Bill > AB869

This bill requires California state agencies to implement Zero Trust architecture, a cybersecurity approach that continuously verifies the identity and security posture of every user and device before granting access, regardless of whether they are inside or outside the organization's network. Specifically, the bill mandates that state agencies must achieve "Advanced" maturity by June 1, 2026, and "Optimal" maturity by June 1, 2030, based on the Cybersecurity and Infrastructure Security Agency (CISA) Maturity Model. Agencies must prioritize solutions that align with federal cybersecurity guidelines and, at minimum, implement multifactor authentication, enterprise endpoint detection and response solutions, and robust logging practices. The bill requires the Chief of the Office of Information Security to develop uniform technology policies and update annual reporting requirements to track agencies' progress in improving their cybersecurity defenses. The legislation aims to address recent cyber breaches by enhancing the state's ability to mitigate threats, limit data breach impacts, and protect the state's workforce and residents. The bill applies to all state agencies, with a specific provision allowing the University of California to opt-in through a resolution by its Regents, and emphasizes implementation should be consistent with federal funding requirements.

Budget and Finance, Business and Industry, Government Affairs

https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB869