Legislative Analyst provides overview of information security proposals in proposed 2023-24 California State budget

The California State Legislative Analyst’s Office will publish shorter, more focused budget analyses over the next few months. In most cases, rather than sending out an announcement for each publication, we will provide periodic updates with the key takeaways from recent pieces. All of our 2023-24 budget analyses to date can be found here.

The 2023-24 Budget: Overview of Information Security Proposals

• Governor’s Budget Includes 26 Information Security (IS) Proposals Totaling $64.4 Million ($70.6 Million General Fund). Of the 26 total proposals, the Governor’s 2023-24 budget includes two major proposals to augment funding and positions for the California Cybersecurity Integration Center (Cal-CSIC) ($28.7 million) and to implement AB 2355 on school cybersecurity ($5.4 million).
• Legislative Oversight of IS Activities and Budget Support Information Merited. Limited oversight of the state’s first five-year IS roadmap—Cal-Secure—along with a lack of standardized disclosure of IS information in support of budget proposals merits oversight from the Legislature. We also find merit in both Cal-CSIC proposals, but the proposed funding and position augmentations would benefit from measurable goals and outcomes and the proposed school cybersecurity resources exceed the mandates of AB 2355.
• Recommend Reporting to Legislature, Prioritizing New Cal-CSIC Funding, and Rejecting of Most Proposed AB 2355 Funding. We recommend the Legislature direct the administration to report to the Legislature on Cal-Secure implementation and its evaluation of options for standardized disclosure of information in support of IS proposals. We also recommend the Legislature direct Cal-CSIC to prioritize the funding and positions requested in its augmentation proposal, and require reporting on goals and outcomes for any new funding. For the AB 2355 funding request, we recommend approving only the funding necessary to meet the legislation’s statutory requirements.