The bill, which follows a significant cyber incident that shuttered state offices in August, has passed as amended in the Senate.
Earlier this year, Nevada began operations for its Office of Information Security and Cyber Defense (OISCD), a new division under the Governor’s Technology Office, designed to support state cyber strategy in numerous ways, including building a statewide Security Operations Center (SOC).
AB 1 would formally establish duties for the SOC, which would operate within the OISCD in the Governor’s Technology Office. It would create a financial account for the SOC and establish its funding processes. It would also require the SOC to report annually on its effectiveness.
The bill would also require the SOC — as funding permits — to develop the Cybersecurity Talent Pipeline Program. The SOC would collaborate with the Nevada System of Higher Education to do so. The program would need to support students’ career development in the fields of computer science or cybersecurity.
The bill would do several other things to support cybersecurity operations in the state, including authorizing the board of trustees of a school district to use the Governor’s Technology Office’s services and equipment, and it would make appropriations.
“This groundbreaking legislation facilitates unprecedented collaboration among state, local, K-12, higher education, and all governmental entities within Nevada, setting the stage for comprehensive cybersecurity initiatives,” state CIO Timothy Galluzi said in a post on LinkedIn.
After receiving unanimous approval from both houses of the Nevada Legislature during a special session, the legislation now awaits Gov. Lombardo’s signature, which Galluzi said in his post is “on the horizon.”
The state’s cybersecurity incident response strategy was highlighted after a security incident in August, in which bad actors moved stolen data outside of the state’s network. The state’s recovery process caused certain websites, services and phone lines to be slow or intermittently unavailable; most were back online about three weeks after the incident. Officials launched a recovery update hub to keep people informed about the process.
In the video below, Galluzi relays updates to the public about the incident during an Aug. 28 press conference. A Nov. 5 report provided additional information about data recovery.
