READY WAS VERY INTERESTED IN
THIS SUBJECT, AND WE WERE GOING
TO HAVE AN OVERFLOWING CROWD.
BUT APPARENTLY NOT. NO WE DIDN'T
WANT EVERYBODY TO HAVE TO WALK.
WELL, I DIDN'T WANNA HAVE TO
WALK ACROSS TO THE SWING SPACE.
SO, UM BUT WELCOME TO TODAY'S
INFORMATIONAL HEARING ON
CALIFORNIA'S CYBER SECURITY PLAN
FOR THE STATE AND LOCAL
CYBERSECURITY GRANT PROGRAM. I
WANT TO REMIND EVERYBODY THAT
TESTIMONY AND PUBLIC COMMENT
MUST BE IN PERSON. UH THIS
HEARING WILL BE LIVE STREAMED ON
THE ASSEMBLY WEBSITE AND THE
RECORDING WILL BE POSTED ONLINE.
I KNOW THAT, UH, COMMITTEE
MEMBERS WERE NOT ABLE TO JOIN US
, BUT SOME OF THEM WILL BE
WATCHING ONLINE AND WE KNOW
OTHER STAKEHOLDERS WILL BE
WATCHING ALSO. UM I WOULD LIKE
TO START BY THANKING THE
PANELISTS THAT ARE JOINING US
TODAY AS WE EXAMINE CALIFORNIA'S
WORK TO EXPAND OUR CYBERSECURITY
EFFORTS WITH LOCAL GOVERNMENTS
AND IMPORTANTLY, LEVERAGE
FEDERAL DOLLARS IN THIS CRITICAL
AREA. THIS HEARING WILL BE AN
OPPORTUNITY FOR THE PUBLIC TO
DEVELOP A DEEPER UNDERSTANDING
OF THE RECENTLY SUBMITTED
CALIFORNIA CYBER SECURITY PLAN,
WHICH WAS A REQUIREMENT OF THE
STATE AND LOCAL LOCAL
CYBERSECURITY GRANT PROGRAM, A
PROGRAM CREATED BY THE FEDERAL
INFRASTRUCTURE INVESTMENT AND
JOBS ACT. THIS PLANNING EFFORT
ENVISIONED COLLABORATION BETWEEN
THE STATE AND LOCAL LEADERS. TO
PRIORITIZE EFFORTS WITHIN THE
GENERAL CATEGORIES TO ENHANCE
OUR COLLECTIVE CYBERSECURITY.
ALL WHILE UNDERSTANDING OUR
STATE HAS A WIDE RANGE OF CYBER
MATURITY, UH, WHEN ENCOMPASSING
EVERY COUNTY CITY SPECIAL
DISTRICT SCHOOL DISTRICT AND
OTHER FORMS OF LOCAL GOVERNMENT
ONE OF THE CONSTANT CHALLENGES I
HAVE FACED CHAIRING THIS
COMMITTEE IN THE PAST NINE YEARS
IS RARELY DO CYBERSECURITY.
PREVENTIVE PREVENTATIVE MEASURES
, GET THE ATTENTION OR
INVESTMENT THAT THEY DESERVE.
WHEN I HEARD ABOUT THIS GRANT
PROGRAM BEING INCLUDED IN THE
BIPARTISAN INFRASTRUCTURE, UH,
ACT. I WAS SURPRISED, BUT ALSO
RELIEVED THAT OUR PARTNERS IN
CONGRESS ARE FINALLY PUTTING
SOME INVESTMENT IN FOCUS ON THE
CYBER SECURITY OF OUR LOCAL
GOVERNMENTS. AS A FOUR FORMER
MAYOR AND COUNCIL MEMBER. I
UNDERSTAND HOW CRITICAL IT IS
FOR LOCAL GOVERNMENTS TO REMAIN
AVAILABLE AND RELIABLE TO OUR
CONSTITUENTS. UM THAT THEY SERVE
ON A DAY TO DAY BASIS. IN MANY
RESPECTS THE CYBER SECURITY OF
OUR LOCAL GOVERNMENTS, INCLUDING
THE SPECIAL DISTRICTS, WHO
PROVIDE MANY CRITICAL SERVICES
ARE MORE FUNDAMENTAL. TO THE
DAILY LIVES OF CALIFORNIANS AND
THE OPERATIONS OF SOME STATE AND
FEDERAL AGENCIES. I LOOK FORWARD
TO HEARING FROM OUR PANELISTS
TODAY AND LOOK AND LEARNING HOW
THE LEGISLATURE CAN ENSURE THE
SUCCESS OF CALIFORNIA'S
PARTICIPATION IN THIS GRANT
PROGRAM. AH! UH, WITH THAT I
WOULD LIKE TO CALL UP THE FIRST
PANEL. AND, UH, WE WILL. I'LL
ASK SOME QUESTIONS AFTER SO YOU
KNOW WHO YOU ARE, UH, ALMOND,
VITALY. GOOD MORNING AND THANK
YOU. UM OUR FIRST TWO WITNESSES
ARE TOM OSBORNE, THE DEPUTY
DIRECTOR FOR HOMELAND SECURITY.
UM DIRECTORATE FROM THE
GOVERNOR'S OFFICE OF EMERGENCY
SERVICES AND VINOLY PANACHE.
THIS STATE CHIEF INFORMATION
SECURITY OFFICER FROM THE
CALIFORNIA DEPARTMENT OF
TECHNOLOGY. WHO MAY BEGIN. WHEN
YOU ARE READY. THANK YOU. GOOD
MORNING, AND, UM HEROIN AND
MEMBERS OF THE COMMITTEE. MY
NAME IS TOM OSBORNE. I AM A
DEPUTY DIRECTOR AT THE
GOVERNOR'S OFFICE OF EMERGENCY
SERVICES WHERE I OVERSEE OUR
HOMELAND SECURITY DIRECTORATE IN
CALIFORNIA. CALAVIUS HAS
IDENTIFIED AS THE STATE ENTITY
FOR HOMELAND SECURITY AND THE
DIRECTOR OF COLONIA SERVES AS
THE GOVERNOR'S HOMELAND SECURITY
ADVISER. HELLO YES, IS CHARGED
WITH MITIGATING THE EFFECTS OF
DISASTERS AND PROTECTING THE
LIVES AND PROPERTIES OF
CALIFORNIANS AND SUPPORTING OUR
COMMUNITIES IN EFFORT TO BE
RESILIENT. IN AN ENDEAVOR TO
ACHIEVE RESILIENCY. WE PROMOTE
SAFE AND PREPARED COMMUNITIES
WITH STRENGTH TO WITHSTAND OR
REBOUND FROM ANY EVENT OR
EMERGENCY, INCLUDING CYBER
ATTACKS. ONE SUCH AVENUE OF
RESPONSIBILITY IS THROUGH THE
COORDINATION OF FEDERAL GRANTS,
WHICH INCLUDES THE ONE WE ARE
HERE TODAY TO DISCUSS A LITTLE
BIT OF BACKGROUND, THE
CALIFORNIA CYBERSECURITY
INTEGRATION CENTER OR THE CAL
SICK IS LOCATED WITHIN CALLOWAY
AS HIS HOMELAND SECURITY
DIRECTORATE AND THE MISSION OF
THE CAL. SICK AND ASSOCIATED
DUTIES INCLUDE CERTAINLY REDUCE
THE LIKELIHOOD AND SEVERITY OF
CYBER INSTANCE THAT COULD DAMAGE
CALIFORNIA'S ECONOMY. IT'S
CRITICAL INFRASTRUCTURE OR
PUBLIC AND PRIVATE SECTOR
COMPUTER NETWORKS. THE CAL SIX
SERVES AS THE CENTRAL
COORDINATING HUB. OF STATE
GOVERNMENT CYBERSECURITY
ACTIVITIES AND COORDINATES
INFORMATION SHARING WITH LOCAL,
STATE AND FEDERAL AGENCIES,
TRIBAL GOVERNMENTS, UTILITIES
AND OTHER SERVICE PROVIDERS,
ACADEMIC INSTITUTIONS AND NON
GOVERNMENT ORGANIZATIONS.
CALCIUM IS ALSO CHARGED WITH
DEVELOPMENT OF A CYBERSECURITY
STRATEGY WITH RECOMMENDATIONS
RECEIVED FROM CALIFORNIA TASK
FORCE AND CYBERSECURITY,
STRENGTHENING CALIFORNIA'S
EMERGENCY PREPAREDNESS AND
RESPONSE. A LITTLE BIT OF
BACKGROUND ON THIS GRANT, AS
REFERRED TO EARLIER CALLOW YES,
AND MINISTERS. MANY FEDERAL
GRANTS FOR THE STATE OF
CALIFORNIA INCLUDING THE ONE
WE'RE HERE TO TALK ABOUT TODAY,
BUT BEFORE I GET INTO WHERE WE
ARE AT NOW, AND OUR NEXT STEPS
LIKE TO PROVIDE A LITTLE
BACKGROUND IN PARTICULAR ON THIS
ON THIS FEDERAL GRANT IN
SEPTEMBER, 2022 DEPARTMENT OF
HOMELAND SECURITY, THE FEDERAL
DEPARTMENT OF HOMELAND SECURITY
ESTABLISHED THE STATE AND LOCAL
CYBERSECURITY GRANT PROGRAM VIA
THE INFRASTRUCTURE. INVESTMENT
IN JOBS. ACCESS REFERRED TO A
LITTLE BIT EARLIER OF 2021, ALSO
KNOWN AS THE BIPARTISAN
INFRASTRUCTURE LAW, FURTHER
REFERRED TO IN MY TESTIMONY AS I
GO FORWARD AS A CYBER GRANT
PROGRAM OR GRANT PROGRAM.
THROUGH THIS BILL. CONGRESS SET
ASIDE 1 BILLION TO BE AWARDED
OVER A PERIOD OF FOUR YEARS TO
QUALIFYING APPLICANTS NATIONWIDE
TO SUPPORT PROJECTS THROUGHOUT
THE PERIOD OF PERFORMANCE. THESE
FUNDS ARE DEDICATED FOR THE
PURPOSE OF REDUCING
CYBERSECURITY RISKS AND THREATS
TO STATE, LOCAL AND TERRITORIAL
GOVERNMENTS, INFORMATION
SYSTEMS. FEMA'S NOTICE A FUNDING
OPPORTUNITY OR NO PHONE AS IT'S
REFERRED TO OR THIS GRANT AND
THE GRANT REQUIREMENTS ARE
DETAILED ON GRANTS DOT GOV. THE
NO. FOUR REQUIRES ALLOCATION OF
FUNDS, ACCORDING TO A
CYBERSECURITY PLAN DEVELOPED BY
A CYBERSECURITY PLANNING
COMMITTEE. ALL 36 STATES AND
TERRITORIES ARE ELIGIBLE
RECIPIENTS, BUT ONLY ONE
ELIGIBLE ENTITY MAY APPLY FOR
THIS GRANT. SUB RECIPIENTS
RECEIVE FUNDING THROUGH THE
STATE ADMINISTRATIVE AGENCY HERE
IN CALIFORNIA THAT IS CAL O ES.
SUB RECIPIENTS ARE STATE
AGENCIES, LOCAL GOVERNMENTS AND
TRIBAL GOVERNMENT TO PUT IT IN
PERSPECTIVE. THE SCOPE OF THIS
GRANT TO CALIFORNIA INCLUDES 482
CITIES, 58 COUNTIES,
APPROXIMATELY 3400 SPECIAL
DISTRICTS 1800 JOINT POWER
AUTHORITIES ALMOST 1000 SCHOOL
DISTRICTS, 110 TRIBAL
GOVERNMENTS. AND OVER 140 STATE
ENTITIES IS THE UNIVERSE FOR
WHICH WERE ATTEMPTING TO ASSIST
ALL STATES AND TERRITORIES WILL
RECEIVE FUNDS DETERMINED BY A
STATUTORY FORMULA OF THE MONEY
RECEIVED BY CALIFORNIA 80% MUST
BE PASSED THROUGH DIRECTLY OR
VIA IN KIND SERVICES TO LOCAL
GOVERNMENTS. IN ADDITION, 25% OF
THAT PASTOR AMOUNT MUST GO TO
RURAL AREAS. AWARD RECIPIENTS
MAY USE FUNDS IN THE AREAS OF
CYBERSECURITY PLANNING,
EQUIPMENT, EXERCISES, MANAGEMENT
AND ADMINISTRATION ORGANIZATION
AND TRAINING. ALSO AS A PART OF
THIS GRAND, THERE'S A COST SHARE
REQUIREMENT. UM THE CYBER GRANT
HAS A PREDETERMINED PERCENTAGE
OF COSTLY REQUIREMENTS FOR THE
RECIPIENTS FOR THE FY 22 AWARD.
CALAVIUS SUBMITTED A 10% COST
SHARE WAIVER REQUEST TO FEMA FOR
WHICH IT WAS SUBSEQUENTLY
APPROVED. FUTURE COST SHARING
REQUIREMENTS FOR FY 23 IS 20%
30% FOR FY, 24 AND 40% FOR FY 25
. ADDITIONALLY RECIPIENTS MUST
USE NON FEDERAL FUNDS FOR THEIR
RESPECTIVE COST SHARE
REQUIREMENTS. SO KIND OF WHAT
WE'VE DONE AS FAR AS THAT. OH
YES, AND WITH OUR PARTNERS TO
MOVE THIS BALL FORWARD, CALCITE
HAS FORMED A SUBCOMMITTEE OF THE
CALIFORNIA CYBER SECURITY TASK
FORCE CALLED THE CYBERSECURITY
INVESTMENT PLANNING COMMITTEE.
FURTHER IN MY TESTIMONY, I REFER
TO THAT AS THE SUBCOMMITTEE FOR
THE PURPOSE OF CREATING THE
PLAN, AS REQUIRED BY THE GRANT.
THE SUBCOMMITTEE IS A
REQUIREMENT OF THE GRANT, AS I
JUST MENTIONED IN HIS VITAL TO
ESTABLISH A REPRESENTATION OF
OUR LOCAL GOVERNMENTS, AS
MENTIONED PREVIOUSLY 80% OF THE
GRANT MUST BE IS INTENDED TO
PASS THROUGH TO THE LOCALS WITH
25 OF THAT PERCENT OF THAT GOING
TO RURAL POPULATIONS. CURRENTLY
THERE ARE OVER 560 MEMBERS ON
OUR SUBCOMMITTEE, AND IT HAS
SENT OUT REGULAR ANNOUNCEMENTS.
VIA UPDATES VIA EMAIL
DISTRIBUTION, AND IS ALSO HELD
TWO INFORMAL SESSIONS IN MAY OF
2023. ON DECEMBER 27TH OF 2022,
CALIFORNIA WAS SUCCESSFULLY
AWARDED 7,976,000. FOR THE CYBER
GRANT. FIRST YEAR FUNDING. SO FY
22 WITH CALA ES ACCEPTING THE
AWARD ON JANUARY 23RD 2023 AS
PART OF THE NO FOE. THE CYBER
GRANT REQUIRES 16 ELEMENTS TO BE
INCLUDED IN THE SUBMITTED CYBER
SECURITY PLAN. THESE 16
REQUIREMENTS REQUIRED ELEMENTS
FORM THE GUIDELINES TO IMPROVE
CYBERSECURITY AND MUST BE
ADDRESSED IN THE PLAN, BUT ARE
NOT CONDITIONS FOR FUNDING.
FURTHERMORE THE CYBER GRANT
REQUIRED A CAPABILITY GAP SURVEY
OF THE 16 REQUIRED ELEMENTS TO
BE COMPLETED AS SUCH. OUR
CAPABILITY GAP SURVEY WAS
COMPLETED IN MAY OF 2023. THE
ANALYSIS WAS COMPLETED IN JULY
OF 2023 AND THEN MOST RECENTLY
PREFERRED SERVICES SURVEY WAS
SENT OUT IN SEPTEMBER OF 2023.
OUR CHIEF INFORMATION SECURITY
OFFICER, MY PARTNER IN CRIME,
BUT TALLY PANITCH WILL ALSO
PROVIDE THE RESULTS OF THIS
SURVEY SHORTLY. AS MENTIONED.
THE SURVEY IS A GRANT MANDATE TO
COMPREHENSIVE MATURITY AND
CAPABILITY. GAP OF THE 16
REQUIRED AMOUNT ELEMENTS AS PART
OF THE PLANNING PROCESS. THIS
SURVEY AND ASSESSMENT PROVIDES A
GREATER UNDERSTANDING OF THE
EXISTING VULNERABILITIES AND
AREAS THAT NEED IMPROVEMENT
ACROSS OUR STATE. OVER 121
ORGANIZATIONS COMPLETED THE
SURVEY. ALL REQUIRED SECTORS
PARTICIPATED, REPRESENTING ALL
POTENTIAL SUB RECIPIENT GROUPS.
COUNTY CITY SPECIAL DISTRICTS,
TRIBAL GOVERNMENTS AND STATE
GOVERNMENT. ON AUGUST 7TH OF
2023 FEMA ANNOUNCED 15,879,004.
$197 IN FY 23 FUNDING FOR THE
STATE OF CALIFORNIA. THE
REQUIRED CYBERSECURITY PLAN WAS
COMPLETED BEFORE THE SEPTEMBER
30TH DEADLINE. SEPTEMBER 30TH
2023 DUE DATE AND WAS
SUBSEQUENTLY APPROVED BY DHS
CISA. LAST MONTH. HELLO YES,
APPLIED FOR THE FY 23 PORTION OF
THE CYBER GRANT BY THE DUE DATE,
WHICH OF OCTOBER 6TH 2023 ON
TIME. WITH THAT I'D LIKE TO
TRANSITION OVER TO THE TALLY
PANICKED OUR STATE'S INFORMATION
SECURITY OFFICER TO TALK A
LITTLE BIT MORE IN DEPTH ABOUT
THE SURVEY SOME OF THE
REQUIREMENTS THE TALLY OVER TO
THANK YOU. GOOD MORNING, MADAM
CHAIR. MY NAME IS VITALI PANIC.
I AM THE STATE CHIEF INFORMATION
SECURITY OFFICER WITH THE
CALIFORNIA DEPARTMENT OF
TECHNOLOGY. THANK YOU FOR THE
OPPORTUNITY TO SPEAK BEFORE YOU
GUYS TODAY I SERVE AS THE SENIOR
ADVISOR FOR THE SLC G P PLANNING
COMMITTEE, THE STATE LOCAL
CYBERSECURITY GRANT PROGRAM. AND
A PARTNER WITHIN THE CELTIC.
TODAY ARE AT THIS POINT. I
WANTED TO TAKE A DEEPER DIVE
INTO THE ORGANIZATION AND
COMPOSITION OF THE GRANT
PLANNING COMMITTEE. IT'S
IMPORTANT TO REPRESENT THE
MAXIMUM AMOUNT OF NEEDS
POSSIBLE. THE STATUTORY REQUIRED
METHODOLOGY TO SELECT THE PARADE
PRIORITIZED PROJECTS THAT
FULFILL THEIR REQUIRED ELEMENTS
WITHIN THE GROUND. THE EMPHASIS
ON THE PRIORITIZED PROJECTS
SELECTED AS IN KIND SERVICES
PROVIDED BY THE STATE VERSUS
DISTRIBUTING ENTIRELY BY DIRECT
FUNDS. IN OTHER WORDS, ARE
HYBRID APPROACH. ENTITIES WILL
GET TO CHOOSE AN OPTION. SO
GIVEN THE SHEER SCALE OF
CALIFORNIA ENCOMPASSING ALMOST A
TOTAL OF 7000 MAXIMUM
ORGANIZATIONS BETWEEN THE
ENTITIES PREVIOUSLY OUTLINED BY
MR OSBORNE. THE STATE HAS
EXECUTED ON A SPECIFIC APPROACH
TO MEET THE FEDERAL ELIGIBILITY
REQUIREMENTS OF THE GRANT AND
ALSO EFFECTIVELY ADDRESS CYBER
RISK REDUCTION NEEDS FOR OUR SUB
GRANTEES. THAT'S FACILITATED BY
OUR OUTREACH. THIS GRANT WILL
NOT ONLY ADDRESS THE MOST URGENT
DEFICIENCIES OR THE
BENEFICIARIES, BUT IT'S A
SIGNIFICANT STEP TOWARDS HELPING
MANY ORGANIZATIONS ESTABLISHED
BASIC FUNDAMENTAL CYBERSECURITY
PRACTICES. OUR GOAL HERE IS TO
LEVERAGE THIS LIMITED AMOUNT OF
FUNDING OPPORTUNITY TO FOCUS ON
THE MOST UNDERFUNDED AND
CONSTRAINT ORGANIZATIONS.
ESPECIALLY AT THE LOCAL LEVELS
AND LEVERAGE THE STATE'S BUYING
POWER. THE MAXIMIZE THESE
DOLLARS TO GO FURTHER THAN
INDIVIDUAL JURISDICTIONS CAN DO
ON THEIR OWN. THERE'S THE
REQUIRED PLANNING COMMITTEE WAS
ESTABLISHED IN TWO PARTS. AN
EXECUTIVE COMMITTEE WAS
ESTABLISHED TO SERVE AS
SIGNATORIES ON THE CHARTER AND
FORMALLY APPROVED THE PLAN. THIS
EXECUTIVE COMMITTEE CONSISTS OF
THE OFFICE OF EMERGENCY SERVICES
AS THE STATE'S ADMINISTRATIVE
AGENCY. THE S A WITHIN THE OS
GRANTS UNIT AND THE CAL SIX,
SERVING AS PRINCIPAL ADVISORS.
THE STATE CHIEF INFORMATION
OFFICER ALONG WITH THE STATE C.
I S O, WHICH IS MYSELF. SERVING
AS THE PRINCIPAL ADVISOR. AS
WELL AS THE ACTING COMMITTEE OR
ACTING COMMANDER OF THE CELTIC,
ALONG WITH REPRESENTATIVES FROM
THE CALIFORNIA STATE ASSOCIATION
OF COUNTIES. COALITION OF
CALIFORNIA URBAN AREA SECURITY
INITIATIVES. LEAGUE OF
CALIFORNIA CITIES CALIFORNIA
DEPARTMENT OF EDUCATION. LOCAL
PUBLIC SCHOOL DISTRICT
REPRESENTATIVES, THE CALIFORNIA
HEALTH AND HUMAN SERVICES
AGENCY. AND FINALLY, THE RURAL
KANYE REPRESENTATIVES OF
CALIFORNIA. SECOND A CYBER
SECURITY TASK FORCE SUBCOMMITTEE
WAS ESTABLISHED TO DEVELOP THE
CYBERSECURITY PLAN THROUGH
PARTICIPATION IN MULTIPLE
WORKING GROUPS, AS WELL AS
SURVEYS AND INFORMATION SESSIONS
AS MENTIONED PREVIOUSLY BEFORE
ME. THE BROADER THIS BROADER
GROUP OF SEVERAL 100 INDIVIDUALS
REPRESENT INCLUDED
REPRESENTATIVES FROM THE
FOLLOWING MUNICIPAL INFORMATION
SYSTEMS ASSOCIATION OF
CALIFORNIA, CALIFORNIA COUNTY
INFORMATION SERVICES DIRECTORS
ASSOCIATION, CALIFORNIA SPECIAL
DISTRICT ASSOCIATION. TRIBAL
GOVERNMENT REPRESENTATIVES AND
NUMEROUS I T CYBERSECURITY AND
GRANTS MANAGEMENT PROFESSIONALS
FROM CITY COUNTY SPECIAL
DISTRICT AND JOINT POWERS
AUTHORITIES. THIS COMMITTEE ALSO
ESTABLISHED FOR WORKING GROUPS.
THAT FOCUSED ON PROGRAM
OBJECTIVES OUTLINED WITHIN THE
PLAN. THESE WORKING GROUPS
DEVELOPED THE METHODOLOGY TO
ASSESS TO DO THINGS. REALLY THE
MATURITY AND KEEP IT AND
IDENTIFY GAPS FOR THE FOR THESE
FUTURE BENEFICIARIES OF THIS
PROGRAM. THEN THIS GROUP MAP THE
MATURITY PLUS THE CAPABILITY
SCORES THAT WERE ASSESSED. TO
THE 16 CATEGORIES. THIS PROGRAM
IS REQUIRED TO ADDRESS OVER
TIME. THERE ARE 16 REQUIRED
ELEMENTS FOR THE CYBER SECURITY
PLAN. THESE ELEMENTS FORM
GUIDELINES TO IMPROVE
CYBERSECURITY CAPABILITIES AND
MUST BE ADDRESSED IN THE PLAN
BUT ARE NOT CONDITIONS FOR FINAL
FUNDING OUTCOMES. THE PROGRAM
EXPECTS STATES TO PRIORITIZE THE
ELEMENTS BASED ON CAPABILITY
GAPS. AND THAT NOT ALL ELEMENTS
ARE REQUIRED TO BE ALIGNED TO
THE PROPOSED PROJECTS OR FUN OR
PROJECTS TO BE FUNDED. THESE
ELEMENTS ARE SUBJECT TO OR THE
THESE ELEMENTS ARE THE SUBJECT
OF THE CAPABILITY GAP SURVEY
INSTITUTED BY OUR WORKING
GROUPS. THIS CAPABILITY. GAP
SURVEY COMPLETED IN MAY 23
ANALYSIS WAS COMPLETED IN JULY
OF 23 AND THE PRIORITIZE
PREFERRED SERVICES SURVEY WAS
COMPLETED IN SEPTEMBER. THE
SURVEY AND INFORMATIONAL
MEETINGS WITH THE WORKING GROUPS
EVALUATED MATURITY LEVELS AND
CAPABILITY, GAPS STRUCTURED TO
ALIGN WITH THESE DIRECT 16
REQUIRED ELEMENTS OF THE CYBER
SECURITY PLAN. ENSURING THAT.
PROVIDES INSIGHTS DIRECTLY
RELEVANT TO GRANT RECIPIENTS
CYBERSECURITY NEEDS. SO THE
MATURITY SCORES. FOCUS TO
PRIORITIZE THE WEAKER OF THE
SCALE FOCUSING ON FUNDAMENTAL
AND FOUNDATIONAL LEVELS OF
MATURITY. WITH COMBINED GAPS
ACROSS. AND CROSS REFERENCE TO
THE 16 ELEMENTS, AND THOSE ARE
DEPICTED IN RED IN OUR CYBER
SECURITY PLAN. THIS IDENTIFIED
TOP CAPABILITY GAPS TO ENABLE
TARGETED INVESTMENTS IN AREAS
WHERE THEY'RE NEEDED THE MOST
FAVORING THE SMALLER AND RURAL
JURISDICTIONS. SO CAPABILITY
GAPS ARE DEPICTED IN GREEN
WITHIN APPENDIX, A OF THE CYBER
SECURITY GRANT PROGRAM. UM.
COMBINED RESULTS WERE ALSO CROSS
REFERENCE TO SERVICES THAT THE
CELTIC AND THE C D. T CAN
REALISTICALLY AND COST
EFFECTIVELY PROVIDE IN THE NEAR
TERM. AS A RESULT, THE
PRIORITIZED AREAS THAT THE STATE
PROVIDES US IN KIND SERVICES.
OUR DARK WEB MONITORING,
FACILITATED AND OPERATIONALIZED
BY THE CAL SICK. THREAT
INTELLIGENCE SUBSCRIPTIONS TO
INCLUDE INTELLIGENCE PRODUCTS,
SUBSCRIPTIONS, MONTHLY CYBER
THREAT BRIEFINGS AND MORE
MORNING REPORTS. THEN SECURITY
EVENT INFORMATION, SECURITY
INFORMATION AND EVENT MANAGEMENT
. NISSIM CAPABILITY PROVIDED BY
THE C D T FOR THE PURPOSES OF
LOG MANAGEMENT. AND THEN ALSO WE
HAVE THE SECURITY OPERATIONS
CENTER CAPABILITY, WHICH
PROVIDES CONTINUOUS MONITORING,
DETECTION AND ALERTING VIA THE
STATE SECURITY OPERATIONS AS A
SERVICE OFFERING. SO IT REALLY
PROVIDES THE PERSONNEL AND THE
PROCESSES AND THE CAPABILITY TO
HAVE EYES ON GLASS AND LOOK FOR
ACTIVITY WITHIN, UM SUB GRANTEES
NETWORKS AND ACT ON IT. MOST
IMPORTANTLY, AND THEN, LASTLY
VIRTUAL SISSOKO ADVISORY
SERVICES TO PROVIDE SECURITY
PERSONNEL AND AUGMENT SECURITY
PERSONNEL. REALLY TO AIM THAT
BUILDING RISK MANAGEMENT
PROGRAMS FOR THE POTENTIAL SUB
GRANTEES IN THIS PARTICULAR
PROGRAM HAS BEEN HIGHLY
SUCCESSFUL WITHIN OUR STATE
AGENCIES AND IN ORDER TO REALLY
HELP THE STATE AGENCIES MATURE
THEIR THEIR CYBER SECURITY
RESILIENCE SCORES. SO SOME OF
THESE PROGRAMS WERE LOOKING AT
POTENTIALLY SCALING OUT IF THEY
ARE IN DEMAND, UM AND PROVIDING
THAT TO THE SUB GRANTEES. THE
COMMITTEES WERE ALSO SURVEYED ON
WHICH FUNDING MODELS WOULD BE
MOST PREFERRED. WHICH ARE STATE
GOVERNMENT PROVIDED IN KIND
SERVICES. IN LIEU OF CASH. THEN
DIRECT CASH OR HYBRID, IN OTHER
WORDS, AN OPTION TO CHOOSE THE
RESULTS. OF THAT QUESTION
INDICATED A HYBRID APPROACH WAS
PREFERRED. WITH OVER 24%
REFERRING THE IN KIND SERVICES
ARE OUT FOR SERVICES THAT THE
STATE PROVIDES. 23% PREFERRED TO
RECEIVE DIRECT CASH TO AUGMENT
THEIR INTERNAL EFFORTS OR
PROJECT FALLING WITHIN THE 16
CATEGORIES. AND THEN LASTLY, 44%
PREFERRED TO RETAIN AN OPTION TO
SELECT THE COMBINATION OF
SERVICES OR CASH. WITH THE
POSSIBILITY OF LEVERAGING THE
STATE'S BUYING POWER FOR
NECESSARY CONTRACTS. WHILE THESE
EFFORTS INVOLVED MANY HOURS AND
MANY PARTICIPANTS THEY WERE
NECESSARY TO GAUGE THE ACTUAL
NEEDS AND GAPS OF OUR
REPRESENTATIVE GRANT
BENEFICIARIES. AT THIS POINT IN
TIME, THE CURRENT IN THE CURRENT
FISCAL YEAR OR IN FISCAL YEAR,
22. STATEWIDE FUNDING FOR
CALIFORNIA HAS BEEN AWARDED AND
IN FY 23 FUNDING IS CURRENTLY
BEING ALLOCATED WHILE WE WORK
TOWARDS FINAL AND FORMAL AWARDS.
TO OUR LOCALS. THE NEXT STEP IS
REALLY TO INTAKE. SUB GRANTEE
APPLICATIONS REVIEW PRIORITIZE.
AND REALLY FIGURE OUT WHAT THEIR
NEEDS ARE AT THE LOCAL LEVEL SO
THAT WE COULD SUPPORT THEM WITH
THE APPROPRIATE FUND FUNDING
MODEL AND OR THE APPROPRIATE
SERVICE. BUT BEFORE WE GET
THERE, OBVIOUSLY, OUR EFFORTS
WILL ALSO BE FOCUSED ON OUTREACH
AND ADVERTISING AND REALLY
GETTING THE WORD OUT THAT THIS
GRANT OPPORTUNITIES OUT THERE
AND WE NEED AS MANY APPLICANTS
AS WE CAN SO WE COULD INITIATE
OUR PRIORITIZATION EFFORTS. AND
THROUGHOUT THE YEAR WE CERTAINLY
HAVE BEEN CONDUCTING OUTREACH
THROUGH OUR PARTNERS MENTIONED
BEFORE, UM, AS WELL AS ATTENDING
THEIR THEIR EVENTS, THEIR
CONFERENCES, SETTING UP
EXHIBITION BOOTS TO REALLY
MARKET WHAT THE STATE DOES AND
WHAT THE STATE CAN PROVIDE, SO
THAT WE CAN ULTIMATELY BENEFIT
THE GREATER GOOD OF THE OF THE
COMMUNITY AND SERVE THOSE THAT
ACTUALLY NEED NEED OUR HELP. SO
WITH THAT, THANK YOU FOR THE
OPPORTUNITY TO SPEAK TO YOU GUYS
TODAY. I LOOK FORWARD TO
ANSWERING ANY QUESTIONS AND I
WILL TURN IT OVER BACK TO MR
OSBORNE FOR ANY FINAL REMARKS.
THANK YOU FOR TALLY JUST A
COUPLE OF THINGS TO WRAP UP SO
KIND OF WHERE WE'RE AT RIGHT NOW
AND WHERE WE'RE GOING TO TALLY
MENTIONED IT, BUT RIGHT NOW THAT
THE CYBERSECURITY PLAN HAS BEEN
IMPROVED CALLOWAY AS AND OUR CAL
SIX CYBER GRANT PROJECT
MANAGEMENT TEAM IS WORKING WITH
VARIOUS DIVISIONS WITHIN
CALAVIUS SPECIFICALLY ARE GRANTS
DIVISION, WHICH ARE EXPERTS IN
THE ADMINISTRATION OF FEDERAL
GRANTS AND THE DEPARTMENT OF
TECHNOLOGY TO ESTABLISH A GRANT
APPLICATION PROCESS WHERE THE
SUB RECIPIENTS, ACCORDING TO THE
PLAN. THIS INCLUDES A PRICE
DETERMINATION OF SERVICE COSTS.
YOU KNOW WHAT IS THAT IN KIND
COSTS ACTUALLY COST THE STATE OF
CALIFORNIA AND THEN TRANSLATE
THAT BECAUSE WE ONLY YOU KNOW,
FOR THIS FIRST YEAR WE ONLY HAVE
$7.9 MILLION SO SPREAD ACROSS
ALL THOSE JURISDICTIONS AND THE
LIKE. IT'S NOT A WHOLE LOT OF
MONEY, APPRECIATIVE OF THE
DOLLARS, BUT IT'S OUR FIRST
STEP. UM AND DETERMINING OUR
SERVICE ENROLLMENT PROCESS AND
FORMS A REQUEST FOR PROPOSAL
PROCESS FOR CASH REQUEST
REFINED, APPROVED CRITERIA. FOR
OUR SUB RECIPIENTS AND VARIOUS
OTHER DEPENDENCIES THAT ARE
REQUIRED TO IMPLEMENT THE
CYBERSECURITY PLAN, SO NEXT
STEPS AS A SUB RECIPIENT GRANT
APPLICATION IS ESTABLISHED.
CALLOWAY YES, WILL ANNOUNCE THE
APPLICATION WINDOW THROUGH OUR
PARTNERS AS VITALITY WILL GO FAR
AND WIDE IN OUR ADVERTISEMENT OF
WHEN THIS APPLICATION WINDOW IS
OPEN AND HOW TO APPLY THROUGH
THE WEBSITE OR PORTAL. MANY
DIFFERENT AREAS THAT WE ARE
GOING TO DO. THOSE ARE ALL
CURRENTLY UNDER WORKS. CALLOWAY
S AND C T WILL PERFORM OUTREACH
AS I MENTIONED TO ENSURE ALL SUB
RECIPIENTS CLEAN THOSE WHO ARE
NOT CURRENTLY AWARE OF THE
PROGRAM THAT WE REACH THEM AS
WELL. WE THINK WE DID A PRETTY
GOOD MARKETING EFFORT THROUGH
THE FOREMAN FORMULATION OF OUR
SUBCOMMITTEE. AND MAKING SURE WE
GO FAR IN AND WIDE IN CONCLUSION
. HELLO? YES WE'LL CONTINUE TO
WORK WITH OUR PARTNERS AT THE
STATE, LOCAL AND FEDERAL LEVELS
TO ENSURE CALIFORNIANS ARE
PREPARED AND CAN EFFECTIVELY
RESPOND TO CYBER ATTACKS AND
THREATS THROUGHOUT OUR
COMMUNITIES. THE FEDERAL CYBER
GRANT IS A GREAT WAY TO ASSIST,
UM IN THE FIGHT AGAINST CYBER
THREATS, AND CALAVIUS HAS TAKEN
STEPS TO ENSURE ALL CALIFORNIANS
CAN TAKE FULL ADVANTAGE OF THIS
PROGRAM THROUGH ACCESSIBILITY
AND INFORMATION. THANK YOU SO
MUCH FOR THE OPPORTUNITY TO
SPEAK TO YOU TODAY, AND WE LOOK
FORWARD TO ANSWERING ANY
QUESTIONS THAT YOU MAY HAVE. OH
THANK YOU VERY MUCH. SO JUST TO
BE CLEAR, IT'S THESE PROGRAMS
WERE I MEAN, IT SEEMS LIKE IT'S
FOCUSING ON WHAT EXISTING
SERVICES ARE ALREADY THERE,
RIGHT. NOT NECESSARILY AT THE
BEGINNING OF THIS ENTIRE PROCESS
, BUT WITH THE COMPACTED
TIMEFRAME OF ACTUALLY GETTING
MONEY OUT TO MAKE AN IMMEDIATE
IMPACT. WE CERTAINLY PRESENTED
AN OPTION THAT HERE ARE A LIST
OF SERVICES THAT YOU COULD
DEPLOY, LIKE READILY LIKE RIGHT
NOW, VERSUS IF A, UM A COUNTY OR
A CITY MAY WANT TO CONTRACT FOR
DARK WEB MONITORING AS A SERVICE
, YOU KNOW, BY THE TIME THEY
WOULD SUBMIT THAT APPLICATION BY
THE TIME THEY WOULD
CONTRACTUALLY UH, OBLIGATE THOSE
FUNDS AND GET THOSE ONLINE IT
WOULD TAKE THEM TIME. UM SO ONE
OF THE THOUGHTS ON ON THIS THAT
THE COMMITTEE EVEN CAME UP WITH
LIKE, WHAT CAN WE DO LIKE RIGHT
NOW, IN THE IN THE IMMEDIATE
TERM TO HELP PROTECT FROM CYBER
ATTACKS, AND SO AS THE SURVEY
CERTAINLY SHOWED, UM, YOU KNOW,
THAT'S WHERE THE HYBRID MODEL
CAME IN. IT'S NOT A ONE SIZE
FITS ALL. WE WANTED MAXIMUM
FLEXIBILITY TO SERVE POTENTIAL
SUBVERSIVE, BUT I GUESS WHAT I
WAS SAYING IS, IT SEEMS THAT
THIS THESE ARE VERY SIMILAR.
SERVICES TO WHAT? UM WHAT CDT
AND CAL SICK ALREADY OFFER. AND
UM AND WE KNOW OVER THE YEARS
THAT IT'S BEEN VERY DIFFICULT TO
GET LOCAL GOVERNMENTS TO USE
THESE SERVICES. AND SO, UM HOW
MAYBE YOU CAN GO A LITTLE BIT
MORE DEEPLY. BESIDES THE
OUTREACH YOU KNOW BY FOUR MATE
FORMING THE COMMITTEE. HOW ARE
YOU GOING TO REACH OUT TO LOCAL
GOVERNMENTS? YEAH I THINK
CERTAINLY IN VITALITY CAN CAN
CHIME IN HERE THROUGH THE
REPRESENTATION OF OUR
SUBCOMMITTEE OF ALL RESPECTIVE
RECIPIENTS. YOU KNOW OUR
BASELINE WE HAD TWO CERTAINLY
UNDERSTAND WHAT IS THEIR
FUNDAMENTAL BASELINE OF
CYBERSECURITY? WHAT IS THEIR
MATURITY AND HOW CAN WE HELP
THEM ALMOST IMMEDIATELY, AND SO
THROUGH THEIR INPUT THROUGH
THEIR, UM, RECOMMENDATIONS OF
THOUGHT IS HOW THE FIVE UM
DIFFERENT AREAS CAME IN TO BE
AND THEN, AS WE MAPPED OUT IN
THE SURVEY, THOSE PARTICULAR
AREAS OF THE YOU KNOW, IN THE NO
FOE, THE FINENESS OF NOTICE OF
FUNDING OPPORTUNITY THERE 16
REQUIRED ELEMENTS RIGHT, SO WE
MAPPED OUT EACH ONE OF THOSE
SERVICES THAT ARE CONSIDERED IN
KIND SERVICES. THEY MAP TO ALL
OF THOSE 16 REQUIRED ELEMENTS.
SO THOSE HELP ASSIST THAT SO AS
FAR AS UM, YOU KNOW, THESE ARE
SERVICES THAT HAVE ALREADY, UM
BEING PROVIDED. NOT AT THE SCOPE
AND SCALE THAT WE EXPECTED AS A
RESULT OF THIS PROJECT. UM BUT
THOSE ARE SERVICES THAT ARE
READILY AVAILABLE THAT WE CAN DO
NOW BECAUSE YOU WERE TALKING
ABOUT THE NUMBER OF LOCAL
AGENCIES IN CALIFORNIA. WHAT DID
THAT ADD UP TO? I KNOW I HEARD
1000 DISTRICTS SO TO 3000
DIFFERENT ENTITIES THAT NEED TO
BE THAT NEED TO BE REACHED AND
RIGHT UP TO THIS POINT BEFORE
YOU STARTED THIS EFFORT. HOW
WHAT PERCENT DO YOU THINK YOU
HAVE A RELATIONSHIP WITH? THAT'S
A GOOD, VERY GOOD QUESTION. AND
I'M GONNA BASE THIS ON OUR
CURRENT OUTREACH THAT WE DO WITH
OUR CYBER THREAT INTELLIGENCE
DISTRIBUTION LIST THAT WE TOUCH
AND, UM IT'S ROUGHLY 1800
DIFFERENT ENTITIES THAT WE TOUCH
ON A REGULAR BASIS, SO IT'S
PRETTY FAR PRETTY WIDE. BUT
CERTAINLY SOME OF THE
REPRESENTATIVE THE
REPRESENTATIVES OF DIFFERENT
SPECIAL DISTRICTS. WE RELIED
UPON THEM TO REACH OUT TO THEIR
CONSTITUENTS BECAUSE WE
CERTAINLY CAN'T TOUCH THEM ALL
THROUGH SIMPLE WORD OF MOUTH OR
AN EMAIL BLAST, SO WE CERTAINLY
I THINK MADE A REALLY, REALLY
GREAT EFFORT IN HITTING ALL
THOSE PARTICULAR GROUPS
COMMITTEES TO HELP SPREAD THE
WORD AND GO FAR, FAR AS WHY DO I
THINK WE'VE TOUCHED EVERY EVERY
SINGLE, UM COMMUNITY. PROBABLY
NOT, BUT THAT IS STILL OUR GOAL.
AND THEN I'M KIND OF CURIOUS.
UM, I MEAN, $7.9 MILLION IS
ALMOST NOTHING. UH HATE TO SAY
THAT I THINK IT'S REALLY
IMPORTANT TO GO THROUGH THIS
EFFORT AND LEVERAGE. I MEAN, USE
IT TO LEVERAGE. AS MUCH AS YOU
CAN. WHY EVEN ASKED LOCAL
GOVERNMENTS IF THEY WOULD LIKE.
CASH OR IF THERE IS A HYBRID
PROGRAM BECAUSE IT WOULD AMOUNT
TO A FEW DOLLARS AND NOT
NECESSARILY HELP THEM FURTHER,
WHAT IT IS THAT THEY ARE TRYING
TO DO SO. ARE YOU SETTLED ON
THIS HYBRID MODEL THAT THIS DOES
CASH TO INDIVIDUAL? UH UM LOCAL
GOVERNMENTS MAKES SENSE AT ALL.
THAT'S ON THE FRONT END. AS WE
WERE DEVELOPING THIS WITH OUR
SUB COMMUNITY. THAT IS CERTAINLY
SOMETHING THAT WE, UM, EXAMINED,
RIGHT? YOU'RE 100% CORRECT IF.
ONE OF THE MODELS WAS JUST
STRAIGHT CASH SUBMITS A REQUEST
MAY HIT IT. YOU KNOW, YOU CAN
ONLY SLICE THAT PIE SO MUCH, AND
THERE'S NO LONGER PIE AND THEN
YOU'RE REALLY NOT MAKING AN
IMPACT OF ALL OF THOSE NUMBERS
THAT WE READ OF ALL THE
DIFFERENT DISTRICTS, AND, UM,
YOU CAN PROBABLY NOT EVEN PUT
ONE PERSON IN A SANDS CLASS. IF
YOU WANTED TO SPREAD IT OUT
EQUALLY, HOWEVER, WE WANTED
FLEXIBILITY, RIGHT? WE DIDN'T
WANT TO. UM HAVE IT. IT'S A ONE
SIZE FITS ALL. SO THAT'S WHERE
WE CURRENTLY ARE RIGHT NOW THE
EVALUATION OF PROPOSALS THAT
WILL RECEIVE HAVE TO CERTAINLY
BE RANKED PRIORITIZED AND
THOUGHT OUT CAREFULLY, BUT I
THINK IT WAS QUITE CLEAR IN THE
SURVEY WHEN WE ASKED THAT
PARTICULAR QUESTION, UM
DIFFERENT REPRESENTATIVE
COMMUNITIES WANTED THE
FLEXIBILITY TO MAKE THE DECISION
LATER. YEAH, I'M NOT. I'M NOT
SURE HOW REALISTIC THAT IS. BUT
UM BUT I APPRECIATE YOU REACHING
OUT TO ALL THESE LOCALITIES. SO
HOW HOW DO YOU PLAN TO COLLECT
THE SUCCESS METRICS AND I'M YOU
KNOW, I OBVIOUSLY HAVE A LOT OF
INTEREST IN THE MIGRATION TO DOT
GOV. WHICH IS ONE OF THE
ELEMENTS. YOU HAVE THAT 90% OF
LOCAL GOVERNMENT SHOULD BE, UM
AH! AH UM USING MULTI FACTOR
AUTHENTICATION. 100% OF LOCAL
GOVERNMENTS SHOULD PROHIBIT
DEFAULT PASSWORDS AND 90% SHOULD
BE GOING TO THE DOT GOV DOMAIN.
SO HOW WOULD YOU HOW DO YOU PLAN
ON COLLECTING THOSE STATISTICS
AND ARE OR ARE YOU ALREADY
COLLECTING THEM? YEAH SURE. I
COULD TAKE THAT ONE. OBVIOUSLY
WITH THE HYBRID APPROACH AS TO
WARRANT A HYBRID APPROACH AND
COLLECTING THE DATA. SPANNING
FROM SELF ASSESSMENT SERVICE
SURVEYS AND QUESTIONNAIRES. FOR
EXAMPLE, IF ONE TAKES SOME CASH,
WE WOULD EXPECT SOME DATA COMING
BACK INTO US SO THAT WE COULD
ULTIMATELY REPORT TO FEMA. AND
DATA SUCH AS WHAT'S YOUR
COVERAGE? FOR EXAMPLE, IF YOU'RE
BUYING A SECURITY TRAINING AND
AWARENESS TOOL ARE YOU SENDING
THAT TRAINING MATERIAL AND
COVERING ALL OF YOUR USERS?
PARTIAL PARTIAL USERS SO THAT
THAT THAT THINGS LIKE THAT COULD
BE QUANTIFIED. AND THEN MEANTIME
, THE RESOLUTION. MEANTIME THE
DETECTION SO, FOR EXAMPLE, IF
ONE CHOOSES TO GO WITH OUR
SECURITY OPERATIONS CENTER
WITHIN EXISTING IN KIND SERVICE,
WE ALREADY HAVE METRIC AND DATA
COLLECTION MEASURES IN PLACE. SO
IF THEY SUBSCRIBE WITH SOCKS,
SERVICE OFFERING OR THE THREAT
INTELLIGENCE SERVICE OFFERING OR
EVEN THE VIRTUAL SISTO SERVICE
OFFERING. WE ALREADY HAVE
METRICS IN THOSE SERVICE LINES
THAT WE CAN COLLECT AND REALLY
REPORT ON BEHALF OF THE SUB
GRANTEE TO SISTER AND FEMA. UH
SO OBVIOUSLY, THAT'S A CONDITION
CONDITION OF THE GRANT, WHICH
MAKES IT MUCH MORE APPEALING TO
GO WITH AN IN KIND SERVICE
VERSUS TAKING THE CASH AND, UM,
PUTTING IN A BUNCH OF WORK AND
OVERHEAD TO COLLECT COLLECT DATA
AND METRICS OR FIGURING OUT
THEIR OWN PROCESS FOR DATA
COLLECTION. SO FOR IN KIND
SERVICES. WE HAVE DATA
COLLECTION MECHANISMS AND
REPORTING WHICH WE'VE ALREADY
INSTITUTED FOR OUR STATE
AGENCIES. UM BUT WITH WITH HIGH
HYBRID OR OR THE CASH OPTION,
WELL, WE WILL HAVE TO RESORT ON
QUESTIONNAIRES AND DATA COMING
BACK TO US. UM SO. SO GOING. I
DO WANT TO FOCUS A LITTLE AGAIN
BECAUSE I'M INTERESTED ON THE
DOT GOV PORTION. YOU HAVE 90% OF
LOCAL GOVERNMENTS ON DOT GOV. UM
THE BILL THAT WE HAD ENDED UP
PEELING AWAY A LOT OF THE
SPECIAL DISTRICTS AND IT'S JUST,
UH, COUNTIES AND CITIES AND I
THINK CURRENTLY THERE AT 30% OR
SO AND SO. SO YOU HAVE A PRETTY
SHORT TIME FRAME TO GET
EVERYBODY ELSE ON AND TO ME. IT
DOESN'T SEEM LIKE WHEN THEY WERE
OPPOSING THE BILL. THEY SAID
THAT THEY DIDN'T HAVE THE
RESOURCES. SO IT SEEMS. SMALL,
UH, SMALL AMOUNT OF FUNDING
ISN'T EVEN GOING TO GET YOU
THERE WITH WHO IS ALREADY, UM,
SUBJECT TO THAT LAW, SO I WOULD
THINK THE VIRTUAL, UM, SEE, SO
WOULD BE THE BEST WAY FOR
COUNTIES AND CITIES. LOCAL
GOVERNMENTS, THEY'RE HAVING
ISSUES. TO GET HELP. UM. BUT
HOW? HOW MUCH ARE YOU GOING TO
BE FUNDING THAT? HOW MANY? HOW
MANY PEOPLE IS THAT GOING TO BE?
OR IS THIS GOING TO BE
COMPLETELY AUTOMATED? OR HAVE
YOU PUT TOGETHER SOME SORT OF
STEP BY STEP? UH INSTRUCTION ON
HOW TO CONVERT TO DOT GOV. YEAH
AND THERE'S A LOOSER KIND OF
MACRO OR GENERAL LEVEL STEP BY
STEP. UM REQUEST PROCESS THAT'S
ALREADY OUTLINED. AND HOW TO
REQUEST THE DOMAIN AND HOW TO
SET UP YOUR EMAIL SYSTEM AND HOW
TO SET UP A WEB SERVER. SO ALL
OF THOSE BASIC THINGS ARE
ALREADY DOCUMENTED. THE
CHALLENGES WILL COME IN INTO THE
SCOPE THAT FALLS OUTSIDE OF THAT
. SO, FOR EXAMPLE, IF SOMEBODY
HAS SOMETHING CUSTOM CUSTOM
APPLICATION, THERE'S SOME CUSTOM
INTEGRATION WITHIN THEIR
ORGANIZATION. THAT'S WHEN, WHEN
EXTRA AND AN ADDITIONAL HELP
WHAT WOULD NEED TO COME IN AND
POTENTIALLY POTENTIALLY
SUPPLANTED BY BY A GRANT PROGRAM
LIKE THIS. HOWEVER THE BROADER
FAMILY OF C D T THAT THERE IS A
GROUP THAT THAT THAT CAN ALSO
HELP OUT IN TERMS OF CONSULTING
AND GUIDING THOSE THOSE FRIENDS
USE CASES OR USE CASES THAT FALL
FALL OUTSIDE OF THE NORMAL
REQUEST PROCESS, SO THERE'S
ALREADY A LIMITED AMOUNT OF
RESOURCES WITHIN C D. D THAT
COULD KINDA THAT CAN CONSULT AND
HOW TO MIGRATE. BUT POTENTIALLY
IF THERE'S A BIGGER, BIGGER
PROJECT ASSOCIATED WITH MOVING A
LARGE AND COMPLEX ORGANIZATION
TO TÔI CA.GOV IN TERMS OF THEIR
EMAIL OR WEB SERVERS OR CUSTOM
APPLICATIONS THAT MIGHT THAT
POTENTIALLY, I WOULD ANTICIPATE
TAKE ADDITIONAL FUNDING. AND SO
WHAT DOES IT LOOK LIKE? RIGHT
NOW? LIKE, WHAT IS A VIRTUAL
WHEN YOU SAY YOU'RE OFFERING
VIRTUAL SEAT CSO SERVICES? HOW
MANY PEOPLE IS THAT? SO WE
PEOPLE WILL THAT BE ONCE YOU
ARE. UM FULLY OPERATIONAL. SO
TODAY WE OPERATE WITH A TEAM OF
ADVISORS THAT ARE SOME OF THEM
ARE STATE STAFF, AND A MAJORITY
OF THEM ARE CONTRACTORS. SO WE
TAPPED INTO A CONTRACT WHICH
REALLY GIVES US REACH INTO A
BENCH OF SECURITY PROFESSIONALS.
SO A BENCH OF SECURITY
PROFESSIONALS DEPENDING ON WHAT
THEY NEED OR WHAT THE DISCIPLINE
IS SO, FOR EXAMPLE, IF WE COME
ACROSS AN AGENCY OR CUSTOMER SUB
GRANTEE THAT NEEDS HELPING HOW
TO BUILD AN INCIDENT RESPONSE
PLAN WILL PULL IN OUR INCIDENT
RESPONSE EXPERT FROM THAT BENCH
OF SECURITY PROFESSIONALS TO
HELP OUT WITH THAT SPECIFIC NEED
, OR, FOR EXAMPLE, IF WE NEED AN
INDIVIDUAL, THAT'S GOOD AT
SETTING UP DNS SECURITY OR
DOMAIN NAME SYSTEM. SECURITY UM,
SPECIFICALLY APPLICABLE TO THE
DNS MIGRATION. WE CAN ASK TO
PULL IN AN EXPERT ON DNS
SECURITY, SO IT'S REALLY A LOOSE
PERSONNEL AUGMENTATION WITH THE
CONSULTANCY OR CONTRACTOR THAT
HAS FAR AND WIDE REACH INTO
VARIOUS THEIR VARIOUS
DISCIPLINES OF IT, AND
SPECIFICALLY ITS SECURITY. THAT
WE HAVE THE FLEXIBILITY TO PULL
INTO AND ESSENTIALLY TAG TAG
SOMEBODY INTO A SPECIFIC
PROBLEM. OKAY SO, UM,
PARTICULARLY THE PARTICULAR
ORGANIZATION WE'RE DEALING WITH.
THEY HAVE OVER 1000 SECURITY
PROFESSIONALS THAT WE CAN
POTENTIALLY ASK FOR HELP. OKAY?
NOT ALL. NOT ALL AT THE SAME
TIME, OF COURSE. UM BUT AGAIN
GOING BACK TO THIS GETTING THESE
90% OF LOCAL GOVERNMENTS ON
BOARD, SO YOU THINK THAT FOR
ONTO DOT GOV. UM YOU THINK THAT
THE STEP BY STEP INSTRUCTIONS
SHOULD BE SUFFICIENT FOR MOST
LOCAL GOVERNMENTS. GENERALLY
FROM FOR A COOKIE CUTTER
ORGANIZATION THAT IT WILL BE
SUFFICIENT ENOUGH, BUT WITHOUT
UM I HONESTLY CAN'T CAN'T SAY
WITHOUT WITHOUT KNOWING THE FULL
SCOPE OF THE PROBLEM OF WHAT'S
OUT THERE BETWEEN THE THOUSANDS
OF ORGANIZATIONS OUT THERE, BUT
TYPICAL DIFFICULT ORGANIZATION.
IT SHOULD BE PRETTY
STRAIGHTFORWARD TO SET UP A
DOMAIN NAME POINTED TO A WEB
SERVER OR AN EMAIL. BUT I DON'T
KNOW. A LOT OF THOSE FRINGE USE
CASES AMONGST THE THOUSANDS OF
ORGANIZATIONS THAT WE'RE DEALING
WITH YET. AND IT'S ALWAYS YOU
KNOW, WE FOCUSED ON COUNTIES AND
CITIES AND, UM, BUT I THINK
WHAT'S REALLY AT RISK IS A LOT
OF THESE SPECIAL DISTRICTS, AND
WE WOULD HAVE LIKED TO HAVE
INCLUDED EVERYTHING. BUT
HOPEFULLY THE SPECIAL DISTRICTS
WILL SEE THE WRITING ON THE WALL
ON THE WALL AND START TO MIGRATE
. ALSO, AND USE THESE OTHER, UM
NÓ MULTIFACTOR AUTHENTICATION
AND. EDITING DEFAULT PASSWORDS.
SO, UM UH, I MEAN, THIS IS KIND
OF WE'RE GOING TO. I REALLY
APPRECIATE YOU COMING TONIGHT. I
THINK THIS IS AN EXTREMELY
DIFFICULT TASK AGAIN FOR
CALIFORNIA. TO ME. THIS IS JUST
NOT THE TYPE OF RESOURCES THAT
SHOULD BE. I MEAN, IT'S NOT
NEARLY ENOUGH. TO PUT TOWARD, UM
, WHERE WE NEED TO GO WITH CYBER
SECURITY. BUT WHILE WHILE WE
WERE PUTTING THIS HEARING
TOGETHER, IT WAS DIFFICULT TO
FIND LOCAL GOVERNMENT
ASSOCIATIONS THAT WE'RE FAMILIAR
WITH THE PLAN AND WILLING TO
DISCUSS IT. YEAH AND SO YOU KNOW
, I THINK THAT'S REALLY MY
BIGGEST CONCERN IS THE WAY I
STARTED OUT AS THERE THERE HAS
TO BE A NEW WAY TO DO OUTREACH
OR I SHOULDN'T SAY A NEW WAY.
YOU HAVE TO AUGMENT THE OUTREACH
THAT YOU'RE CURRENTLY CURRENTLY
DOING, BECAUSE IT'S REALLY
CRITICAL THAT THAT'S AT LEAST
ALL THOSE. THOSE UM LOCAL
GOVERNMENTS THAT ARE GETTING THE
THREAT ANALYSIS THAT THAT THAT
WE KNOW THAT THEY'RE ON BOARD
AND WE KNOW THAT THEY'RE DOING
THE RIGHT THINGS TO PROTECT
THEIR UM, CONSTITUENTS SO UH,
NO. I HOPE THAT THERE'S REALLY A
LOT OF THOUGHT PUT INTO THAT
THAT WE'RE NOT LEAVING ANYBODY
BEHIND. ABSOLUTELY UNDERSTOOD.
UM, YOU KNOW IT'S NOT A PERFECT
SCIENCE OF TOUCHING EACH AND
EVERYONE, UM, BUT ALSO IN OUR
PLAN. THERE IS A LISTING OF ALL
THE DIFFERENT ORGANIZATIONS AND
THEIR CHAIRS WHO THEY REPRESENT
IS LISTED. THAT'S ON THERE. SO
IT UM IT WAS PRETTY EXPANSIVE IN
THAT REGARD. NOW HOW FAR THAT
PERMEATES DOWN IS TO YOUR POINT.
THAT'S THE CHALLENGE FOR WHICH
WE ALL FACE AND ENSURING THAT
THEY ARE REACHING THEIR
CONSTITUENTS, NOT JUST THROUGH
THEM, BUT ALSO THROUGH US.
THAT'S OUR OBLIGATION AS WELL.
AND UM, YOU ALWAYS CAN WORK WITH
LEGISLATORS KNOW IF YOU IF YOU
LOOK AT THE SENATORS AND THE
ASSEMBLYMEMBER'S WE ALL EVERY
COUNTY, EVERY CITY, EVERY
SPECIAL DISTRICT IS IN ONE OF
OUR DISTRICTS AND IF WE HAD, UM,
INFORMATION, UH, PUT TOGETHER TO
LET THESE COUNTIES AND CITIES
KNOW WHAT THEIR RESPONSIBILITIES
ARE, UM, WHERE THEY CAN FIND
HELP THROUGH THE STATE. WE CAN
HELP SPREAD THAT INFORMATION
ALSO, BUT IT IS THIS IS REALLY
SOMETHING THAT IS CRITICAL. AND
I THINK IS, UM IT THAT IT IS
BECOMING MORE AND MORE CRITICAL.
WHEN WE SEE THE ELECTIONS COMING
UP, AND, UM NO, WE'RE SEEING
MORE AND MORE OF THESE
CYBERATTACKS. WE REALLY NEED TO
GET EVERYBODY WITH THE PROGRAM.
SO UM SO USE US UTILIZE US TO
HELP YOU SPREAD THE INFORMATION,
SO THANK YOU VERY MUCH FOR
JOINING US TODAY. AND UM, UM, WE
ARE NOW GOING TO CALL UP OUR
NEXT PANEL AND THIS IS GOING TO
BE AN IMPLEMENTATION DISCUSSION
BY REPRESENTATIVES OF LOCAL
GOVERNMENTS. THANK YOU,
GENTLEMEN. UH HUH. FOR OUR NEXT
PANEL. WE HAVE GLENN HEARD RICH,
WHO SERVES AS THE INFORMATION
SECURITY MANAGER FOR THE COUNTY
OF SACRAMENTO. AND I GUESS WE
CAN BUT ONCE AND THEN WE HAVE
ANDREA BENNETT AND DAVID
THURSTON.
ALL RIGHT. WHY DON'T WE START
WITH GLENN? ALL RIGHT, SO, UH,
CAN YOU HEAR ME? OKAY FOR
SOMEONE TO START. GOOD MORNING.
ALL THANK YOU FOR COMING. SEE
ABOUT FIBER. AS WE LOOK IN THE
COMMUNITIES. THERE'S DIFFERENT
LANGUAGES. AND THAT MAKES IT
HARD TO COMMUNICATE THE SAME
LEVEL. I JUST WANT TO SHARE THAT
WITH YOU FOR US. BEFORE HIGH
START. THANK YOU. SO UM, WITH
THAT, UM YOU KNOW, WE TOOK. I
WORKED ON FIRST OFF THE LITTLE
LITTLE BACK UP A LITTLE BIT. MY
NAME IS GLEN. UM I'M A CODA. SO
MY PARENTS ARE DEAF. I
UNDERSTAND THAT THERE IS
DIFFERENT PERSPECTIVES. ON THE
WAY IN WHICH WE INTEGRATE AND
COMMUNICATE AND, UM, DEFINITELY
AS WELL AS THAT IN CYBER
SECURITY, AND, UH, WHAT
DIFFERENT LEVELS THINK IS THE
BEST PRIORITY FOR MOVING
FORWARD. I'VE WORKED IN A LOT OF
DIFFERENT ORGANIZATIONS FOR
STARTING IN THE MILITARY
GOVERNMENT CONTRACTOR HEALTH
CARE, EDUCATION, AUTOMOTIVE,
LOCAL GOVERNMENT. I'VE WORKED IN
A LOT OF DIFFERENT SECTORS
AROUND SECURITY AND CYBER
SECURITY. AND OUR PROBLEMS ARE
ALL THE SAME. BUT THEY'RE ALL
DIFFERENT. WE HAVE DIFFERENT
SCOPES AND SCALES IN WHICH WE
CAN APPLY OUR RESOURCES TO
MITIGATE THESE CYBER THREATS AND
AS YOUR ORGANIZATION'S GET
LARGER PROBLEMS IN SCOPE ALSO
INCREASES BUT EVEN IN THOSE
ORGANIZATIONS THAT ARE SMALLER,
THEY HAVE THOSE SAME RISK THAT
NEEDS TO BE APPLIED TO THEM.
WHEN LOOKING AT THE GRANT, UM 16
CATEGORIES. FELT LIKE INITIALLY
WE WEREN'T NECESSARILY ALIGNED
TO ALL OF OUR NEEDS AT OUR
LEVEL. I THINK THAT THEY ARE
WORTHY ITEMS. TO HELP GET A
STARTED IN THE RIGHT DIRECTION.
AND PROVIDE A FOUNDATION TO
FIGURE OUT HOW WE SHOULD BE
ACTION NG THESE RESOURCES. AS A
PART. OF THESE PLANS AT THE
STATE PUT TOGETHER IT FELT LIKE.
WHILE I WAS APPRECIATIVE OF THE
INTEGRATION THAT WE GOT FROM THE
STATE AND THE OUTREACH THAT IT
DIDN'T REALLY ALIGNED YET TO OUR
NEEDS, MAINLY BECAUSE THERE WAS
A DIFFICULTY IN UNDERSTANDING
WHAT OUR NEEDS IN THE FIRST
PLACE WHERE HOW DO YOU
COMMUNICATE WITH SO MANY
ORGANIZATIONS ACROSS SUCH A
LARGE STATE? TO BRING BACK THOSE
APPROPRIATE DETAILS. TO
FORMULATE A PLAN. I WORKED ON
THREE OF THE FOUR WORKING
GROUPS. UH AND IT WAS A BIT OF
AN EYE OPENER OF THE DIFFERENCES
THAT WE SAW AND HOW WE PUT THIS
INFORMATION TOGETHER AMONG THE
GROUPS. AND RELATED UP AND WAS A
LITTLE LITTLE WORRISOME THINKING
THAT THIS WAS GOING ON ACROSS
THE COUNTRY. WHERE WE WERE ALL
HEADING IN DIFFERENT DIRECTIONS
AND WHAT OUR GOALS ARE BECAUSE
OF OUR DIFFERENCES. I THINK
THERE'S SOME GREAT COMPONENTS IN
THIS PLAN. AND THAT THE GOAL SET
UP WHILE THERE, UM LOFTY. UM AND
, UH WHILE WITH ONLY FOUR OF
THEM SIGNIFICANTLY WIDENED SCOPE
. UH THAT WOULD BE DIFFICULT TO
ACHIEVE. FOR ANY ORGANIZATION,
EVEN THE STATE ITSELF. SOME OF
THESE GREAT, UM, COMPONENTS OF
THIS PLAN INCLUDES SOME
SERVICES. FROM THE STATE. I
THINK THAT LEVERAGING THOSE
SERVICES FROM A CENTRALIZED
PLACE IS GOING TO BE THE ONLY
WAY THAT WE ARE SUCCESSFUL AND
ADD ACQUITTING OR APPLYING FUNDS
TO MAKE A DIFFERENCE THROUGHOUT
THE STATE. THE STATE OF PARA THE
SACRAMENTO COUNTY LEVERAGES SOME
OF THESE SERVICES ALREADY UH,
GENERALLY, ASSESSMENTS THREAT
INTELLIGENCE ASSESSMENTS, AND
WE'RE STILL LOOKING AT
INTEGRATING WITH THEIR SECURITY
OPERATIONS CENTER, BECAUSE AS WE
INTEGRATE MORE TOGETHER, WE DO
BETTER TOGETHER. WE HAVE A
BETTER IDEAL OF THE IMPACTS THAT
ARE COVERING ACROSS THE COUNTY.
BUT THERE'S SOME ITEMS IN HERE
LIKE YOU MENTIONED EARLIER. THE
NICE WORK FOR WORKFORCE
FRAMEWORK. IF YOU TOOK A LOOK AT
THE POSITIONS THAT ARE LISTED IN
THAT FRAMEWORK, GREAT THERE IN
DETAIL THEIR SPECIFIC ABOUT A
BUNCH OF DIFFERENT DISCIPLINES
WITHIN THIS CYBERSECURITY SPACE.
BUT IF YOU TURN TO LOOK AT YOUR
STATES AND COUNTIES IN MY
ORGANIZATION. WE HAVE 12
INDIVIDUALS FOR ALL OF CYBER
SECURITY FOR THE ENTIRE COUNTY.
IF YOU TAKE A LOOK AT MY
HOMETOWN GOLD THEY HAVE TO I T
PEOPLE SO WHEN YOU TRY TO APPLY
THESE REALLY IN DEPTH SCOPES
POSITIONS TO OUR NEEDS, THEY
DON'T ALIGN. SACRAMENTO COUNTY
BARELY NOW HAS ONE SECURITY
CLASSIFICATION. WE ARE MOVING
FOR A COUPLE OF MORE, BUT
THEY'RE ALL IN LINE FOR A SINGLE
, UM, ALIGNMENT OF INFORMATION
SECURITY ANALYSTS WITH THE CHAIN
UP AND. THAT'S EVEN INCLUSION OF
THE GOVERNANCE RISK COMPLIANCE
SECURITY OPERATIONS. AND, UM. SO
IT MAKES IT VERY DIFFICULT FOR
US TO LINED SO THE THINGS LISTED
IN THIS PLAN. AND AS I READ
THROUGH THE PLAN, IT FELT LIKE
IT WAS, UM SCOPED. FOR THE
STATE. IN THAT IT WAS A
REPURPOSING OF THE STATE'S GOALS
AND INITIATIVES. THERE UM, STATE
SECURITY MANUAL, HOW THEY
OPERATE. AND HOW THEY BELIEVE
THAT THAT THEY SHOULD BE MOVING
FORWARD. NOT NECESSARILY HOW WE
SHOULD BE MOVING FORWARD. UM. I
THINK THAT THERE ARE SOME SOME
REALLY GOOD COMPONENTS. UM
SPECIFICALLY AROUND THE
PREPAREDNESS. AND I THINK THAT.
IN THIS GRANT FUNDING IF WE
SPENT YEAR ONE YEAR TWO SOLELY
FOCUSING ALL OVER THOSE FUNDS
TOWARDS PREPAREDNESS. WE WOULD
SET A FAIR FOUNDATION. IN WHICH
WE COULD BETTER COMMUNICATE AND
UNDERSTAND THEIR ORGANIZATIONS,
RISKS AND WHAT I MEAN BY THAT,
AND PREPAREDNESS IS DOES EACH OF
THE ENTITIES HAVE AN INCIDENT
RESPONSE PLAN? THAT'S SOMETHING
THAT COULD BE TEMP LAMENTED
TEMPLATE. ID WORKED WITH THE
DIFFERENT ORGANIZATIONS AND
APPLIED EVENLY THROUGHOUT THE
STATE. DO THEY HAVE A
COMMUNICATION PLAN? A SIMPLE
CULTURALLY THAT'S PRINTED OUT IN
A BINDER ON THEIR DESK THAT THEY
CAN PULL OUT AND SAY WHO? HEY
SYSTEMS ARE DOWN. WHO DO I CALL?
WHO DO I CALL IT THE STATE SO I
CAN GET THE SERVICES AND THE
HELP THAT I NEED. EXERCISES.
THERE'S A LOT OF ORGANIZATIONS
HERE THAT HAVEN'T EVEN COMPLETED
ONE CYBERSECURITY EXERCISE. AND
IF THEY DO, THE SCOPE OF THAT
EXERCISE IS USUALLY LIMITED TO
THE TECHNICAL STAFF. AS WE LOOK
AT, YOU KNOW, IN THE STATE,
CALIFORNIA THE GREAT CHIC
EARTHQUAKE AWARENESS AND
PREPAREDNESS. WHY DO WE NOT HAVE
A SIMILAR ACTION FOR
CYBERSECURITY TO BRING UP
AWARENESS IN THE IN THESE
DIFFERENT ORGANIZATIONS SO THAT
THEIR LEADERSHIP CAN BE AWARE OF
THESE PROBLEMS AND CONTRIBUTE
FUNDING ON THEIR OWN BEHALF? TO
HELP FURTHER THEIR
CYBERSECURITY. UM. THERE'S
ANOTHER, UM, I GUESS ISSUE THAT
I'D LIKE TO JUST MENTIONED
SLIGHTLY. IS THE SERVICES THAT
ARE RECEIVED FROM THE STATE. WE
LEVERAGE THEM. THEY'RE NOT FAST.
UM BUT THEY DO PROVIDE A QUALITY
PRODUCT. UM AND IF WE ALLOCATE
SIGNIFICANT AMOUNT OF FUNDING
TOWARDS THE STATE PROGRAMS WE
NEED TO MAKE SURE THAT THERE'S
NOT NECESSARILY HER. THERE'S
ALSO CHECKS TO MAKE SURE THAT
HEY, WE WERE SUCCESSFUL IN
ALLOCATING THOSE FUNDS FOR HOW,
UH, THE COUNTIES IN LOCAL
GOVERNMENTS WERE ABLE TO IMPROVE
THEIR CYBERSECURITY, BUT IS
THERE UM AND REQUIREMENTS FOR
THE STATE IN WHICH THEY ARE
OBLIGATED TO PROVIDE THOSE
SERVICES TO OUR COUNTY, BECAUSE
IF THEY'RE NOT IN EFFECTIVE OR
IF THEY'RE NOT, UM, STREAMLINING
THEIR SERVICES TOWARDS OUR NEEDS
, THEN WHERE YOU ARE NOT GOING
TO BE SUCCESSFUL, AND THEN IT'S
GOING TO LOOK BAD ON THE
COUNTY'S BECAUSE WE DIDN'T OR
LOCAL GOVERNMENT BECAUSE WE
DIDN'T LEVERAGE THESE SERVICES
THAT WERE PROVIDED AND MAYBE
IT'S BECAUSE WE COULDN'T BECAUSE
IT JUST DIDN'T WORK FROM A WORK
PERSPECTIVE. UM ALSO ANOTHER
ITEM. AS WE LOOK FOR FUTURE
PLANNING IS WE NEED TO FIND A
WAY TO HELP SMALL AND LOCAL
BUSINESSES WITH THEIR CYBER
SECURITY. CYBER SECURITY IS NOT
JUST A COUNTY'S PROBLEM. THE
STATE PROBLEM GOVERNMENTS
PROBLEM. THIS IS SOMETHING THAT
WE'VE SEEN TIME AND TIME AGAIN,
WHERE THIRD PARTY
VULNERABILITIES RESULT IN
COMPROMISES OF ORGANIZATIONS, SO
WE NEED TO HELP THESE BUSINESSES
, ESPECIALLY THESE NEW
BUSINESSES HAVE AN UNDERSTANDING
OF CYBER SECURITY AND HOW THEY
CAN IMPLEMENT SOME BASIC BEST
PRACTICES. SO THAT THEY CAN HELP
PROTECT US OVER TIME. UM THERE
WAS QUITE A FEW GREAT MENTIONS
ABOUT THE NEST CYBERSECURITY
FRAMEWORK. AND I THINK THAT IS
HOW WE GAIN THE INSIGHT AND
DRIVE FORWARD IN OUR
CYBERSECURITY POSTURE. AND THIS
CYBER SECURITY FRAMEWORK HAS
SOME CATEGORIES THAT ARE LISTED
IN A WAY THAT ARE UNDERSTANDABLE
FROM. UM BOTH SIDES OF THE
CONVERSATION. THEY'RE GREAT
HERBAL. THEY'RE REPEATABLE
COUNTIES ALREADY DO THESE AS THE
AS A PART OF THEIR NATIONAL
CYBERSECURITY, UM, READINESS FOR
GRANT FUNDING TO BEGIN WITH. HOW
CAN WE GET THIS INFORMATION TO
THE STATE AS A SURVEY TO
UNDERSTAND TRULY WHERE OUR
DEFICIENCIES ARE, AND WHERE ARE
RISKS ARE SO THAT WE CAN DO
BETTER AND MOVE FORWARD. I DO
WANT TO SAY I APPRECIATE ALL OF
THE WORK THAT THE STATE HAS DONE
AND THE WORKING GROUPS. I THINK
THAT THIS PLAN WILL BE
SUCCESSFUL OVER TIME. UM AND I
THINK A LOT OF TEAMS DID A LOT
OF GREAT WORK. TO PUT THIS
TOGETHER SO THAT WE CAN BECOME
QUALIFIED FOR THIS GRANT FUNDING
AND WE CAN START MOVING IN THE
RIGHT DIRECTION. THANK YOU.
RIGHT THANK YOU VERY MUCH. THAT
WAS REALLY THAT WAS REALLY
HELPFUL AS IT SO THERE IS. NO
YOU'RE TALKING ABOUT SURVEYING.
UH UM. HOW WELL THE GOVERNMENT
SERVICES ARE WORKING YEARLY. OR
HOW WOULD YOU? HOW WOULD YOU SAY
THAT SHOULD BE DONE, I WOULD
SAY, LET'S SEE, UM MAYBE SOME,
LIKE OBLIGATIONS. IF LIKE, HEY,
WE SUBMITTED FOR REQUEST. HOW
LONG DOES IT TAKE FOR THE STATE
TO INITIALLY RESPOND TO
ACKNOWLEDGE OUR REQUEST. HOW
LONG DOES IT TAKE FOR THE FOR
THE SERVICES TO BEGIN? HOW LONG
DOES IT TAKE FOR THE SERVICES TO
CONCLUDE AND USE THOSE AS
METRICS TO SEE HOW EFFECTIVE
THESE SERVICES ARE BEING ACTION?
AND LIKE, DID THEY ACTUALLY
RESOLVE THE PROBLEM THAT STARTED
THE SERVICES IN THE FIRST PLACE.
UM THANK YOU VERY MUCH THAT, AS
I SAID, THAT WAS REALLY HELPFUL.
MR HEARD RICH. UM. NEXT UP. WE
HAVE TWO PANELISTS FROM
CALIFORNIA I T AND EDUCATION,
THEIR EXECUTIVE DIRECTOR ANDREA
BENNET, AND THE C I T E S
TREASURER DAVID THURSTON. WHO
SERVES AS THE ASSISTANT
SUPERINTENDENT FOR TECHNOLOGY
SERVICES FOR THE SAN BERNARDINO,
SUPERINTENDENT OF SCHOOLS
WHENEVER YOU'RE BOTH READY, I
WAS GONNA DO THAT SAME
INTRODUCTION, SO I APPRECIATE
THAT. UM SO SITE IS A NONPROFIT
NOT NOT FOR PROFIT ORGANIZATION
SUPPORTING THE I. T
PROFESSIONALS AND K 12 EDUCATION
IN CALIFORNIA. OUR MEMBERS HAVE
TITLES SUCH AS CHIEF TECHNOLOGY
OFFICER DIRECTOR OF I T. NETWORK
MANAGER, ENGINEER DATABASE
ADMINISTRATORS, CAL PADS
ADMINISTRATORS AS WELL AS FIRST
RESPONDERS FOR CLASSROOMS,
TECHNOLOGY IN THE CLASSROOMS.
THANK YOU FOR INVITING US HERE
TODAY TO TALK ABOUT THE PLAN. WE
REALLY APPRECIATE THAT THE
STATES SUBMITTED THE PLAN AND WE
LOOK FORWARD TO SEEING THE
CHANGES THAT CAN BE MADE AS A
RESULT. GENERALLY WE ARE
CONCERNED THAT THE STATE PLAN
DOES NOT ADEQUATELY ADDRESS THE
CYBERSECURITY THREATS TARGETING
OUR PUBLIC SCHOOLS. PUBLIC
SCHOOL STUDENTS, THE TEACHERS,
ADMINISTRATORS AND CLASSIFIED
EMPLOYEES. SCHOOLS OFTEN
MAINTAIN IMPORTANT PERSONAL
INFORMATION LIKE SOCIAL SECURITY
NUMBERS, HEALTHCARE INFORMATION
AND SENSITIVE PERSONAL DATA THAT
WHEN COMPROMISED AND HURT
PEOPLE. WHILE IT IS IMPORTANT
FOR THE CALIFORNIA DEPARTMENT OF
TECHNOLOGY, AND CAL, SICK TO
FIRST DEVELOP INTERNAL
INFRASTRUCTURE TO SUPPORT THE
PLAN, DIRECT CYBER SECURITY
SUPPORT FOR SCHOOLS IS VITAL TO
PROTECTING CALIFORNIA STUDENTS
AND SCHOOL EMPLOYEES. OUR 1100
PUBLIC SCHOOL AGENCIES CONTINUE
TO BE A TARGET OR CALIBER FOR
RANSOMWARE, DDOS ATTACKS AND
OTHER INCIDENCES. CALIFORNIA'S
PUBLIC SCHOOLS ARE DIFFERENT
FROM OTHER LOCAL GOVERNMENTS,
LIKE CITIES AND COUNTIES IN THAT
THEY ARE ALMOST ENTIRELY
DEPENDENT UPON STATE AND FEDERAL
FUNDING IN ORDER TO OPERATE.
SCHOOL BOARDS LACK THE ABILITY
TO RAISE LOCAL REVENUE IN ORDER
TO FUND NEW ON ONGOING OR
ONGOING INITIATIVES LIKE
CYBERSECURITY, SO WE NEED YOUR
HELP. THE LEGISLATURE HAS TAKEN
POSITIVE STEPS RECENTLY. THE
RECENT PASSAGE OF HB 1023
REQUIRES CAL STICK TO COORDINATE
CYBER CYBER THREAT INFORMATION
SHARING WITH SCHOOLS. HOW ELSE
IQ IS PREPARING FOR THIS ROLE
NOW AND CAN EXPAND IT WHEN MORE
HELP IS NEEDED BY THESE
ENTITIES. SITE ALSO RECENTLY
SPONSORED LEGISLATION SIGNED BY
THE GOVERNOR NEWSOM TO ALLOW THE
CALIFORNIA MILITARY DEPARTMENT
TO OFFER INDEPENDENT SECURITY
AUDITS. HOWEVER UM IN OUR
EXPERIENCE SO FAR, IT'S BEEN
SOMEWHAT DIFFICULT TO OBTAIN
THESE SERVICES DUE TO LACK OF
ADEQUATE STAFF WITHIN THE
MILITARY DEPARTMENT. SO
IRRITABLE LEGISLATURE TO
CONSIDER IMPROVING FUNDING FOR
THESE EFFORTS. SITE HAS A
VIBRANT COMMUNITY THAT
COMMUNICATES REGULARLY WITH EACH
OTHER TO ASSIST AND FORM AND
DEVELOP BEST PRACTICES FOR THE
USE OF TECHNOLOGY IN SCHOOLS. SO
ONE WAY THAT SITE CAN HELP IS BY
GETTING INFORMATION TO SCHOOLS
AND COUNTY OFFICES OF EDUCATION.
WE CAN REACH OUR MEMBERS EASILY
ONLINE AND THROUGH REGIONAL
GROUPS AND AT OTHER EVENTS.
RELATIONSHIPS WITH AXA, KAZ BOW
AND CSB A AND ALSO HELP GET
INFORMATION TO OTHER INDIVIDUALS
AND ENTITIES. LIKE I MENTIONED
THERE ARE ABOUT 1100 INDIVIDUAL
SCHOOL DISTRICTS AND ALSO 58
COUNTY OFFICES OF EDUCATION IN
CALIFORNIA. RANGE LIKE COUNTIES
FROM HIGHLY URBAN TO HIGHLY
RURAL. AND UM, TWO THIRDS OF THE
SCHOOLS IN CALIFORNIA ARE
CONSIDERED SMALL, WHICH MEANS
THEY HAVE ABOUT 2500 STUDENTS OR
LESS. THIS MEANS THEIR BUDGETS
ARE SMALL AND THEIR STAFFS ARE
SMALL. THEY DON'T HAVE STAFF
TRAINED IN CYBERSECURITY AND
OFTEN HAVE TO USE CONSULTANTS TO
PERFORM THAT KIND OF WORK. UM
MANY SCHOOL DISTRICT CONNECT
SCHOOL DISTRICTS CANNOT PAY IT
PERSONNEL AT A RATE COMMENSURATE
WITH SILICON VALLEY. AND SO WE
HAD WE STRUGGLED TO FULLY STAFF
FOR IT DEPARTMENTS. MANY
COUNTIES AND SCHOOLS ARE HAVE
ALREADY BEGUN TO EVALUATE THEIR
CURRENT CYBERSECURITY POSTURE,
BUT OFTEN FIND IT DIFFICULT TO
DEVELOP ANY KIND OF INTERNAL
STRUCTURE TO MITIGATE RISKS
REGULARLY. HELP FROM THE STATE
IS ESSENTIAL. SINCE THE
STRUCTURE OF THE PLAN HAS NO
CASH AWARDS BEING GIVEN TO
SCHOOLS, IT WILL BE UP TO THE
STATE TO DEVELOP AND MAKE
AVAILABLE A CERTAIN SERVICES TO
ACCOMPLISH THE OBJECTIVES IN THE
PLAN. PROPER AND EFFECTIVE,
EFFECTIVE STAFFING COLLABORATION
BETWEEN MUNICIPALITIES AND
SCHOOLS INVOLVING THE PRIVATE
SECTOR ARE ALL AREAS OF
IMPORTANCE. SITE WOULD LIKE TO
WORK WITH THOSE INVOLVED IN
BRINGING S L G C P TO FRUITION,
WE CAN BE THE VOICE OF K 12
SCHOOLS, COUNTY OFFICERS OF
THEIR EDUCATION AND THOSE
WORKING WITH THEM. WE APPRECIATE
YOUR ATTENTION TO THIS IMPORTANT
ISSUE. OUR ASSOCIATION STANDS
READY AND WILLING TO CONTINUE TO
WORK WITH THE LEGISLATURE AND
ADMINISTRATION TO PROTECT OUR
PUBLIC SCHOOL STUDENTS, TEACHERS
, ADMINISTRATORS AND CLASSIFIED
EMPLOYEES. AND DAVID THURSTON
HERE IS DEFINITELY A SUBJECT
MATTER EXPERT AND HE'S HERE TO
HELP ME ANSWER ANY QUESTIONS.
YOU MAY HAVE. I JUST HAVE ONE
BEFORE WE MOVE ON. YOU MENTIONED
THE SECURITY ASSESSMENTS HAVE
DONE BY THE MILITARY DEPARTMENT.
YOU HAVEN'T BEEN ABLE TO ACCESS
THEM NOT AT NOT AT ALL OR VERY
WILLING TO HELP US. UM THE PILOT
THAT WE HAD SET UP GOT WAYLAID
BY ATTORNEYS. OH, SO IT HASN'T
HAPPENED HASN'T HAPPENED YET.
LEGAL TIE UP AS WELL ON THE
STATE SIDE. MAYBE WE COULD, UH,
LEARN LATER ABOUT, UH, LEGAL TIE
UP THERE. NOT RIGHT NOW.
PROBABLY IT'S NOT SUPPOSED TO
BE. IF IT'S LEGAL, YOU PROBABLY
DON'T WANT TO DO IT OVER THE
MICROPHONE. SO ALL RIGHT. THANK
YOU. THAT PARTICULAR SERVICE
WHILE THAT PILOT WOULD HAVE
BEEN, UM, AN EXCELLENT
OPPORTUNITY TO EXPLORE THE.
EFFECTS OF THAT ASSESSMENT ON
SCHOOL DISTRICTS ABILITY TO
IMPROVE THEIR POSTURE. UM IT WAS
VERY CLEAR FROM OUR INTERACTIONS
WITH THE TALIBAN DEPARTMENT
MILITARY THAT THEY DID NOT HAVE
THE CAPACITY TO SCALE THAT UP
PAST. POSSIBLY 10 DISTRICTS AT
ANY GIVEN TIME, SO DEALING WITH
1100 DISTRICTS, IT'S GOING TO BE
DIFFICULT TO REACH A SIGNIFICANT
NUMBER OF THOSE DISTRICTS. SO
THAT'S SOMETHING TO BE CONCERNED
OF, UH, AS THE COLLEAGUES HERE
ON THE ON THE TABLE OF ALL
COMMENTED, UM WE DEFINITELY
APPLAUD THE STATE ESPECIALLY
CALLOW. YES AND THAT C, D T. UH,
TO GET THIS GRANT AND GET THIS
MONEY. HOWEVER LIMITED INTO THE
STATE AND TO AFFECT STATE AND
LOCAL GOVERNMENTS. IT IS VERY
CLEAR FROM THE READING OF THIS
GRANT THAT THAT THIS THIS OR
THIS PLAN THAT THIS PLAN IS NOT
REALLY DESIGNED TO ASSIST SCHOOL
DISTRICTS, AND THAT'S FINE THAT
WE UNDERSTAND THAT INITIALLY IT
IS. HOPEFULLY THE PLAN IS TO
DEVELOP THAT CAPACITY FOR CALLOW
ES, SPECIFICALLY CATHOLIC. HELPS
SCHOOL DISTRICTS BECAUSE
CURRENTLY THAT CAPACITY DOESN'T
EXIST. ANOTHER EXAMPLE WOULD BE
A B 2355, WHICH REQUIRES THE
REPORTING OF CYBERSECURITY
EVENTS AFFECTING MORE THAN 500
STUDENTS, OR 500 STAFF MEMBERS
AT A LOCAL SCHOOL DISTRICT. MY
COLLEAGUES AND I, FROM THE
COUNTY OFFICES OF EDUCATION
REACHED OUT TO CALLOWAY. YES AND
CAL SICK. YOU TALK ABOUT WHAT
THAT REPORTING WOULD LOOK LIKE.
AND FOR QUITE A BIT OF TIME,
THERE WASN'T ANY CLEAR GUIDANCE
REGARDING THAT REPORTING, AND
THERE STILL ISN'T REALLY NO
ESTABLISHED PROTOCOL FOR THAT
REPORTING RIGHT NOW IT'S JUST AN
EMAIL. THERE HASN'T BEEN A STATE
THERE HAS BEEN A FORMALIZED FORM
WORKFLOW PROCESS, SO IT'S UP TO
SCHOOL DISTRICTS. LOCAL SCHOOL
DISTRICTS TO DEVELOP THAT
PROCESS AND THEN OUTREACH TO
CARLO. YES, AND THERE HAS BEEN
NO. UNFORTUNATELY THERE'S BEEN
NO OUTREACH FROM THOSE STATE
PARTNERS, AND I DON'T THINK THAT
THAT'S BUT NOT FOR LACK OF
TRYING OR NOT FOR LIKE A WANT. I
THINK IT'S A LACK OF CAPACITY.
THEY SUDDENLY HAD THEIR MISSION
EXPANDED BY AND LARGE NUMBER OF
AGENCIES THAT THEY HAVE TO
OUTREACH, AND SOME OF THAT
INFRASTRUCTURE DOESN'T EXIST IN
SIGHT AS A REPRESENTATIVE OF THE
SCHOOL DISTRICTS IS HERE TO
CROSS THAT BRIDGE OR HELP THEM
CROSS THAT BRIDGE AND DEVELOP
THAT INFRASTRUCTURE BECAUSE THAT
COMMUNICATION INFRASTRUCTURE IS
GOING TO BE KEY. OKAY? DO WE
HAVE ANYTHING? UH, TO ANSWER
QUESTIONS. DO YOU HAVE ANY
QUESTIONS? ALRIGHT. UH WELL,
THIS WAS, UH I THINK ONE OF IT
WAS SHORT AND SWEET. UH I THINK
EVERYBODY PROBABLY HAS, UM, IS
HAPPY THAT THEY'RE GOING TO HAVE
AN EXTRA HOUR IN THEIR DAY. SO I
REALLY APPRECIATE IT. WE'RE
GOING TO CONTINUE TO, UM WE'RE
GOING TO CONTINUE TO FOCUS ON
THIS ISSUE. LOOK A LITTLE BIT
MORE, UH, DEEPLY. INTO THE
ISSUES THAT YOU BROUGHT UP
TODAY, ESPECIALLY FOR THE FOR
THE SCHOOLS. BUT LIKE I
MENTIONED THERE'S UH, LOCAL.
THERE ARE A LOT OF LOCAL
GOVERNMENTS AND WE REALLY HAVE
TO MAKE SURE THAT WE GET
EVERYBODY INTO THE FOLDS OF
THESE COMMENTS HAVE BEEN VERY
HELPFUL. SO THANK YOU FOR
JOINING US TODAY, AND, UM, WE
ARE GOING TO CALL, UH, MEMBERS
OF THE PUBLIC IF THEY HAVE ANY
PUBLIC COMMENTS.
ALL RIGHT. NO PUBLIC COMMENTS.
SO UM, I WOULD LIKE TO THANK
EVERYBODY FOR JOINING US. OH,
YOU DO HAVE A PUBLIC COMMENT.
OH, NO, WE WOULD. GOOD MORNING,
MADAM CHAIR MARCUS DETWEILER
WITH THE CALIFORNIA SPECIAL
DISTRICTS ASSOCIATION. UM HAPPY
TO BE HERE TODAY. WE RECENTLY
RECEIVED THE PLAN AND BEGUN OUR
ASSOCIATION'S REVIEW OF THE PLAN
. LOOKING FORWARD TO WORKING
WITH STAKEHOLDERS, HONEST
DEVELOPMENT. THANK YOU. OR
RATHER, ITS DEPLOYMENT. THANK
YOU. THANK YOU VERY MUCH FOR
JOINING US. AH! AND AGAIN, I
WOULD LIKE TO THANK ALL THE
PANELISTS THAT JOINED US TODAY
TO PRESENT TO THE COMMITTEE OF
ONE AND I'D LIKE TO HELP. THANK
ALL THE SUPPORT STAFF TO THAT
HELPED MAKE THIS HEARING
POSSIBLE. AND WITH THAT, THIS,
UH, INFORMATIONAL HEARING OF THE
ASSEMBLY SELECT COMMITTEE ON
CYBER SECURITY IS ADJOURNED.
THANK YOU.