2019 Oregon Revised Statutes
Volume : 07 - Public Facilities and Finance
Chapter 276A - Information Technology
Section 276A.329 - Oregon Cybersecurity Center of Excellence.
The State Chief Information Officer shall develop a plan for the establishment of an Oregon Cybersecurity Center of Excellence. The State Chief Information Officer shall submit the plan to an appropriate committee or interim committee of the Legislative Assembly no later than January 1, 2019. The plan must identify any grants, donations, gifts or other form of conveyance of land, money, real or personal property or other valuable thing made to the state from any source that is expected to support the establishment and continued operation of the center. The plan must also include a description of the actions, timelines, budget and positions or contractor resources required for the center to:
(1) Coordinate information sharing related to cybersecurity risks, warnings and incidents.
(2) Provide support regarding cybersecurity incident response and cybercrime investigations.
(3) Serve as an Information Sharing and Analysis Organization pursuant to 6 U.S.C. 133 et seq., and as a liaison with the National Cybersecurity and Communications Integration Center within the United States Department of Homeland Security, other federal agencies and other public and private sector entities on issues relating to cybersecurity.
(4) Identify and participate in appropriate federal, multistate or private sector programs and efforts that support or complement the center’s cybersecurity mission.
(5) Receive and appropriately disseminate relevant cybersecurity threat information from appropriate sources, including the federal government, law enforcement agencies, public utilities and private industry.
(6) Draft and biennially update an Oregon Cybersecurity Strategy and a Cyber Disruption Response Plan to be submitted to the Governor and an appropriate committee or interim committee of the Legislative Assembly. The plan must:
(a) Detail the steps that the state should take to increase the resiliency of its operations in preparation for, and during the response to, a cyber disruption event;
(b) Address high-risk cybersecurity for the state’s critical infrastructure, including a review of information security technologies currently in place to determine if current policies are sufficient to prevent the compromise or unauthorized disclosure of critical or sensitive government information inside and outside the firewall of state agencies, and develop plans to better identify, protect from, detect, respond to and recover from significant cyber threats;
(c) Establish a process to regularly conduct risk-based assessments of the cybersecurity risk profile, including infrastructure and activities within this state;
(d) Provide recommendations related to securing networks, systems and data, including interoperability, standardized plans and procedures, evolving threats and best practices to prevent the unauthorized access, theft, alteration or destruction of data held by the state;
(e) Include the recommended content and timelines for conducting cybersecurity awareness training for state agencies and the dissemination of educational materials to the public and private sectors in this state through the center;
(f) Identify opportunities to educate the public on ways to prevent cybersecurity attacks and protect the public’s personal information;
(g) Include strategies for collaboration with the private sector and educational institutions through the center and other venues to identify and implement cybersecurity best practices; and
(h) Establish data breach reporting and notification requirements in coordination with the Department of Consumer and Business Services. [2017 c.513 §4]
