Post on 16-Dec-2015
transcript
Legislative Update
Pat Burns, CSU and
Jeanette VanGalder, UNC
4/19/2006 Legislative Update 2
Theme
“If you like the law or you like sausage, you should never watch either of them being made.” Otto von Bismark
4/19/2006 Legislative Update 3
Topics
Executive Orders State Legislation Federal Legislation
4/19/2006 Legislative Update 4
Executive Orders
“Refresh” of Governor’s original Executive Order of 12/28/00 that mandated higher ed participate in the MNT Higher ed again mentioned prominently Extends the term of the Order indefinitely However, higher ed still operates under the
exemption granted by Troy Eid to Tim Foster MNT exploring its future
Uncertain what might transpire in this regard
4/19/2006 Legislative Update 5
State Legislation
S 24, H ? – the SASID Requires use of the 10-digit State Assigned
Student ID (SASID) from K-12 to be used for reporting purposes
Goal is greater accountability (?) Do not believe that we need to accept its use for
delivery of services (e.g. COF stipends, web services, etc.)
Rick Beck has a Banner mod queued up
4/19/2006 Legislative Update 6
S 10, H 1157 – CISO Legislation Establishes a CISO, to be appointed by the
Governor Funds the CISO office via State Agency budgets
after year 1 Requires State Agencies to
Implement IT Security policies and procedures developed by the CISO
Gives the CISO authority to suspend services Institutes reporting requirements
Amended to include a section pertaining to higher ed (see next page) Higher ed fiscal note was not included in the legislation?
4/19/2006 Legislative Update 7
Section 24-37.5-404.5. Institutions of higher education…1. By July 1, 2007, each institution shall develop an
IT security plan, in coordination with CCHE
2. Includinga) Periodic risk assessments…
b) Process for providing adequate IT security…
c) Information security awareness training…
d) Periodic testing of the effectiveness…
e) A process for detecting, reporting and responding to security incidents… and reporting them to the CISO
f) Plans and procedures to ensure continuity of operations…
4/19/2006 Legislative Update 8
Section 24-37.5-404.5. Institutions of higher education… (cont’d)3. By July 1, 2007, the plans shell be submitted to
CCHE who will then submit them to the CISO
Comments on HB 1157 IT environments in higher ed are vastly different from
those in state agencies Our focus should be risk management, rather than
adherence to specific policies and procedures Our amendment was accepted with the understanding
that our IT security incidents must stop! Impractical, but we must do our best Monthly meetings queued up (3rd Tuesday, 9 AM to noon)
4/19/2006 Legislative Update 9
Other State Legislation
Pertains to State Agencies, and not higher ed (for now) – multiple bills Strengthens OIT oversight Strengthens IMC oversight Requires formal project management
A new class description in the state personnel system Requires Independent validation and verification
(IV&V) Why? Reaction to large, disastrous state “IT
projects,” incl. CBMS and others
4/19/2006 Legislative Update 10
Comments
Apparently, there is a strong desire to include higher ed under the oversight of both the IMC and OIT Incongruous with the funding MOU between the JBC and
CCHE in the mid-80’s We do not understand this, because we have
universally conducted successful projects Sometimes with expected “burps,” but generally successful
and with very limited resources Julie agreed to have the CCHE CIO Council prepare an
analysis of such oversight this summer, and present it to John Picanso, State CIO
More to come…
4/19/2006 Legislative Update 11
Federal Legislation
S. 1294 – The Community Broadband Act of 2005: McCain-Lautenberg Prevents “a state or political subdivision thereof, any agency,
authority, or instrumentality of a state or political subdivision thereof, or any Indian tribe” from enacting legislation that prohibits local governments and states from providing broadband services, either directly or in partnership with private-sector providers;
Ensures that local governments cannot use their regulatory authority to discriminate against private-sector providers of broadband services; and
Ensures that federal and state telecommunications laws and regulations apply to all providers.
4/19/2006 Legislative Update 12
Federal Legislation (cont’d)
CALEA FCC ruling that it pertains to our WAN connections If approached, put a “sniffer” on the traffic, assist as best
you can S. 1408 – Identity Theft Protection Act (from 2005)
Originally, significant bipartisan support, but now in limbo Corrects and codifies the California Legislation See the following for a detailed summary
4/19/2006 Legislative Update 13
U.S. Senate Bill S. 1408, the Identity Theft Protection Act Patterned after California legislation, with “fixes”
The California legislation required notification in the event of identity theft, and “opened the flood gates”
Observation: identity theft has been much more prevalent than we had thought
Significant bi-partisan support References
http://commerce.senate.gov/pdf/s1408-asreported.pdf. http://commerce.senate.gov/newsroom/printable.cfm?id=24
2027.
4/19/2006 Legislative Update 14
High-level Summary of S. 1408 Covered entities:
All entities, including schools, that collect social security numbers or any other sensitive personal information that the FTC determines can be used for identity theft.
Sensitive Personal Information: an individual’s name, address, or telephone number with:
1. Social security number, taxpayer ID number, or employer identification number derived from social security number;
2. Financial account/credit card number combined with password or access code; and/or
3. Driver’s license identification number.
4/19/2006 Legislative Update 15
Summary of S. 1408 (cont’d) Requirements
1. Security Program - Develop and enforce a written security program for personal information to protect against anticipated threats to or unauthorized access. 1. Compliance with the GLBA is sufficient
2. Reports - Report any security breach to the FTC and—for breaches affecting 1,000 or more individuals—report as well to consumer credit reporting agencies.
3. Investigation - Investigate the security breach to determine whether or not it poses a reasonable risk of identity theft.
4/19/2006 Legislative Update 16
Summary of S. 1408 (cont’d) Requirements (cont’d)
4. Notification - to each individual affected by the breach, if the investigation shows there is a reasonable risk of identity theft.
Notice may be provided in either written or electronic form and must be provided within 45 days of the discovery of the security breach.
If done electronically, the notice must be consistent with the Electronic Signatures in Global and National Commerce Act.
See http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=106_cong_public_laws&docid=f:publ229.106.pdf.
A substitute notice may be provided in cases where either the cost exceeds $250,000; the number of individuals to be notified exceeds 500,000; or the entity does not have sufficient contact information for the affected individuals. Such may be via email ((if the entity has e-mail addresses for the affected individuals); and must also include:
Conspicuous posting on the entity’s Web site; and Notification to State-wide media.
4/19/2006 Legislative Update 17
Summary of S. 1408 (cont’d) Requirements (cont’d)
5. Contents of Notice1. Individual’s name;
2. Entity where the breach occurred;
3. Dates of the security breach and of its discovery;
4. Categories of personal information subject to the breach; and
5. Toll-free numbers for the entity subject to the breach, all nationwide credit reporting agencies, and the FTC.
4/19/2006 Legislative Update 18
Summary of S. 1408 (cont’d) Penalties: Entities that fail to provide the require notification are
subject to fines Up to $11,000 per individual subject to a breach Capped at $11 million for a single breach
Social Security Numbers: A school or other covered entity may not Obtain a social security number from any individual unless there
is a specific use for it and no other identifier can reasonably be used.
Social security numbers (or derivatives) may not be displayed on student or employee identification cards.
No Private Right of Action; Pre-emption of State and Local Laws: The legislation prohibits a private right of action and also pre-empts State and local laws in this area.
4/19/2006 Legislative Update 19
Comments on S. 1408
Not well defined what constitutes: An investigation, or A reasonable risk of identity theft
Permits collection of SSN’s For resolving identities, if no other reasonable
means of so doing are available At CSU, we have adopted this stance: we will
continue to collect SSNs for all of our constituents, and to protect them diligently
4/19/2006 Legislative Update 20
Questions
Are more than welcome.