO EACH ENTITY THAT YOU
VOTED VERY WELL SO. WHAT'S
INTERESTING IF. WE PUT TOGETHER
A PACKING COMMITTEE OF KIDS
THEY'RE ALL KIDS- I'M SERIOUS
WITHIN FORTY EIGHT HOURS IF YOU
GAVE THEM THE GO AHEAD TO DO IT
LEGALLY THEY WOULD BE IN EVERY.
ORGANIZATION AND- UNDER
SUPERVISION. MAYBE ADULT
SUPERVISION EVEN WHO KNOWS.
ANYWAY THAT'S MY COMMENTS THANK
YOU MADAM CHAIR. SO JUST- FOLLOW
UP ON THAT THAT IS SO YOU
MENTIONED OF THE PEN TESTING
THAT THE- SECURITY ASSESSMENTS
DONE MOSTLY BY THE- THE MILITARY
DEPARTMENT AND THAT THEY ARENOT
NECESSARILY THOSE TESTS ARE THE
RESULTS ARE NOT NECESSARILY
IMPROVING BUT IT COULD BE THE
RESULT OF. ADDITIONAL
VULNERABILITIES AND LACK OF
PATCHING RIGHT SO NOT
NECESSARILY ANY ISSUE WITH
WHETHER THE DEPARTMENT IS DOING
I MEAN IT COULD BE SOME OF IT
COULD BE WHETHER DEPARTMENT IS
DOING BETTER OR WORSE BUT SOME
OF THE CALLS OF THE- ARE
VULNERABILITIES THAT WERE
DISCOVERED BY. ME BASICALLY THAT
THEY ARE DOING HACKING RIGHT.
THE MILITARY DEPARTMENT IS.
BASICALLY DOING HAPPEN WHEN THEY
DO THE TESTING. DOES THAT MEAN
THE COULD THAT BE WHAT ARE THE
REASONS THAT THE THOSE- SECURITY
BECAUSE IT SOUNDS LIKE WE'RE-
KEEPING UP ON THOSE. ACCORDING
TO- THE LAW THAT WAS PASSED SO
WHAT ARE REASONS THAT THOSE
TESTS MIGHT GO DOWN YEAH I MEAN
THAT'S THE THING WHEN WE LOOKED
AT THE RESULTS OF THE
INDEPENDENT SECURITY ASSESSMENTS
THAT AS YOU SAY THE CALIFORNIA
DEPARTMENT MILITARY CONDUCTS. I
MEAN THERE ACCORDING TO THEIR
OWN GUIDELINES THE GOAL IS FOR
THESE DEPARTMENTS TO SCORE IN
THIS NINETY TO A HUNDRED RANGE.
AND SO THE FACT THAT THEY'RE
HITTING ABOUT FIFTY FOUR OUT OF
A HUNDRED OVER ALL THREE YEARS
FAIRLY CONSISTENTLY- IS
TROUBLING SO THEY'RE A LONG WAYS
FROM THE MARK AND I THINK. BASED
ON. OTHER STUFF THAT WE DID IN
THE AUDIT THAT WE TOOK A LOOK AT
IT SEEMS LIKE THE DISCONNECT IS
THAT MANY OF THESE DEPARTMENTS
THEY HAVE. INFORMATION SECURITY
POLICIES AND PROCEDURES THEY
HAVE LAID THAT FOUNDATIONAL
GROUNDWORK. BUT THEY HAVEN'T
GOTTEN TO A PLACE WHERE THEY'VE
ACTUALLY IMPLEMENTED THOSE
POLICIES PROCEDURES AND THOSE
PRACTICES. SO I THINK THAT'S
PART OF WHY THEY'RE NOT DOING
VERY WELL ON THE- THE- TECHNICAL
SECURITY ASSESSMENTS. IS THERE
ANYTHING ELSE YOU HAVE TO ADD TO
THAT MISTER WARD ABOUT THOSE
ASSESSMENTS. I THINK THAT'S AN
ACCURATE REPRESENTATION- THE
THREATS ARE CONSTANTLY CHANGING-
BUT THAT'S WHAT CAN BE THE VALUE
OF THOSE MATURITY METRICS OR
STANDARD SCORE RANGES SO.
YESTERDAY YOU HAVE TO RESPOND TO
NEW TYPES OF THREATS BUT- THERE
SCORING SUBSTANTIALLY BELOW
THAT. THAT DESIRED RANGE BOTH
IN. THE TECHNICAL ASSESSMENTS
AND- SELF ASSESSMENTS AND-
AUDITS THAT LOOK MORE AT THE
POLICIES AND PROCEDURES. OUR
RIGHTS- THANK YOU GENTLEMEN AND
YOU'LL STAY TILL THE END- SO WE
CAN ASK MORE QUESTIONS OUR
RIGHTS- WE ARE GOING TO. MOVE ON
TO A DEPARTMENT OF TECHNOLOGY.
AND I WOULD LIKE TO HAVE YOU
RESPOND TO SOME OF THE FINDINGS
OF THE AUDIT FROM THE AUDIT I'D
LIKE TO WELCOME. OF FROM CD T.
RUST AND- NICHOLS THE ACTING
DIRECTOR AND STATE CHIEF
INFORMATION OFFICER AND OF THE
TOLLY PANACHE. BUT I GOT IT
RIGHT THIS TIME THE POLICY.
PRIOR DAY. IT AT THE STATE THAT
EACH OF HER SECURITY OFFICER IT
WAS ALL. CLOSE I ALWAYS HAVE A
FIFTY FIFTY TWO. OF THANK YOU
FOR JOINING US GENTLEMEN. WE
WILL LISTEN TO YOUR UP PREPARED
REMARKS AND THEN OPENED THE
PANEL UP FOR QUESTIONS FROM
MEMBERS. THANK YOU MADAM CHAIR
WITHIN THANK YOU. SURE SAUSAGE
WELL AND TO THE ENTIRE
COMMUNITY- I AM REST NICHOLS ON
THE ACTING DIRECTOR OF THE
DEPARTMENT TECHNOLOGY. BOB
TELEPICTURES STATE ISO- IS ALSO
HERE WITH US AND WE'LL GO
THROUGH A MOVE BIT ABOUT. THE
OVERALL PROGRAM AND SOME OF THE
- RIGHT. FROM CS. I DO I THANK
REALLY THE CS WORKING THE ON
THIS VERY IMPORTANT- ASPECT OF
STATE IN MY THIRTY YEARS OF
EXPERIENCE I'VE SEEN STATE
GOVERNMENT IMPLEMENT MORE AND
MORE TECHNOLOGY TO THE POINT
THAT IT IS NOW IN IRAQ IN MOST
OF THE SERVICES WE PROVIDE
PEOPLE OF CALIFORNIA IT IS ONE
OF THE FUNDAMENTAL THINGS THAT
MAKES OUR STATE GOVERNMENT
ACTUALLY WORK AT ITS NECESSARY
TO ACHIEVE ARE OUT. WITH THAT
STARBURST ACUITY AS CHAIR OR ONE
OUT IS QUICKLY- MATURING DEVELOP
AND THE THREAT LANDSCAPE THAT'S
IN FRONT OF US IS VERY COMPLEX
AND VERY BROAD BECAUSE OF THAT
CYBERSECURITY PROGRAM THAT MR
AND IT'S RUNS POOREST IS BURIED
HAS MANY AND SCO AUTO FOCUSES ON
ONE COMPONENT OR ONE SLICE OF
THAT PIE WHICH IS THE SECURITY
AUDIT PROCESS THAT WE OUGHT. SO. NEVER SALAS- POINTED OUT THAT
WE HAVE REALLY OVERHEAD AD
FIFTY ENTITIES AND STAY. ABOUT A
HUNDRED NAVAL HUNDRED OUR GOALS
ARE UNDER THE AUTHORITY THE
GOVERNOR MOST OF THE THAT WE
HAVE. BOTH OF THE STORY AND
RESPONSE OF THE TO MAKE SURE
THAT THEY ARE APPROPRIATELY
APPLY SECURE PRACTICE WITHIN
THAT WE PER NARROWED DOWN GROUP
TO BE FIFTY TWO HI SICK I RISK
TYPE ENTITIES THAT WE REALLY ARE
EXERCER THE AUDIT ALL THE OTHER
HAND OF THAT GROUP THE MEMBERS
OF THE WHITE OH EIGHT THAT ARE
AT RISK R. AND I LOWER. OF A SET
THIS GET THE MORE ASSESSMENTS
THEY'RE NOT SUBJECT TO THE AUDIT
PRO BECAUSE THEY DON'T HAVE I-
SIX THAT ARE OUT AND AS AS YOU
CAN IN CYBER ONCE I FITS ALL IS
NOW APPROPRIATE THE ACTUAL THAT
WE FOR SYSTEMS THAT PERSONAL.
AND HELP. OR STATE OFFICE
LOCATIONS SO IT IS A TIERED
MECHANISM INTENTIONALLY AND SO
AS WE CONDUCT THESE AUDITS AND
ACTUALLY I THINK MISTER TOLD AN
ACCIDENT- SPOKE YOU SEPARATE
COMPLETED THIRTEEN THE NUMBER IS
ACTUALLY THIRTY ONE AT ONE ONE
OF THOSE AUDITS OF MISTER CELLS
ACTUALLY CORRECTED THAT AS WELL-
AS WE GO THROUGH THOSE AUDITS WE
HAVE STAFF TO OUR PROGRAM TO
CONDUCT- ESSENTIALLY A QUARTER
OF THOSE AUDITS OF HIGH RISK
ENTITIES EACH YEAR. ON A FOUR
YEAR CYCLE. IT IMPORTANT TO NOTE
THAT THAT THAT AUDIT REALLY IS
PROCESS AND PROCEDURE AUDITS AND
THE POLICY HUNDRED OF THOSE
ORGANIZATIONS IT IS NOT
MEASURING THE EFFECTIVENESS AND
THE IMPLEMENTATION. OF THE
EXECUTION OF THOSE POLICIES M.
S. AS MR BALL JOINTED OUT YEAH
WE DO HAVE THE MILITARY
ASSESSMENTS THAT ARE ACTUALLY
COMING IN AND INTENTIONALLY TRY.
TO OPT. BREAK THROUGH AND ENTER
THOSE SYSTEMS AND EXERCISE THAT
BUT THAT IS REALLY NOT THE FOCUS
OF THIS REPORT- SO THAT THE
PROGRAM IN SUMMARY IS VERY BROAD
WE'RE FOCUSING ON JUST. ONE
PIECE AS WE TALK THROUGH THIS.
D. OTHER THING THAT I WANT TO
OUT IS OUR THREAT LANDSCAPE IS
CONSTANTLY CHANGING AGAIN
BECAUSE WE USE SO MUCH
TECHNOLOGY BUT THE STATE OF THE
WORLD IS CONSTANTLY CHANGING
JUST SINCE THE BEGINNING OF THE
PANDEMIC. WE'VE SEEN THE NUMBER
OF ATTACKS AGAINST OUR SYSTEMS
QUADRANT. WE MEASURE THAT
THROUGH- MR PARRISH'S OFFICE IN
THROUGH THE- CALIFORNIA CYBER
SECURITY IMMIGRATION CENTER THAT
WE THAT WE OPERATE IN
COORDINATION WITH WE ASKED WITH
CHP. OUR MILITARY THAT IS A VERY
TACTICAL AND OPERATIONAL
COMPONENT OF CYBER SECURITY THAT
IS KIND OF THE FRONT LINE
UPDATED DATE. MONITORING AND
REACTION TO CYBER EVENTS IN THE
WORLD AND EVEN IN THE NEWS THIS
WEEK YOU SEE INCREASED. TENSIONS
AND CONCERNS. WE ADJUSTING FOR
QUICK. TO RESPOND TO THOSE
THINGS WHICH ARE NOT POLICY
ADJUSTMENTS CLOSER ALL
ADJUSTMENTS ARE TACTIC WHEN I WE
SECURITY FENCE THE MESSAGING WE
PUT OUT OUR- AND THE MANAGEMENT
OR INFORMATION SECURE. SO BLACK
NETWORK OF THAT WE DO. SO WITH
THAT THE TERM- THE THINGS OVER
TO MR AND H. AS HE CAN WALK
THROUGH LITTLE MORE ON OUR
STREETS PROGRAM AND THE SPECIFIC
RECOMMENDATIONS IN CS. SO THE
BALLOT. YES THANK YOU RUSS GOOD
MORNING MADAM CHAIR AND MEMBERS
OF THE COMMITTEE HOW THE TALIBAN
ITS STATE CHIEF INFORMATION
SECURITY OFFICER. AND THANK YOU
FOR THE OPPORTUNITY TO DISCUSS
THE MUCH NEEDED FOCUS ON CYBER
SECURITY. THE GOAL OF OUR
APPROACH IS REALLY RISK BASED TO
MAKE OURSELVES MORE DIFFICULT
TARGETED AT EVERY STEP OF THE
WAY AND EVERY STEP OF THE
ATTACK. ALL AT THE SAME TIME IS
STRIVING TOWARDS OUR COMPLIANCE
GOALS. FIRST BEFORE WE DIE THEN
I WANTED TO SUMMARIZE AND FIRST
GO INTO VANITY THREAT LANDSCAPE
AS IT'S APPALLING. AND THE
NUMBER TO ALSO HIGHLIGHT THE
WAYS THAT WE MEASURE POSTURE AS
WELL AS- WHAT WE HAVE DONE TO
DIRECTLY. BENEFIT AND HELP THE
ENTITIES BECOME A MORE DIFFICULT
TARGET AND DIRECTLY DEAL WITH
IMMINENT THREATS DEALING WITH
THE PANDEMIC. AND THE NUMBER
THREE DISCUSS OF CSA'S VALUABLE
INPUT PROVIDES ADDITIONAL
INSIGHT INTO OR OVERSIGHT
EFFORTS AS WE WORK MUTUALLY TO
PROGRESS AND PUSH THE BALL
FORWARD. FIRST TO REITERATE THE
SOPHISTICATION OF THE THREAT
LANDSCAPE. WE ARE TRACKING
NEARLY OVER NINETEEN HUNDRED
CRIMINAL AND NATION STATE THREAT
ACTORS ALONG WITH FIVE HUNDRED
PLUS NEW MALWARE SAMPLES OR NEW
MALWARE FAMILIES IN TWENTY
TWENTY ONE. NATIONALLY
RANSOMWARE SOARED BY A HUNDRED
AND FIFTY ONE PERCENT. FISHING
WAS UP BY TWENTY TWO PERCENT. OF
THAT CALIFORNIA HAS SEEN IN OVER
44% INCREASE IN RANSOMWARE. A
32% INCREASE IN CORPORATE DATA
THEFT AND A 13% INCREASE IN
PHISHING BASED ATTACKS. WE'VE
ALSO SEEN SIXTY SIX ZERO DAY
VULNERABILITIES. OR
VULNERABILITIES THAT THE THAT
WERE DISCLOSED WITHIN THE
COMMUNITY THAT DID NOT HAVE
FIXES. UPON THE TIME OF THIS
CLOSURE. THIS WAS UP BY TWENTY
FIVE OR FROM TWENTY FIVE LAST
YEAR. WE ALSO SAW EIGHTEEN
THOUSAND FOUR HUNDRED THIRTY
NINE SECURITY VULNERABILITIES
DISCLOSED GENERALLY MORE THAN
THAN ANY YEAR. DEBATE BUT WE'VE
ALSO WITNESSED AN INCREASED
RECONNAISSANCE AND DISCOVERY
ACTIVITY TARGETING OR WORDS THE
TECH THAT ARE BY BY OUR SECURITY
OPERATIONS EFFORTS. ASSISTING
NEARLY FORTY FOUR HUNDRED
MILLION DAILY SIGNALS WE'VE ALSO
SEEN AN AMPLITUDE IN THE NATION
STATE SPONSORED DENIAL OF
SERVICE ATTACKS TARGETED AT OUR
NETWORKS. IN ADDITION TO THAT
THE PANDEMIC OPENED NEW
OPPORTUNITIES FOR ADVERSARIES TO
TAKE ADVANTAGE OF THE SITUATION
INCLUDING REMOTE WORK
ENVIRONMENTS AS A RESULT THE
CDT. EMPLOYED IMMEDIATE MEASURES
TO ENABLE ALL DEPARTMENTS TO
DEAL WITH THE PANDEMIC SAFELY
AND SECURELY WHILE MAINTAINING
CLOSE FOCUS AND SECURITY
OVERSIGHT. MITIGATED THREAT
ACTORS ATTEMPTING TO EXPLOIT AND
DISRUPT. THE OPPORTUNITIES
AROUND EMERGENCY RESPONSE
EFFORTS. AND THEN AS OVER A
COURSE OF A MONTH DURING THE
PANDEMIC THE STATE HAS SHIFTED
ITS NEARLY ONE HUNDRED FIFTY
THOUSAND. REMOTE WORKFORCE TO
BEING TELEWORK ENABLED. WHILE
DOING SO WE PERFORMED AND SCALE
THEIR TEAMS TO CONDUCT POINTED
RAPID ASSESSMENTS OF ALL
DEPARTMENTAL REMOTE WORK
RESOURCES. SO THIS INCLUDED.
PENETRATION TESTING HOME
ENVIRONMENTS AND LOOKING FOR
IMMEDIATELY EXPLOITABLE
VULNERABILITIES THAT OUR TEAMS-COLLECTIVELY WORKED ON AND
HEALTH DEPARTMENTS REMEDIATE.
OUR TEAMS ALSO WERE PRIORITIZED
OFFICIALS CONSOLIDATED AND THEN
IT WOULD JUST X. REPORTING
VACCINE MANAGEMENT. AND ALL WITH
SECURITY AND PRIVACY PRESERVING
PRACTICES IN MIND. THIS DIRECTLY
RESULTED IN RELEASING DOZENS OF
CODE RELATED APPLICATIONS AND
DASHBOARDS TO SUPPORTER
DEPARTMENTS. IN ADDITION CDT
PLAYED A SIGNIFICANT ROLE IN
ESTABLISHING THE CALIFORNIA
CYBERSECURITY INNOVATION CENTER
OR AS WE CALL CAL SICK. THROUGH
THE CAL SIXTY T. PROVIDES A
DEDICATED THREAT INTELLIGENCE
RESPONSE TEAM TO ASSIST STATE
AND LOCAL ENTITIES IN DEALING
WITH IMMEDIATE IN IMMINENT
THREATS RESULTING FROM ATTACKS
SUCH A SOPHISTICATED RANSOMWARE
SUPPLY CHAIN ATTACKS AND
SOPHISTICATED IDENTITY THEFT. AS
PART OF THE CAL SIXTEEN CDT
SECURITY OPERATIONS TEAMS ARE
OFTEN DEPLOYED TO INVESTIGATE
AND RESPOND TO INCIDENTS AT
LOCAL LEVELS REGULARLY CAUSED BY
RANSOMWARE. AS A RESULT MULTIPLE
JURISDICTIONS IN SCHOOLS HAVE
BEEN SUCCESSFULLY RECOVERED FROM
SUCH INCIDENTS WITH THE
ASSISTANCE TO HARDEN THEIR
NETWORKS DID FOR THEM TO DO
BETTER GOING FORWARD. ON TOP OF
THAT THE SURFACE SO DATED
INCIDENT RESPONSE EFFORTS.
MITIGATING AND REMEDIATING
SUPPLY CHAIN VULNERABILITIES
CAUSED FROM SOLAR WINDS OF LOG
FOUR J. AND THEN WHILE DEALING
WITH THE THREAT TACTICALLY AT
THE STRATEGIC LEVEL. WE RELEASE
THE CALIFORNIA'S FIRST FIVE YEAR
CYBERSECURITY ROADMAP CAL SECURE
IN OCTOBER OF LAST YEAR
ROADMAP'S LOTS OF CLOUDS WHAT'S
A PATH FORWARD FOR STATE
ENTITIES AND LOCAL ENTITIES TO
ACHIEVE AN INCREASE
CYBERSECURITY MATURITY LEVEL.
LAST YEAR IN ADDITION CDT
SHIFTED ITS SECURITY OPERATIONS
AND AUDIT COST FUNDING MODEL TO
ALLOW STATE ENTITIES. TO REALLY
RETAIN A LOT OF THEIR INTERNAL
FINDINGS WERE INTERNAL INTERNAL
FUNDING TO REMEDIATION EFFORTS.
AS WE MADE SHIFTED DEAL WITH
SUCH IMMINENT SECURITY THREATS
AROUND THESE EMERGENCIES. WE
MAINTAINED OUR OVERSIGHT PROGRAM
ON OUR HIGH RISK AND NON HIGH
RISK ENTITIES AS SUCH I DID WANT
TO HIGHLIGHT SOME OF THE YEAR
OVER YEAR STATISTICAL
IMPROVEMENTS. WHICH WE- WE DO
COLLECT COMPLIANCE COMPLIANCE
METRICS THROUGH AUDITS HOWEVER
WE DO ALSO RELY ON OUTCOME BASED
MEASURES THROUGH THESE TECHNICAL
ASSESSMENTS. SO TECHNICAL
ASSESSMENTS YEAR OVER YEAR
INDICATED A DECREASE IN HIGH
RISK VULNERABILITIES BY NINETEEN
PERCENT. LOWER PHISHING
SUSCEPTIBILITY BY 9% INTERNAL
PENETRATION TESTING RESISTANCE
IMPROVING BY 18% SO MEETING
DEPARTMENTS ARE ARE ABLE TO
DEFEND THEMSELVES BY 18% BETTER
TOWARDS MINISTRATION TESTING
EXERCISES. OVERALL THESE
TACTICAL ASSESSMENT SCORES ARE
IMPROVING BY 5% AND AN ANNUAL
INCREASE AND WE TRACK THESE
METRICS AND BENCHMARKS. AS
OVERALL AVERAGES AS NOTED
EARLIER ON THE CURRENT AVERAGE
IS FIFTY FOUR PERCENT. PRIOR
PRIOR YEARS IT WAS FORTY EIGHT
AND WE CONTINUE TO EVOLVE. OUR
COMPLIANCE FRAMEWORK PROGRAMS TO
MAKE THE SCORE MORE DIFFICULT
AND HARDER TO ATTAIN AS THE
THREAT LANDSCAPE KEEPS. KEEPS
EVOLVING SO OVERALL WE'VE SEEN
69% OF ALL TESTED ENTITIES. BUT
THEIR SCORES IMPROVED BY SINGLE
DIGIT NUMBERS. AREAS THAT HAVE
HELPED AND REQUIRE MORE FOCUS.
ON ABILITY SCANNING AND
REMEDIATION PROCESSES AND
PRACTICES IMPLEMENTATION OF ZERO
TRUST ARCHITECTURES HAVE HELPED.
ALSO ADOPTION OF NEXT GENERATION
ENDPOINT PROTECTION TOOLS WHICH
WE'VE MIGRATED NEARLY EVERY
DEPARTMENT TO THE NEXT
GENERATION ENDPOINT PROTECTION
DEFENSE MECHANISM. IN ADDITION
DEPARTMENTS DIDN'T DO NEED MORE
HELP AND SYSTEM SECURITY
PLANNING DOCUMENT DOCUMENTATION
OF THEIR OVERALL SECURITY
PROCESSES AND PRACTICES AS
HIGHLIGHTED BY THE AUDITS.
ALTHOUGH THESE INCREMENTAL
IMPROVEMENTS ALTHOUGH THE
INCREMENTAL IMPROVEMENTS ARE
EVIDENCE OF THE ATTACK SURFACE
CONTINUES TO EXPAND WE MUST
CONTINUE TO IMPROVE
CYBERSECURITY OVERSIGHT TO BE
SUSTAINABLE INTO THE FUTURE.
NEXT I WOULD LIKE TO.
ACKNOWLEDGE THE FIVE SELECTED
RECOMMENDATIONS. AND SET CONTEXT
BUT THEY DO PROVIDE ADDITIONAL
VALUES ARE OR OVERSIGHT PROGRAM
. NUMBER ONE WAS TO INCREASE ITS
CAPACITY OR INCREASE OUR
CAPACITY TO PERFORM TIMELY
COMPLIANCE AUDITS. AS WAS
MENTIONED BEFORE CD KOMMT
IMPLEMENTS A FOR YOUR OVERSIGHT
LIFECYCLE. THAT IS THIS DESIGNED
TO ASSESS HIGH RISK DEPARTMENTS
. RUNNING THEIR MOST CRITICAL
IMPACTFUL SERVICES. THIS CYCLE
ENCOMPASSES COMPREHENSIVE POLICY
AND PROCESS AUDITS AS WELL AS
TECHNICAL WATER ABILITY
ASSESSMENTS CONDUCTED BY THE
MILITARY DEPARTMENT. AND THAT
THOSE ENGAGEMENTS ARE REALLY
TARGETED FOR HIGH END ON HIGH
RISK ENTITIES. WHERE'S AUDITS
ONLY TARGET THE HIGHEST RISK
ENTITIES. HI HIGH RISK ENTITIES
ARE DEFINED AND ASSIGNED BY
THEIR PRIORITY. BASED ON THEIR
ATTACK SURFACE BASED ON THEIR
PRIOR ASSESSMENT RESULTS THEIR
COMPLIANCE FILINGS- AND HOW MANY
CRITICAL SYSTEMS THEY OWN AND
OPERATE SO WE TAKE A REALLY
MEASURE OF RISK BASED APPROACH
AND FACILITATED EMPLOYMENT
AUDITS ASSESSED AND ASSESSMENTS
AND SELF REPORTED CAPABILITIES
ON THE HIGHEST RISK ENTITIES.
AND RELY ON ASSESSMENTS
IMPRACTICAL TECHNICAL METRICS ON
THE LOW RISK MARKETS. SO
GENERALLY AS WAS MENTIONED WE
PERFORM APPROXIMATELY. TEN
AUDITS PER YEAR AS AN ANNUAL
AVERAGE THAT DEPENDS ON RISK AND
ARE OVERSIGHT AUTHORITY SESAC
KNOWLEDGES CDT COMPLETED. THIRTY
ONE OF THIRTY NINE AUDITS AS OF
LAST YEAR. ACCORDINGLY EIGHT
ENTITIES WERE ACCOMMODATED FOR
SCHEDULING PURPOSES DUE TO THE
PANDEMIC AND THE BICK
PRIORITIZATION BASED ON ON THEIR
MATURITY. AS OF TODAY. WE ARE
TRACK TO COMPLETE FORTY EIGHT
HIGH RISK AUDITS ON TOP OF THE
FIVE HUNDRED FIFTEEN PLUS
ASSESSMENTS THAT WE CONDUCT WITH
THE MILITARY DEPARTMENT. OF
THESE METRICS COULD CONTRIBUTE
TO OUR OVERSIGHT POSTURE
INVISIBILITY INTO ALL OF THE ONE
HUNDRED AND EIGHT ENTITIES THAT
WE HAVE- VIEW OVER. AS AN
OPERATIONAL EFFORT WE FOCUSED ON
BUILDING UP OUR SECURITY
OPERATIONS CENTER. WE HAVE
NEARLY THIRTY ENTITIES THAT HAVE
BEEN ONBOARDED TO OUR MANAGED
SECURITY OPERATIONS SERVICE
BRENT HANSON TRIAL MONITORING
THIS PROVIDES SUPPORT FOR
ENTITIES THAT DO NOT HAVE
STAFFING MARKET CAPACITY TO
MONITOR THEIR OWN INTERNAL
NETWORKS. AS RESPECTIVELY AUDITS
PROCESS IS NOT TO TREAT ALL
ENTITIES THE SAME BUT TO FOCUS
ON. HIGH RISK ENTITIES RATHER
THAN A SPECIFIC NUMBER. HOWEVER
HIGH RISK IS A FACTOR DETERMINED
AT A POINT IN TIME HAN ANNUALLY
WE REALIZED RISK INVOLVED WITH
THE THREAT LANDSCAPE. AND A
COLLEGE THE RECOMMENDATION TO
LOOK. AT THE LOOK AND EXPLORE
FOR OPPORTUNITIES TO SCALE
OVERSIGHT ACTIVITIES. IN
ADDITION EXPLORE WAYS TO BE MORE
CONSULTATIVE AND ADVISORY TO
HELP OUR OUR ENTITIES. THAT
CANNOT SOMETIMES HELP THEMSELVES
AS A SUB RECOMMENDATION TO THE
NUMBER ONE. CDT SHOULD
PRIORITIZE CALCULATING MATURITY
METRIC SCORES FOR NINE ENTITIES
THAT DID NOT HAVE PRIVACY
CONTROLS AUDITED BEFORE PROCEED
CONTROLS WERE ACTUALLY ADDED
OVER OR BRAIDED INTO OUR AUDIT
PLAN ERNEST. WE KNOWLEDGE THIS
RECOMMENDATION AND WILL WILL
EVALUATE THE NINE MENTIONED
ENTITIES BY JUNE OF TWENTY
TWENTY TWO. SECOND
RECOMMENDATION IS C. T. SHOULD
PROVIDE ADDITIONAL GUIDANCE
DENSITIES ON WHAT CONSTITUTES A
CRITICAL SYSTEM AND FOLLOW UP
ANNUALLY. DURING SELF ASSESSMENT
PROCESS HE'S CDT WILL CLARIFY
GUIDANCE ON WHAT THE CRITICAL
SYSTEM DEFINITION IT IS. BY
APRIL TWENTY TWENTY TWO AND
THREE- AGENCY REVIEWS AND OTHER
SELF REPORTED NET MECHANISMS
WILL FACTOR AND METRICS. TO
COMPASS IN OUR OVERSIGHT
PROCESS. NUMBER THREE UTILIZE
INFORMATION FROM ENTITIES SELF
ASSESSMENT SELF ASSESSMENT
REPORT AS WELL AS FROM THE
NATIONWIDE CYBERSECURITY REVIEW
AS WAS MENTIONED EARLIER. TODAY
WE LEVERAGE THE NCS ARE
NATIONWIDE CYBERSECURITY REVIEW
TO INFORM AND HELL BE SUBJECTIVE
AND CSR SCORES CORRELATE TO
OBJECTIVE AUDIT AND ASSESSMENT
METRICS THAT WE DO HAVE ON HAND
. IN ADDITION WE ARE WORKING
WITH THE NCS ARE WITH THIS
CYBERSECURITY REVIEW PROGRAM TO
DEVELOP AGGREGATED AND TRENDING
REPORTS THAT WILL BE USED AS
PART OF THIS RECOMMENDATION.
HISTORICALLY AS WAS MENTIONED
BEFORE THE NATIONAL CYBER
SECURITY REVIEW WAS LEVERAGED
FOR GRANTS ADMISSION PURPOSES
AND BY VERY NATURE HAVE BEEN
VERY SUBJECTIVE. HOWEVER WE WILL
CONSIDER EVALUATING AND CSR AND
INCORPORATING AND CSR AS PART OF
OUR RISK MAKING METHODOLOGY WITH
APPROPRIATE WAITING. IN LINE TO
WORK TOWARDS OUR SECURITY
MATURITY METHODOLOGY. NUMBER
FOUR CDT SHOULD COMPLETE THE
NECESSARY UPDATES THE STATE
ADMINISTRATIVE MANUAL IN OUR
STATEWIDE INFORMATION MANAGEMENT
MANUAL THE REFERENCE LATEST
REVISION OF THE FEDERAL MISSED
SPECIAL PUBLICATION EIGHT
HUNDRED FIFTY THREE. WELL CITY
HAS GENERALLY ADOPTED THIS
SPECIAL PUBLICATION EIGHT
HUNDRED FIFTY THREE. AS A
MINIMUM STANDARD FOR STATE
ENTITIES INVESTORS WERE RELEASED
REVISION FIVE TO THE STANDARD
PUBLICATION DURING THE PANDEMIC
IN SEPTEMBER OF TWENTY TWENTY.
ALTHOUGH THE PANDEMIC ALL ALL
ALL THROUGHOUT THE PANDEMIC WE
HAVE BEEN CONTINUALLY UPDATING
SPECIFIC PREFERENCES AND
HIGHLIGHT APPLICABLE CONTROLS
THE PARTICULAR UPDATES ARE MADE
TO ADDRESS IMMINENT IMMEDIATE
THREATS OF GAPS WE ARE FACED
WITH ON AN IMMEDIATE BASIS TO
NOTE WE HAD RELEASED FOR
IMPORTANT PRIVACY AND SECURITY
STANDARDS JUST PRIOR TO THE
PANDEMIC. WILDER VISION FOR WAS
WASN'T DROUGHT THAT THE NATIONAL
LEVEL OUR STANDARDS HOW OUR
FOURTH STANDARDS WERE
IMPLEMENTED THE COVER EMAIL
THREAT PROTECTION EMAIL
PROTECTION PRACTICES ENDPOINT
PROTECTION PRIVACY THRESHOLD AND
PRIVACY IMPACT ASSESSMENT
METHODOLOGIES AS WELL AS MINIMUM
SECURITY STANDARDS. FOR STATE
DEFINED PARAMETERS. DURING THE
PANDEMIC CDT WAS ABLE TO PUBLISH
SIX MORE STANDARDS WHICH ADVANCE
THE STATE WIDE INFORMATION
SECURITY PRO PROGRAM. AND
THEY'LL STILL DO COVER ABOUT
SECURITY PRACTICES VISHING
EXERCISE STANDARDS VULNERABILITY
MANAGEMENT SECURITY EVENT
NOTIFICATION AND RESPONSE
PROTOCOLS. UPDATES TO THE
RELEASE OF PERSONAL INFORMATION
FOR RESEARCH AS WELL AS OUR
CALIFORNIA CYBERSECURITY
MATURITY METRIC FRAMEWORK. WHICH
ON AN ONGOING BASIS CONTINUALLY
EVOLVES AS I MENTIONED EARLIER.
CTA KNOWLEDGES THIS
RECOMMENDATION AND HAS BEGUN THE
PROCESS OF UPDATING FROM
REVISION FOR DIVISION. FIVE TO
BE COMPLETED BY FISCAL YEAR END
. SIX RECOMMENDATION CDT SHOULD
CLARIFY REMOTE ACCESS GUIDANCE
BY FEBRUARY OF TWENTY TWENTY TWO
PERTAINING TO EMPLOYEES USING
PERSONAL DEVICES. CDT IS ISSUING
REFERENCE UPDATES TO THE REMOTE
REMOTE ACCESS INTERNAL WORK
STANDARDS PERTAINING TO PERSONAL
DEVICE GUIDANCE. THIS WAS
INFORMAL GUIDANCE WITH RELEASED
DURING THE START OF THE
PANDEMIC. AND THAT'S PART OF THE
RECOMMENDATION WE WILL EMBED
THIS IS OUR OFFICIAL TELEWORK
ACTIVE STANDARD GOING FORWARD.
WE AGREE THAT TELEWORK SECURITY
WILL CONTINUE TO EVOLVE AND BE
AT GREATER RISK GOING FORWARD
AND WILL BE COMMITTED TO
INVOLVING OUR PRACTICES AND
STANDARDS AROUND REMOTE
WORKFORCE OF OUR OF OUR-
DEPARTMENTS. I DO APPRECIATE
CSA'S VALUABLE AND PUT THEM INTO
COMPLIANCE PROGRAM AND LOOK
FORWARD TO FURTHER EVOLVING IT.
EVEN THOUGH WE ARE NEARING AN
ENDEMIC WE ARE STILL A CYBER
EPIDEMIC WE CAN TRULY SAY WE
FACILITATED. THE CORRECT COURSE
OF ACTION AND AS A RESULT KEPT
ENTITIES OUT OF HOT WATER DURING
THESE EMERGENCIES. HOWEVER
THERE'S A LOT MORE WORK TO BE
DONE AND I LOOK FORWARD TO THE
INCREASED COLLABORATION BETWEEN
ALL OF OUR OFFICES AND GETTING.
AND EVOLVING OUR STATE. AND
NUMBER THIRTY JOURNEY. AND NOW I
WILL TURN IT BACK OVER TO RUSS.
I THANK THE POWERS YOU CAN SEE
CYBERSECURITY IS VERY DETAIL AND
LOTS OF INFORMATION HERE ARE THE
REGION PUBLISHED THE SOUTH HOW
SECURE- PLAN THIS ARTICULATE A
ROAD MAP TO GUIDE STATE
ENTITIES. AS THEY WON'T START
RISKY ACTIVITIES AND RAISE THAT
BAR ACROSS THE STATE AGAIN THAT
THE AUDIT PLAN OTHER PROGRAMS
THAT WE RUN BECAUSE SHE'S ABOUT
OVERALL PLAN BUT IT IS NOT.
ANYWHERE CLOSE TO THE PARK IT IS
VERY IMPORTANT BUT DURING THE
COURSE OF THE PAIN THAT WE CAN
DECISIVE AND IMMEDIATE ACTION TO
DEAL WITH THE TELEWORK AND THE
OTHER CYBERSECURITY. OUR
RESEARCH THE B SPOKE WITH THAT
I THINK THE COMMITTEE AND IN
FACT CSAA FOR CONTINUED
ATTENTION ON CYBER SECURITY IT
IS IMPERATIVE. WE GET THIS RIGHT
. VERY VERY DIFFICULT. EVERY TO
ADDRESS WE THAT WE ARE TO TAKE A
QUESTION THE COMMITTEE. ALL
RIGHT THANK YOU FOR MUCH AND I
THE ASSEMBLY SALAS. DO YOU HAVE
SOME. ABSOLUTELY THANK YOU THANK
YOU MADAM- WILL TO START WITH
THE FIRST THREE QUESTION THAT
ASKED. ARE AND YOU- ALLUDED SOME
OF THE ANSWER. BUT THE REASON
WHY OF THE HUNDRED AND EIGHT
REPORTING ENTITIES ARE THAT
WE'VE IDENTIFIED CERTAIN ONES IS
HIGH RISK AND LOW RISK BUT- WHY
. WHY WAS SO WHAT'S THE BEST WAY
TO PHRASE THIS LESS THAN HALF OF
IT WAS DONE AND WITH THE AUDITOR
AND ESTABLISHED YOU'RE TOLD
THAT. YOU KNOW WAS IT BECAUSE OF
IT OR DID THEY GIVE YOU A REASON
WASN'T STAFFING WAS OF THE
PANDEMIC WAS IT WHY WHY WEREN'T
THESE DONE- TO THE EXPECTATIONS
WERE WERE WE'VE GOT MORE OF A
WOULD BE COMPLETED CAN YOU JUST
GIVE ME A- DIRECT ANSWER ON THAT
. WE'RE ACTUALLY ON PACE OF THE
HIGH RISK ENTITIES. TO ACHIEVE
FORTY EIGHT OF THE- FIFTY TWO
THAT ARE IDENTIFIED. SO THEY'RE
CORRECT IN THE FIRST THREE YEARS
OF THE PROGRAM WE ACCOMPLISH
THIRTY ONE. OF THE THIRTY NINE
THAT WERE SCHEDULED- BUT SOME OF
THOSE THAT WEREN'T COMPLETED BY
THE END OF YOUR THREE WERE
ACTUALLY WHITE SO. SO WE ARE ON
PACE. TO ACTUALLY ACCOMPLISH
ALMOST ALL OF THE ENTITIES ARE.
THE FOR YOUR COMPOST ARE
ACTUALLY ESSENTIALLY PUSHING
BACK AND SAYING THEY'RE NOT
SUBJECT TO THE ARTICLES SO WE'RE
IN OUR VIEW WE ARE ACTUALLY NOT
BEHIND A HIGH RISK AUDITS. AGAIN
THE REST OF THE HUNDRED KNIGHT
ARE NOT SUBJECT TO AN AUDIT SO
THAT WOULD NOT BE INCLUDED
PRESSBOX. WONDERWORKER PARKS.
AND CURRENT STRUCK OKAY WITHIN
FORTY FORTY EIGHT THE FIFTY TWO
THAT YOU'VE IDENTIFIED AS HIGH
RISK WILL BE COMPLETED. YES GOT
IT ALL RIGHT AND THEN LET ME
JUST ASK- ALSO YOU KNOW THE
AUDITOR AND SUGGESTED THAT CD T.
USE THE RESULTS OF THE FEDERAL
NATIONWIDE CYBER SECURITY REVIEW
TO INFORM THE STATUS OF THE
STATE'S INFORMATION SECURITY
IT'S MY UNDERSTANDING THAT CTE
IS ALREADY REQUIRING REPORTING
AGENCIES TO COMPLETE THE
NATIONAL REVIEW EVERY YEAR.
RIGHT I BELIEVE IT'S CONDITION
FOR RECEIVING SOME- GRANT
FUNDING FROM THE US DEPARTMENT
OF HOMELAND SECURITY. AS THE
QUESTION IS- WHY DOESN'T CD T.
USE THAT INFORMATION TO COULD
GAIN A CLEARER PICTURE OF THE
STATUS OF THE END. OF THE
STATE'S INFORMATION SECURITY. IN
THE PAST WE DID NOT INCORPORATE
THAT RECORD BECAUSE IT WAS SELF
REPORTED INFORMATION. BYE WEEK
KNOWLEDGE THE RECOMMENDATION WE
THINK IT IS A GOOD INDICATION-
WHICH IS MUCH BETTER THAN
NOTHING AND PLAN TO INCORPORATE
THAT IN THE FUTURE BUT IT HAS
NOT BEEN PART OF THE SECURITY
POLICY THE CYBER SECURITY POLICY
OF THE STATE. UP UNTIL THIS
POINT. ALLEN RIGHT NOW I
APPRECIATE THAT AND I THINK- WE
CAN INTEGRATED IN THE FUTURE
ESPECIALLY IF THAT INFORMATION
IS OUT THERE SO WHETHER IT'S
UNDER THE- ST FIFTY THREE
HUNDRED OR THE SAM- GUIDELINES I
THINK THAT WOULD BE HELPFUL JUST
GIVE AN OVERALL PICTURE. OF
WHERE WE'RE AT. AT THE STATE IN
TERMS OF SECURITY- I DO WANT TO.
ASK ANOTHER QUESTION IF I MAY
MADAM CHAIR- YOU KNOW MISTER
NICHOLS I BELIEVE YOU STATED
THAT THERE HAVE BEEN AN INCREASE
IN ATTACKS INCLUDING PHISHING
AND RANSOMWARE- IN THE PAST
YEAR- DCA A CORRELATION BETWEEN
THE ENTITIES UNDER ATTACK. AND
THE RECENT- SECURITY STATUS MAY
BE WITH THE AUDITS- AND- ALREADY
HAVE THEM. DO ANY OF THEM LOCKED
THE POLICIES UNDER THE STATE
AUDITOR'S REVIEW. LET ME DEFER
TO MISTER PENICHE TO ACTUALLY
ADDRESS THAT I DON'T HAVE THOSE
NUMBERS AND- THANK YOU. SIX
CERTAINLY HAS MENTIONED THAT
THERE WAS THERE IS GENERALLY AN
INCREASE IN SOME OF THESE
INCIDENTS. WHICH IS WHY OVER THE
LAST YEAR AND A HALF WE'VE BUILT
UP. IT'S A SOPHISTICATED
INCIDENT RESPONSE CAPABILITY THE
NEW THE SUPPORT OF CAL SICK AND
THAT'S REALLY INTENDED TO.
MITIGATE MITIGATE SOME OF THE
NEGATIVE OR ADVERSE OUTCOMES
THAT POTENTIALLY CAN STEM STEM
FROM A PHISHING ATTACK WERE
RANSOMWARE ATTACK SO THAT WE CAN
HAVE AN OPPORTUNITY OR A BETTER
OPPORTUNITY TO CONTAIN THE
ACTUAL THREAT BEFORE IT CAUSES
HARM FULL DAMAGE. SO WE'VE-
INSTITUTED THIS INCIDENT
RESPONSE AND THREAT INTELLIGENCE
PRACTICE ALL FOR THE PURPOSES OF
MITIGATING. THE GAPS OR ISSUES
THAT MAY BE. NOT THAT MAY BE
EVIDENT WITHIN AT THE
DEPARTMENTS SO THAT THERE IS THE
POTENTIALLY CORRELATING POINT
THERE WHICH IS WHY WE USE THAT
TO INFORM WHAT WE DO. WITH OUR
SECURITY COMMUNITY TO ESTABLISH
NEXT GENERATION INCIDENT
RESPONSE CAPABILITIES ESTABLISH.
A THREAT INTELLIGENCE
CAPABILITIES THAT THAT THAT'S
USEDTO INFORM OUR STATEWIDE
SECURITY OPERATIONS PRACTICES AS
AN OVERARCHING MITIGATE- WHILE
THE DEPARTMENT OF AT A LOCAL
LEVEL THIS IS ABLE TO
EFFECTIVELY- REMEDIATE THE ISSUE
REMEDIATE AN ISSUE BY FOR
EXAMPLE IMPLEMENTING BETTER
ACCESS CONTROLS IMPLEMENTING.
BETTER IN POINT PRODUCTION
STANDARDS IMPLEMENTING BETTER
SECURITY AWARENESS PRACTICES ASK
GUIDE GUIDED BY BY OUR OFFICE TO
POLICY MEASURES SO THERE'S A
CORRELATING POINT THERE THAT
WERE LEADING POINT. AIMS TO
INFORM WHAT WE DO AS A STATE
STATEWIDE CYBERSECURITY
COMMUNITY WITH ALL OF OUR
PARTNERS. IN THE VAN THAT THE
CAL SICK. SOME MUCH SO TWENTY
THREE IF I CAN ASK OUR ONE AT A
STRIP YOUR CALL. AS WE GO
THROUGH OUR AUDITS DO NOT
PUBLISH PUBLIC SPUR SCORES WERE
. OR OLDER POLICE RELATED TO US
FOR DOCTOR. IN THIS S. R. C. S.
AUDIT ALSO THAT THEY ARE AND A
ENERGY P. WITH INTENT NOT.
EXPRESS MAKING TARGETS MANY OF
OUR OLDER WILL VERY CAREFUL.
WITH THAT. WE DO PROVIDE THE
SPECIFICS BACK TO THE DEPARTMENT
TO WORK WITH THEM TO HELP
EDUCATE THEM ON THE THINGS THAT
WE DO. ARE YEAH NINE UNDERSTAND
THAT WOULD ONE. PUBLIC LIST SOME
THAT WE DON'T PUT THE AT FURTHER
RISK BUT I DO WANT TO. I DO WANT
TO UNDERSTAND WHETHER HAVE THE
POWER. IN PLACE OR WHETHER IT'S
A NEXT GENERATION INCIDENT
RESPONSE OUR THREAT INTELLIGENCE
THAT WERE USING THE BEST
PRACTICES FOR THOSE ENTITIES.
THAT'S IMPROVE THEIR SECURITY SO
WHETHER YOU KNOW IT'S AND IT
WHETHER TDD WHICH I MENTIONED
EARLIER ANYBODY ELSE. IS THAT
TECHNOLOGY BEING. UTILIZED AND
IS CD T. WHO IS RESPONSIBLE. FOR
IMPLEMENTING THE STATE'S
SECURITY LIKE HOW ARE WE GETTING
THAT OUT TO ALL OF THE
DEPARTMENTS AND I KNOW WERE
FALLING BACK ON SOME OF THE
ARTISTS BUT NOW YOU'RE ON PACE
BUT I JUST WANNA MAKE SURE THAT
WE'RE STILL PROTECTING YOU KNOW
CALIFORNIA'S PRIVACY IN THEIR
SECURITY THAT THESE. MEASURES
ARE ACTUALLY BEING IMPLEMENTED
THAT MAKES SENSE. SO I'LL LET ME
BACK UP HOW OFFICE. WE DO
COURTNEY BOTH THE FEDERAL
GOVERNMENT AND OUR PARK. TO CAN
. MATURE OUR TECHNOLOGY- CAN
SECURITY POLICIES AND THE TOOLS
AND PRACTICES. THAT ARE IN
PLACE. AND SO. SINCE YOU
MENTIONED EATING DE UM ALL USE
THAT EXAMPLE. AS THE.
EXPERIENCED ACROSS EVENT THAT
THAT THEY HAVE WE WORK WITH SOME
OF OUR PARTNERS AND BROUGHT IN
TECHNOLOGY TO HELP WITH
IDENTITY. MATCHING TO MAKE SURE
THAT WE USE THE APPROPRIATE
TECHNOLOGIES TO REDUCE THE
EXPOSURE TO THE EXTENT THAT
FRAUD COULD BE PERPETRATED. BY
BAD ACTORS AND IN THIS SOCIETY
SO WHILE SOME OF THAT ISN'T
NECESSARILY A POLICY CHANGE WERE
ABSOLUTELY USING THOSE SPEEDS
FROM. OUR OWN. FROM OUR CYBER
SECURITY INTEGRATION CENTER FROM
THAT FEDERAL GOVERNMENT AND FROM
OUR PARTNERS TO IMPROVE THAT
PLATFORM CONTINUE. IT AND THEN
IN ADDITION TO THAT IF I MAY
ANSWER A WEEK WEEK WE DO COLLECT
ON A QUARTERLY BASIS A LOT OF
ACTION A MILESTONE KIND OF A
RISK REGISTER INVESTMENT AND
ASSOCIATED PLAN FROM EACH
DEPARTMENT. AND WE ULTIMATELY
AGGREGATE THAT DATA POINT AND A
BUNCH OF OTHER DATA POINTS
COLLECTED FROM AUDITS AND
ASSESSMENTS. AND GO OVER A LOT
OF THESE DETAILS AND CORRELATOR
COROLLARY CAUSE AND EFFECT
POINTS. AT THE AGENCY LEVEL TO
REALLY ENABLE OUR OUR OUR
AGENCIES TO HELP PUSH DOWN FROM
THE TOP DOWN EFFECTIVE AND
BETTER. BETTER CHANGE IN THE
RIGHT DIRECTION. AND THEN WE DO
THAT ENOUGH OBVIOUSLY IN A
CONFIDENTIAL MANNER MATTER
PARTICULARLY. AROUND THE
SPECIFIC HOLD BUILDINGS OF
SPECIFIC DEPARTMENTS THAT
APPLIED TO THOSE ENTITIES.
UNDERSTOOD THANK YOU I AM DID
HAVE ANOTHER QUESTION IF I MAY
JUST HAVE UNDERSTAND- THE
METRICS THE TO USE YOUR MATURITY
METRICS. RIGHT AND I'M
UNDERSTAND IT'S LIKE ON A SCALE
OF ZERO TO FOUR CIVIC KIND OF
EXPLAIN. DESERVE A MISSING
ISRAEL'S WORSENED FOR IS
EXCEPTIONAL- BUT KIND OF WHERE
WE'RE AT BECAUSE YOU KNOW WHEN
YOU LOOK AT IT WE ONLY HAD
SEVENTEEN OR EIGHTEEN BUT
ACTUALLY THAT YOU ACTUALLY
DEVELOP METRICS FOR IS THAT
CORRECT. THAT'S CORRECT AND IT
THAT A CERTAIN POINT POINT IN
TIME LAST YEAR AS WAS MENTIONED
. WE DID HAVE OR WHAT WE ARE ON
TRACK TO COLLECT THIRTY NINE
METRICS AND BY THE END OF THE
FISCAL YEAR FOR FORTY EIGHT.
METRICS AS A RESULT FROM BOTH
AUDITS AND ASSESSMENTS. AND JUST
TO REITERATE KIND OF THE SCALE
OF THESE METRICS OF IT SCALES
FROM ZERO TO A FOR. ZERO IT
MEANS YOU'RE DOING NOTHING IN A
PARTICULAR SECURITY CONTROL
CATEGORY A ONE MEANS YOU HAVE
EIGHT. A POLICY A TWO MEANS YOU
HAVEN'T AND ASSOCIATED
PROCESSING PROCEDURE. IN A THREE
AND A FOUR GENERALLY IS THE
OUTCOME BASED MEASURE OR SUCCESS
MEASURE HOW EFFECTIVE YOU ARE
WITHIN A SECURITY CONTROL
CATEGORY. OFTENTIMES THE ISSUE
IS THAT AN ENTITY OR DEPARTMENT
MAY NOT BE MATURE AND HAVING A
POLICY STANDARD PROCEDURE. BUT
MAY PERFORM WELL IN A SECURITY
CONTROL CATEGORY WITHOUT A
POLICIES AND PROCEDURES SO
GENERALLY BY THE VERY NATURE
METRICS. WOULD BE SCORED LOWER.
THAT THAN WHAT THEY'RE IS
POSTURE. WHAT WOULD REALLY BE IN
REALITY SO WE SPECIFICALLY
DESIGNED THAT THE ELECTRIC
METHODOLOGY TO ENCOURAGE AND THE
PUSH DEPARTMENTS TO MAKE SURE
THEY ALSO FOCUS ON POLICIES
STANDARDS AND PROCEDURES WHICH
ULTIMATELY LEADS LEAD TO YOUR
OVERALL LONG TERM SUSTAINABILITY
OF YOUR SECURITY. POSTURE IN
YOUR SECURITY PROGRAM- HELLO
HOWEVER WE DO ENCOURAGE
DEPARTMENTS ALSO BE TACTICAL AND
MAKE SURE THEY'RE- MEET ME TO
GET AT THE END OF THE ROAD BASED
UPON THE- SO IT'S A BALANCE AND
THAT THAT IS WHY WE OFTEN KIND
UNDER RAVEL THE METHODOLOGY AND
LOOK AT. LOOK AT ASSESSMENT
SCORES INDEPENDENTLY AS WE ALSO
RELY ON BOSNIA SIX SECURITY
MATURITY SCORES WHICH
ENCOMPASSED THE POLICIES AND
PRACTICES AND PROCEDURES SO BUT
BOTH. BOTH FRONTS ARE NEEDED OR
BOTH EFFORTS ARE NEEDED SO WE
GENERALLY DE COUPLE THE COUPLE
ARE BENCHMARKS. IT'S A REALLY
DEAL WITH THE IMMINENT THREAT
SECONDHAND. PRODUCT THANK YOU
THANK YOU FOR THE EXPLOITATION
BUT SOME FOR THE SEVENTEEN
REPORTING ENTITIES. THAT RECEIVE
SCORES BOB IGER FOUND THAT THEY
ACHIEVED AN AVERAGE SCORE OF ONE
POINT THREE. YOU KNOW I THINK
IT'S AN- FIGURE EIGHT ON PAGE
TWENTY TWO OF THE REPORT. SOME-
SOME SHOW LITTLE OR NO PROGRESS
FOR SOME ENTITIES. AND FIRST OF
OTHER ENTITIES ARE SCORES OF
ACTUALLY DECLINED. SO WHAT CD
HE'S PERSPECTIVE ON THIS AND YOU
KNOW. SEDG SAYING LOOK WE SHOULD
TRY TO HAVE A MINIMUM SCORE OF
AT LEAST A THREE ON THESE
METRICS. AND WHAT IS CDT DOING
TO HELP IMPROVE- THOSE ENTITIES
THAT. OVERALL METRICS COURSE.
YES SORRY OUR GOAL IS ALWAYS TO
CONTINUALLY RAISE THE BAR-
DEFINITELY WE NEED TO RAISE THE
BAR AND BE AT A MINIMUM OF A TO
OUR BLOG MEETING YOU HAVE A
HEALTHY POLICY PROCESS AND
PROCEDURE IN PLACE HOWEVER THIS
YEAR. MATURITY METRICS DON'T
DON'T TAKE INTO ACCOUNT- IT
DON'T TAKE INTO ACCOUNT HOW
EFFECTIVE YOU ARE HOW IT
AFFECTED YOUR DOING AS IT
PERTAINS TO YOUR SUSSMAN IF YOU
DON'T HAVE A POLICY IN MIND SO
WITHOUT WEEK WE ARE CONTINUALLY
RELEASING TEMPLATE POLICIES AND
PROCEDURES THAT DEPARTMENTS
COULD IT TAKE TAKE A DOLPHIN
CHARLIE ON THEIR OWN TO DATE
WITH PUBLISHED BETWEEN SIXTY
SIXTY TO SEVENTY TEMPLATE
POLICIES AND PROCEDURES. THAT
DEPARTMENTS COULD TAKE RIGHT
AWAY AND THEN IMPLEMENT AND PUT
FORTH INTO PRACTICE WITHIN THE
ORGANIZATION SO THAT THAT'S ONE
MEASURE. I MEASURE IS- FOCUSING
ON WORKFORCE DEVELOPMENT AND
EDUCATIONAL EFFORTS THROUGH THE
DEPARTMENTAL FOCUSED WORKSHOPS
EDUCATIONAL WORKSHOPS. VULSO IT
ENABLED WERE BUILT OUR
INFORMATION SECURITY LEADERSHIP
ACADEMY SO THAT WE CAN EDUCATED
PARDON FOR MISSION SECURITY
OFFICERS TO EFFECTUATE. THESE
POLICIES THESE. POLICY AND
PROCEDURAL CHANGES FROM WITHIN.
SO JUST WHAT'S IT GONNA TAKE FOR
US TO HELP THESE ENTITIES
IMPROVE THEIR SCORES TO AT LEAST
IT SOUNDS LIKE YOU SAID A
MINIMUM OF THE TWO- I MEAN IS IT
REALLY JUST IMPLEMENTING THESE
POLICIES IS GOING TO TAKE. MORE
BUDDY YOU TALK ABOUT WORKFORCE
DEVELOPMENT. BUT HOW DO WE HOW
DO WE GET THERE BECAUSE YOU KNOW
IT'S LOW OF THE SERVING ONE SOME
HAVE SHOWN NO MOVEMENT AND WE'VE
BEEN DOING THIS SINCE TWENTY
THIRTEEN. SOME OF THE CLIENT-
I'M JUST TRYING TO GET AT HOW DO
WE- FIX THIS. STILL THE PLAN
IT'S REALLY TO ALIGN ENTITIES
AND SUPPORT THEM IN THEIR
JOURNEY. OF IMPLEMENTING WHAT'S
OUTLINED AND CAL SECURE. CAL
SECURE WHICH OUTLINES. BROUGHT
PROCESS. RIGHT PROCESS-
TECHNOLOGY ROADMAP IN AND ON.
AND I WORKFORCE ROAD MATH SO WE
REALLY NEED TO BE ABLE TO
SUPPORTER DEPARTMENTS AND
BUILDING UP THEIR SECURITY
DEFENSES AUDIENCE CAPABILITIES
AS IT AS IT IS MAPPED TO CAL
SECURE. SO MR SAUCE ON ME MAYBE.
A LITTLE WORK ON A TRUCK WITH
PRIOR TO. CAL SECURE PLAN LAST
FALL DEPARTMENTS REALLY OPERATE
WITHIN THOSE POLICIES ARE
WITHOUT. OVER GUIDANCE FROM FROM
DEPARTMENT TECHNOLOGY NEED NOT
GIVING THEM A ROAD MAP THE
CONNECTED WHERE THEY ARE TO
WHERE WE WANT THEM TO BE. THAT
IS THE INTENT OF THAT CAL
SECURE. TO ESSENTIALLY LAID OUT
AS A SERIES OF OBJECTIVES WE'RE
GOING. TO COMPLETE. ENGINE THE
FUNDING BACK THAT MR AND-
MENTIONED DURING HIS COMMENTS.
GIVES THEM THE FUN INTO. TO ME
MOVEMENT ALONG THOSE ROADS THAT
. AND SO WE'RE NOT A POOR YET
WHERE WE KNOW. IF IS A GAP THERE
- THAT WILL OF ALL WILL THE NEXT
YEAR TO TWO YEARS TO SEE WHERE
THEY ARE IN THE ARE THAT MAKE.
CDT IS- YEAH IN THAT BUSINESS UP
IMPLEMENTING THERE'S PROCEDURES
POLICIES THEM TO FRANKLY THAT'S
WHY DOES ORDER HAVE. AND
SECURITY WITH THE EACH. IS TO BE
PERFECTLY ALIGNED THERE MODEL.
SO WE WERE PROVIDED THEM NOW
WITH THE ROAD MAP AND ALL. AND
HELPING TO GUIDE THEM DOWN THAT
. BUT WE ARE CAL ON THE TO PARK
DIRECTORS AGENTS STAFF
INFORMATION SIX STAFF AT BOTH
LEVELS THE WOMAN'S. THAT REALLY
START WHICH THE A BIG PIECE OF
THIS IS IN UPGRADING ESSENTIALLY
CULTURE OR PROCESS. DEBTS
SECURITY GOT TO BE A FUN PART OF
ANY PROGRAM THAT. SHOULD END IN
THE REAL. HOUSE IS NOT SPECIAL
AN HOUR. THAT WE BRING IN WE ARE
CHANGE THAT MESSAGING WERE
CHANGING THAT CULTURE- AND I
BELIEVE WE ARE MAKING PROCESS.
OUR PROGRESS AGAINST THAT
BECAUSE YOU SEE THE METRICS-
WE'RE STAYING YOU KNOW
RELATIVELY STAGNANT AND WITH
THAT OBSERVATION. WE ARE RAISING
THE BAR WE'RE WE'RE ACHIEVING
SIMILAR SCORES BUT THOSE SCORES
ARE AGAINST MORE MORE RIGOROUS
METRICS AS WE GO. SO WE ARE
IMPROVING. THE SECURITY. A
PROFILE WHICH IS NOW WORK WANT
TO BE. IN A WOULD ALSO. POINT
OUT OR- IN THINGS LIKE THE MILL
IS WHERE WE TALKED ABOUT A SCORE
CALL. IF ANY SAYS ACTUALLY TO
AND- TWO ON. IT IS ALMOST ON YOU
SO IT'S QUITE OFTEN. BETWEEN
INFORMATIONS. AND THE
FUNCTIONALITY THAT WE ARE TRYING
TO DEPLOY WHETHER IT'S
ASSISTANCE INSIDE AN APARTMENT
OR PUBLIC FACING. IT'S GOT TO BE
USABLE FOR THE PEOPLE THAT NEED
TO DO THEIR JOBS OR FOR OUR
RESIDENTS IN CALIFORNIA TO.
OBTAIN SERVICES FROM SPECTRUM
WITH ONE. ARM UP PERFECTLY
SECURE SYSTEM WOULD BE ONE IT'S
SO UNUSABLE NOBODY WHATEVER. TO
THAT TO EXPERIENCE. YEAH NINE. A
PRE THAT THE- ANSWER BUT YOU
KNOW WHEN I TALK TO YOU LIKE MY
CONSTITUENTS BACK HOME THE- THE
FUNDAMENTAL. QUESTION THEY
ALWAYS ASK ME IS YOU KNOW I DO
MY BANKING SECURELY AND WHY CAN
I DO ALL THESE OTHER SERVICES
SECURELY I CAN USE AN ATM I CAN
GO ONLINE I CAN USE MY PHONE.
AND IT'S THROUGH SECURE SYSTEM
SO THE- SECURITY VERSUS ABILITY
TO- ACTUALLY USE A SYSTEM A YOU
KNOW. FOR FOLKS BACK HOME IS
JUST A VERY SIMPLE THING IF I
COULD DO IT FOR MY BANKING WHAT
CAN BE DONE WITH ALL THESE OTHER
ENTITIES. I APPRECIATE THAT YOU
KNOW CAL SECURE IS SOMETHING
THAT WAS IMPLEMENTED IN OCTOBER
OF LAST YEAR SO ARE YOU SAYING
WE SHOULD JUST. YOU KNOW HEALTH
CARE THE WAY TO GO AND- THAT'S
HOW WE'RE GONNA INCREASE- THE
METRICS WHETHER IT'S- THE
NATIONAL OR WHETHER IT'S THE
ZERO FOUR- GET UP. CASCAR IS A
WAY TO DO THAT. CALCULAR IS A
VERY IMPORTANT PIECE OF THAT IS
NOT THE WHOLE STORY. BUT IT DOES
PROVIDE THE ROAD MAP THAT THAT
NOW PROVIDES GUIDANCE TO THE
DEPARTMENTS THE ABILITY TO
IMPROVE THAT SCORE- IN FACT IT
IS ACTUALLY BEEN REFERENCED BY
THE FEDERAL GOVERNMENT. THE
NUMBER OF FORMS AS BEING A
STANDOUT AMONG STATES. IN
ACTUALLY PROVIDING THAT TYPE OF
THE ROAD MAP OF THE. THANK YOU
THANK YOU VENTURE. HI I HAVE A
THANK YOU MISTER SALAS SO I JUST
NEED TO. SOME CLARITY I. HOW
MANY AUDIT. ARE GOING TO BE
COMPLETED IN TWENTY TWENTY TO
THE AUDITOR. NOTES THAT YOU NEED
TO COMPLETE SEVENTEEN- TO MEET
THE FORTY EIGHT AUDITS IN YOUR
LETTER. BUT THE CD T. HAS ONLY
AVERAGED ELEVEN SO ARE YOU GOING
TO BE HIRING ADDITIONAL PEOPLE I
GUESS I'D I'D- I DON'T KNOW THE
CLEAR ANSWER TO THAT. I DON'T
HAVE A CLEAR ANSWER TO THAT. IT
BECOMES A LITTLE BIT MONEY-BECAUSE OF THE REFERENCE SO
WE'RE THREE YEARS. THREE YEARS
COMPLETED IN THAT AUDIT CYCLE
FOR YEARS. AT THE END OF THE
THIRD YEAR WE COMPLETED THIRTY
ONE. IT'S THERE WERE OTHER
AUDITS THAT WERE IN PROCESS BUT
NOT COMPLETED SO IT'S NOT THAT
WE HAVE TO START SEVENTEENTH
START AND FINISH SEVENTEEN
AUDITS IN THIS LAST YEAR. WE
HAVE TO COMPLETE THOSE SEVENTEEN
SO A NUMBER OF THEM WERE VERY
CLOSE TO FINISHING IN THE FIRST
PLACE. BY THE END OF THE FOUR
YEAR CYCLE WE ARE ON TASK TO
COMPLETE FORTY EIGHT OF THE
FIFTY TWO AUDITS THAT WOULD BE
ON THE HIGH RISK ENTITIES STATE.
OKAY THANK YOU FOR THAT SO YES
SO BASICALLY RIGHT NOW TO DO
THAT WORK YOU DON'T SEE THAT YOU
NEED TO. ASSIGN MORE STAFF OR
CONTRACT OUT YOU HAVE THE
PERSONNEL YOU NEED. THAT'S
CORRECT OKAY. OF- SINCE MANY OF
THE A METRIC- CATEGORIES ARE
SUPPLIED BY. NEED TO SINCE MANY
OF THE METRIC CATEGORIES ARE
SUPPLID BY AUTO PERFORMANCE HOW
DO YOU CALCULATE A METRIC A
MATURITY METRIC FOR LOW RISK
ENTITIES THAT- DON'T RECEIVE AN
AUDIT. KELLY WON'T DRESS UP YEAH
NOT SOMETHING WE'RE WE'RE
CURRENTLY IN DISCUSSIONS ON THE
HUB PLANNING IN TERMS OF WHAT
OUR PLAN WILL BE TO SHORE UP THE
METRICS. SO CURRENTLY WE WOULD
RELY ON SELF SELF ASSESSMENT
SUBJECTIVE QUESTIONNAIRES AND AT
THIS POINT IN TIME THAT THAT'S
HOW WE WOULD WOULD BE ABLE TO
COLLECT THOSE METRICS. WE ARE
EXPLORING OPPORTUNITIES AND
CONDUCTING FISCAL ANALYSIS UP ON
HOW TO. MORE OBJECTIVELY- COVER
THOSE OTHER ENTITIES WITHOUT
RESORTING TO SUBJECTIVE MEASURES
LIKE QUESTIONNAIRES AND THAT'S
SOMETHING WE'RE CURRENTLY
DISCUSSING AS A PLAN OF ACTION
GOING FORWARD. OKAY CITIES
LETTER NOTES THAT THE METRIC
DOES NOT TAKE INTO ACCOUNT- THE
SOCCER CAL SICK- SERVICES- WHY
IF THAT'S THE CASE THE CDT FEEL
THAT THESE SERVICES MAY MEDIC-
MEDICAID A LESS MATURE AND
EIGHTY. SO WE WERE BUILDING THE
STATEWIDE SECURITY CONTROLS AS A
COMPENSATING CONTROL FOR
ENTITIES. REMEMBER WHICH CANNOT
IMPLEMENT SECURITY CONTROLS
LOCALLY FOR EXAMPLE. CONDUCTING
INCIDENT RESPONSE PROCESSES
LOCALLY SOMETHING THAT THAT SOME
OF OUR ENTITIES HAVE NOT BEEN
ABOUT EXCELLED IN AND THAT WAS
THE MAIN DRIVER MOTIVATOR AND
ESTABLISHING A STATEWIDE
INCIDENT RESPONSE TEAM SO THAT
WE CAN DO THAT FOR THEM HOWEVER
THE METRICS SOLELY MEASURE
DEPARTMENTS. SCORES AND ABILITY
AND MATURITY TO DEAL ON THEIR
OWN WITHOUT STATEWIDE
CENTRALIZED SERVICES. OKAY SO- I
SHOULD SELL THE SELL THESE
ENTITIES PARTICIPATION WITH THE
SOCCER CAL SICK IMPROVE THEIR
MATURITY. YES IT WILL IMPROVE
THEIR MATURITY AND THEIR ABILITY
TO BE RESILIENT TO THE THREATS
RATS AND HANDS. OKAY AND THEN
LEVEL THREE I'M SORRY DON'T
DON'T SORRY WE DON'T MEASURE
THAT IS PART OF THE CURRENT RISK
MEASUREMENT METHODOLOGY THAT'S
AN INDEPENDENT COMPENSATING
CONTROL THAT THAT HELPS
DEPARTMENTS. WITH THEIR LACK OF
FULFILLING A SECURITY CONTROL
CATEGORY. SO SHORT. MYSTERY AND
IT TO YOUR POINT FRANKLY THERE'S
A GAP IN PART OF THE SCORING
METHODOLOGY WHEN I ESPECIALLY A
SMALL ORGANIZATION. HOW IT WORKS
WITH OUR SECURITY OPERATIONS
CENTER TO ACQUIRE SOME OF THOSE
SECURITIES SERVICES ACTUALLY CAL
IN THEIR SECURITY SCORE BECAUSE
THE WAY THE SECURITY SCORE IS
CALCULATED IS BASED ON WHAT THEY
DO. AND HENCE FOR SCORING
METHODOLOGY ACTUALLY DOES NEED
TO BE UPDATED TO TAKE THAT INTO
ACCOUNT. RIGHT SO JST. TO
CLARIFY IT ARE HAVE YOU DO YOU
HAVE MATURITY METRICS FOR ANY
LOW RISK ENTITIES. FOR NON HIGH
RISK ENTITIES NO WE DO NOT. WE
WILL RELY ON THE ASSESSMENT
SCORES. OUR RATE- SO- LET'S SEE
WHAT ELSE. SO I DO I DO I DO
WANT TO SAY WITH- WE WERE
TALKING ABOUT A BRIEFING OF THE
LEGISLATURE I'VE APPRECIATED THE
VOLUNTARY COOPERATION OF THE
ADMINISTRATION AND BRIEFING ME
AND SOME OF MY FORMER COLLEAGUES
ON A QUARTERLY BASIS. BUT OF
MORE FORMAL MECHANISM IS A
INTERESTING RECOMMENDATION BY
THE AUDITOR AS CYBER SECURITY
MAY BE TOO IMPORTANT OF AN ISSUE
TO LEAVE TO IT INFORMAL
REPORTING IS THERE ANY INTEREST
BY THE ADMINISTRATION TO BUILD
UPON OUR CURRENT BRIEFING-
FORMAT. WE WOULD DEFINITELY BE
INTERESTED IN HAVING A
CONVERSATION WITH THE
ADMINISTRATION WILL NOT. I CAN'T
COMMIT TO THAT I HAVE NOT HAD
THAT CONVERSATION WITH
GOVERNMENT'S OFFICE PROJECT WILL
PUSH WHAT'S- OKAY. RIGHT I THINK
THAT WE ARE- DONE WITH. THE
QUESTIONS I REALLY APPRECIATE-
YOUR TIME AND OF. I DON'T KNOW
IF THERE'S GOING TO BE MORE
QUESTIONS WHILE WE ARE
DISCUSSING THE AUDITORS-
RECOMMENDATIONS BUT- WE WILL
MOVE ON TO THAT. FOR THE AUTO
PAY SO IF WE COULD HAVE YOU COME
BACK UP.
ALL RIGHTS OF THE
AUDITOR HAS MADE THREE
RECOMMENDATIONS- TO THE
LEGISLATURE AND AS I MENTIONED
EARLIER I'VE INTRODUCED TWO
BILLS TO USES VEHICLES FOR.
LEGISLATIVE CONSIDERATION OF
THESE RECOMMENDATIONS SO I
WANTED TO ASK SOME QUESTIONS
ABOUT THE RECOMMENDATIONS
ESPECIALLY RECOMMENDATIONS ABOUT
NON REPORTING ENTITIES WHO.
HAVEN'T GOTTEN AS MUCH OF FOCUS
TODAY. SO- FIRST TO US YES THEY
RECOMMEND FOR THE LEGISLATURE TO
REQUIRE CDTV TO REPORT
CONFIDENTIALLY TO THE
LEGISLATURE IS- TO THE
LEGISLATURE AND CSR SCORES
IMMATURITY METRIC SCORES AS YOU
CONSIDERED THESE MORE DETAILED-
INFORMATION THAT STATISTICAL
INFORMATION ABOUT AYE ESSAYS AND
THE LEGISLATURE CURRENTLY
RECEIVES SO FIRST IS HOW DO
THESE TWO SCORES- WHICH PROVIDE
NO INSIGHT TO WEAKNESS OR
STRENGTH JUST OVERALL MATURITY.
HOW ARE THEY MORE HELPFUL. SO I
THINK IT GIVES- THEY WERE
DESIGNED TAKE QUICKLY SEE WHERE
AN ENTITY- IS AS FAR AS THEIR
MATURITY- ARE THEY PROGRESSING
AND ARE THEY MEETING THOUGH SENT
MINIMUM STANDARDS SO I THINK-
JUST LIKE WE DISPLAY IN THE
REPORT THAT ON AVERAGE THE
MATURITY METRIC SCORES WERE ONE
POINT THREE WHERE THEY SHOULD BE
AT LEAST A TWO AMP I'M
POTENTIALLY HIGHER I THINK THOSE
SUMMARY STATISTICS AND- IF
YOU'RE CONCERNED ABOUT SPECIFIC
DEPARTMENT THAT'S A EASY NUMBER
THAT YOU CAN LOOK AT AND CAN GET
A SENSE FOR. HOW ARE WE DOING AS
A STATE HOUSING DEPARTMENT DOING
AND- DEFINITELY FURTHER
DISCUSSIONS COULD BE HELPFUL-
BACK AND FORTH QUESTIONS BUT
THAT'S OF A ONE POINT EASY
NUMBER THAT YOU CAN LOOK AT THE
TRACK OVER TIME AND COMPARE
ENTITIES TO EACH OTHER. AND WHAT
ABOUT- GETTING THE FULL I. SA-
TO GET THE WHOLE OF THE WHOLE
STORY. SO I THINK THE I A SAFE
THAT SINGLE SCORE IS HELPFUL FOR
COMPARING THAT THE FULL I. SA
WOULD DEFINITELY PROVIDE MORE
INFORMATION- THAT IF YOU GOT ALL
OF THE ISAY'S WE LOOKED AT
SCORES FOUR HUNDRED THIRTY FIVE
THAT IS A SIGNIFICANT AMOUNT OF
INFORMATION BUT THAT'S SOMETHING
THAT YOU FOUND HELPFUL. YEAH I
THINK IT PROVIDES A LOT OF
DETAILED INFORMATION. AND THEN
THE CSA'S RECOMMENDATIONS FOR
NOT REPORTING ENTITIES HAVE
CHANGED SINCE THE LAST A
PUBLISHED REPORT CAN YOU TALK
ABOUT WHY- YOU HAVE SWITCHED
OVER TO REPORTING TO THE
LEGISLATIVE. LEADERSHIP AS
OPPOSED TO REPORTING TO- POLICY
COMMITTEES WITH THE JURISDICTION. YEAH SO WE HAD IT ADICIONAL
DISCUSSIONS- A SWEEP I KNOW ONE
OF THE MAJOR CONCERNS WITH NON
REPORTING ENTITIES ARE
INDEPENDENCE IS THEIR
INDEPENDENCE- SO WE FIVE. THAT
REPORTING AT A HIGHER LEVEL AND
DEFINITELY THE LEGISLATIVE
LEADERSHIP COULD REFERRED THAT
DIRECTLY TO A POLICY COMMITTEE-
BUT WHEN WE THOUGHT THAT THAT
MIGHT- REPORTING A HIGHER LEVEL
MADE. WOULD MAYBE BE MORE
ACCEPTABLE TURN ON REPORTING
ENTITIES AND THEN IF THE
LEGISLATURE THINKS IT'S MOST
APPROPRIATE TO HAVE A COMMITTEE
LIKE THIS LOOK AT THAT
INFORMATION THEN THAT'D BE
DEFINITELY WITHIN THE SCOPE OF
THE LEGISLATURE'S ABILITY.
YOU'RE JUST TRYING SOMETHING
ELSE FIRST THEY DIDN'T LIKE CDT
AND THEN THEY DIDN'T LIKE THE
POLICY COMMITTEE SAYS THIS IS
THE THIRD THE THIRD TRY IS THAT
IT'S- WE NEVER RECOMMENDED
DIRECTLY TO CDT WE WOULD
DEFINITELY RECOMMEND THAT THE
LEGISLATURE UNDER WAS THAT SHIFT
FROM A SPECIFIC COMMITTEE. AND
IT ANOTHER CONCERN WITH THE
COMMITTEE WAS LAST TIME WE-
RECOMMEND IT- PRIVACY AND
CONSUMER PROTECTION COMMITTEE
AND I DON'T BELIEVE AT THAT TIME
THERE IS A QUICKLY SENATE.
COMMITTEE SO THEN THERE IS THE
CONCERN OF OUR WE ONLY GIVING
INFORMATION TO THE ASSEMBLY SO-
TECH DRESS THAT ALSO GOING AT A
HIGHER LEVEL AND THEN THEY CAN
DETERMINE THE APPROPRIATE
COMMITTEES TO DIG INTO THE
INFORMATION I KNOW YOU NEVER
RECOMMENDED CD T. BUT IT WAS ON
IN ONE OF THE EARLIER BILLS
THERE SO YEAH. YES OKAY WELL
THAT THAT'S A- MAY SENSE- CSA'S
RECOMMEND FOR NOT REPORTING
ENTITIES- CONTINUES TO HAVE A
THREE YEAR CYCLE FOR ISA'S EVEN
THOUGH BOTH ARE LOW RISK AND
HIGH RISK REPORTING ENTITIES
HAVE A TWO YEAR CYCLE UNDER CD
T. WIDE VARIANCE. SO DID THREE
YEARS WAS. WAS INTENDED TO BE A
LITTLE MORE COMPREHENSIVE THAN
THAN THE I SAY BECAUSE I SAY IS
HIGHLY TECHNICAL POINT TIME AND
WE- WE ENVISION THIS BEING A
MORE COMPREHENSIVE ALSO LOOK AT
POLICIES AND PROCEDURES AND
BASED ON. A REPORT IN TWENTY
NINETEEN WE LOOKED AT- THE
INCREMENTAL OF. THE PEOPLE OF
THE NUMBER FOR ENTITIES THAT
WERE DOING THEM HOW FREQUENTLY
WERE THEY DOING THEM WE LOOK FOR
GUIDANCE AND BEST PRACTICE AND
THAT'S HOW WE ENDED ON THE THREE
YEARS SO- TAKE TO HAVE THAT MORE
COMPREHENSIVE LOOK. IF IT'S
APPROPRIATE TO DO THAT MORE
TECHNICAL LOOK EVERY TWO YEARS
IS LIKE HEY I THINK THAT'S
APPROPRIATE BUT- WE GAVE A
LITTLE MORE TIME BECAUSE IT'S A
LITTLE MORE COMPREHENSIVE THAN
JUST THE MILITARY DEPARTMENT
ASSESSMENT. OKAY SO THE
RECOMMENDATION IS FOR AN AUDIT
AND I ESSAY EVERY THREE YEARS.
IT'S. WE SAY AN AUDIT OF
INFORMATION SECURITY- IN OUR
TWENTY NINETEEN REPORT WE TALK
ABOUT COMPREHENSIVE IN IN THAT
REPORT WE TALK ABOUT ENTITIES
WERE ONLY LOOKING AT PORTIONS OF
THEIR CONTROLS- IN THE TWENTY
NINETEEN REPORT WE ACTUALLY
VISITED SOME PLACES THAT ONLY
HAD THE MILITARY ASSESSMENT DONE
BUT THEY HAVEN'T EVALUATED OTHER
ASPECTS THAT THE MILITARY
DEPARTMENT HADN'T ADDRESSED SO
WE RECOMMENDED A MORE
COMPREHENSIVE AND THAT'S WHAT
WE'RE GETTING AT HERE- SO.
OBVIOUSLY THE NON REPORTING
ENTITIES ARE OUTSIDE THIS OTHER
FRAMEWORKS- SO THEY WOULD HAVE
DISCRETION ABOUT. DO THEY WANNA
BRING IN THE MILITARY
ASSESSMENTS AND SUPPLEMENT WITH
AN AUDIT DO THEY WANT TO HAVE
ANOTHER ENTITY WE DIDN'T SPECIFY
THAT KNOWING THE ISSUES WITH
INDEPENDENCE. OKAY AND THEN-
FINALLY THE AUDIT DOESN'T SEEM
TO INDICATE THAT- MILITARY
DEPARTMENT AS ANY DIFFICULTY AND
CONDUCTING I STAYS IN A TIMELY
FASHION. YEAH A NON REPORTING
ENTITIES COULD PER YOUR
RECOMMENDATION EVEN CONTRACT
WITH- THIRD PARTIES UNLIKE THE
DEFAULT FOR REPORTING ENTITIES.
YES YES. MAYBE THIS YEAR WILL BE
ARE ARE A LUCKY YEAR FIVE I
REALLY- I ALWAYS APPRECIATE THE
WORK THAT THE- AUDITOR DOES- IT
JUST GIVES INCREDIBLE INSIGHT
ESPECIALLY IN THIS AREA THAT SO
COMPLICATED EVERY TIME YOU COME
BACK AND GIVE US GREAT. IDEAS
FOR BILLS SO THANK YOU ARE RIGHT
AND WE ARE- WE ARE GOING TO MOVE
TO PUBLIC COMMENTS. AND
APPARENTLY THE NUMBER THAT I
GAVE BEFORE IS INCORRECT SO THAT
NUMBER IS. ONE EIGHT EIGHT
EIGHT. SIX NINE TWO. EIGHT NINE
FIVE SEVEN. AND THEN THE ACCESS
CODE IS. ONE THREE ONE FIVE ONE
TWO SIX AND I WOULD LIKE TO
REMIND YOU TO IDENTIFY YOURSELF
BY NAME AFFILIATION ANSWER
PLEASE KEEP YOUR COMMENTS BRIEF
SO DO WE HAVE ANYBODY ONLINE. AT
LEAST YOU DON'T SHE WOULD LIKE
TO MAKE A COMMENT PLEASE PRESS
ONE AND THEN ZERO AT THIS TIME
AGAINST. ONE ZERO. CURRENTLY NO
PARTY'S QUEUING UP. OKAY WELL A
AGAIN THANK YOU GENTLEMEN AND OF
ALL FOUR OF YOU- THAT THIS WAS
VERY INSIGHTFUL AND HOPEFULLY IN
A FEW YEARS SHE'LL COME BACK AND
DO THIS AGAIN AND THE REPORT
WILL BE. IMPROVED WE CAN YOU
KNOW I KNOW THEY HAVE HAD
TREMENDOUS IMPROVEMENTS AS- IN
THE DEPARTMENT OF TECHNOLOGY
WE'VE YOU KNOW CONSIDERING THE
SITUATION WE WERE BACK IN TWENTY
THIRTEEN AND IN SPITE OF THIS
REPORT I DON'T THINK THAT'S A
GOOD- EVEN WITH THIS REPORT I
DON'T THINK THAT WE SHOULD
NEGATE. EVERYTHING THAT THEY
HAVE DONE THAT TO REALLY BRING
UP- THE CYBERSECURITY MATURITY.
IN THE STATE OF CALIFORNIA
BECAUSE IF YOU REMEMBER BACK
THEN IT WAS NOT A PRETTY
PICTURE. SO BUT WITH THAT
THERE'S A LOT OF WORK TO BE DONE
AND WE APPRECIATE SAID- ALL THE
WORK YOU'VE DONE TO. HELP POINT
THAT OUT. THANK YOU SO MUCH
THANK YOU THINK WITH THAT WE
WILL. ADJOURN.