Bill > SB373

This bill establishes comprehensive information technology and cybersecurity standards for Pennsylvania state agencies, creating a new framework for managing and securing digital infrastructure. The legislation empowers the Chief Information Officer to develop and enforce statewide security standards, including requirements for data classification, encryption, and risk management. Key provisions include mandating that all state technology systems obtain an "authorization to operate" after rigorous security assessments, which may involve penetration testing and evaluation of various security domains like identity management and network security. The bill also creates a Joint Cybersecurity Oversight Committee composed of diverse stakeholders from government, law enforcement, and the private sector, tasked with reviewing cybersecurity policies, discussing emerging threats, and preparing reports for state leadership. The committee will meet quarterly and can conduct both public and confidential sessions to protect sensitive information. Additionally, the legislation requires biannual assessments of vendors' compliance with security standards and gives the Chief Information Officer the authority to directly manage the information technology security of agencies that fail to meet established standards. The overall goal is to maximize the functionality, security, and interoperability of the Commonwealth's technology assets while protecting against potential cyber threats.

Business and Industry

https://www.legis.state.pa.us/cfdocs/billinfo/bill_history.cfm?syear=2025&sind=0&body=S&type=B&bn=373