H-2641.1
SECOND SUBSTITUTE HOUSE BILL 2044
State of Washington 67th Legislature 2022 Regular Session
By House Appropriations (originally sponsored by Representatives
Boehnke, Hackney, Fitzgibbon, Kloba, Ormsby, Sutherland, Ramel, and
Young)
READ FIRST TIME 02/07/22.
1 AN ACT Relating to the protection of critical constituent and
2 state operational data against the financial and personal harm caused
3 by ransomware and other malicious cyber activities; amending RCW
4 43.105.054 and 43.105.220; reenacting and amending RCW 43.105.020;
5 adding new sections to chapter 43.105 RCW; adding a new section to
6 chapter 42.56 RCW; and creating new sections.
7 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
8 NEW SECTION. Sec. 1. Washington state branches of government,
9 agencies, boards, and commissions manage and protect highly sensitive
10 data in order to best serve constituents. The data managed by public
11 entities is a high value target for domestic and international
12 perpetrators of for-profit ransomware and other malicious cyber
13 activities. Breaches in data security prevent state agencies from
14 protecting confidential and sensitive information stored in
15 technology systems. In the absence of immutable data backup
16 capabilities and reliable disaster recovery practices, state agency
17 information technology systems are vulnerable to such breaches in
18 security. The legislature finds that enterprise technology programs,
19 standards, and policies have been developed for data backup and
20 recovery practices that agencies must implement to protect
21 confidential and sensitive information contained in enterprise and
p. 1 2SHB 2044
 1 individual agencies' information technology systems. The legislature
2 further finds that the availability of an enterprise identity
3 management solution, the active promotion of cybersecurity awareness
4 practices, readiness of state resources for incident management, and
5 the availability of immutable data backups of critical, sensitive,
6 and confidential data are the best protection that the state can
7 offer to combat ransomware and other malicious cyber activities. The
8 legislature recognizes that action must be taken at each state agency
9 to ensure data backup and disaster recovery practices are consistent
10 with enterprise technology standards and is aware that additional
11 investments in technology, training, and personnel will be needed.
12 NEW SECTION. Sec. 2. A new section is added to chapter 43.105
13 RCW to read as follows:
14 (1) The office shall design, develop, and implement enterprise
15 technology standards specific to malware and ransomware protection,
16 backup, and recovery, as well as prevention education for state
17 employees and constituents using state technology services.
18 (2)(a) The office shall establish a ransomware education and
19 outreach program dedicated to educating public agencies on
20 prevention, response, and remediation of ransomware.
21 (b) The office shall document, publish, and distribute ransomware
22 response educational materials specifically for chief executive
23 officers, chief financial officers, chief information officers, and
24 chief information security officers, or their equivalents, to each
25 state agency, board, and commission, which outlines specific steps to
26 take in the event of a malware attack. Distribution of materials must
27 be determined at the discretion of the office.
28 (3) Each state agency must ensure that all mission critical
29 applications, business essential applications, and other resources
30 containing data that requires special handling, as defined in
31 enterprise technology standards developed pursuant to RCW 43.105.054,
32 must be protected.
33 (4)(a) Each state agency must perform an assessment of all their
34 applications and resources containing data and report to the office
35 the sizing of managed data to include identifying mission critical
36 applications, business essential applications, and categorizing all
37 data attributes, as defined in enterprise technology standards
38 developed pursuant to RCW 43.105.054, and develop a list of
39 prioritized applications based on mission criticality and impact to
p. 2 2SHB 2044
 1 constituents in the event of system failure or data loss and submit
2 the list to the office.
3 (b) Each state agency must submit the sizing of managed data and
4 the list required in (a) of this subsection to the office by
5 September 30, 2022.
6 (5)(a) The office must analyze and aggregate data reported
7 pursuant to subsection (4) of this section.
8 (b) By October 31, 2023, the office must submit a report to the
9 governor and the appropriate committees of the legislature on the
10 following:
11 (i) The total number of mission critical applications, the total
12 amount of data associated with each mission critical application, the
13 percentage of mission critical applications with immutable backups,
14 the estimated annual data change and growth rates for each mission
15 critical application, the percentage of mission critical applications
16 that undergo annual continuity of operations exercises, and the
17 percentage that meet enterprise technology standards;
18 (ii) The total number of business essential applications, the
19 total amount of data associated with each business essential
20 application, the estimated annual data change and growth rates for
21 each business essential application, the percentage of business
22 essential applications with immutable backups, the percentage of
23 business essential applications that undergo annual continuity of
24 operations exercises, and the percentage that meet backup and
25 recovery standards of the office;
26 (iii) The percentage of applications with catalogued and
27 categorized data;
28 (iv) Prioritized applications identified by each state agency as
29 required in subsection (4)(a) of this section; and
30 (v) Recommendations for further legislation, rules, and policy
31 that will increase protections against ransomware.
32 (6) Agencies must ensure that all mission critical applications,
33 business essential applications, and other resources containing
34 category 3 and category 4 data are protected in accordance with
35 enterprise technology standards developed under RCW 43.105.054.
36 (7) The office of financial management, department of enterprise
37 services, and consolidated technology services agency must ensure
38 that all mission critical and business essential information
39 technology systems, in accordance with enterprise technology
40 standards developed under RCW 43.105.054, are compliant with the
p. 3 2SHB 2044
 1 provisions of this act and are supported by immutable backups by
2 December 31, 2025.
3 (8) The office shall provide ongoing assistance to the
4 legislature by identifying mission critical systems, as defined in
5 enterprise technology standards, that do not maintain backup and
6 recovery capabilities and may require further investment to do so.
7 The office shall modify existing portfolio reporting mechanisms
8 already in place to support the collection of relevant data necessary
9 to baseline and monitor risk associated with malware and ransomware
10 protections as prescribed by this act. The agency-reported data must
11 be analyzed for risk and used to provide the legislature with a
12 prioritized list of mission critical systems that require additional
13 protections to maintain continuity of operations in the event of
14 malicious cyber activity.
15 (9) The reports produced and information compiled pursuant to
16 subsection (5) of this section are confidential and may not be
17 disclosed under chapter 42.56 RCW.
18 (10) This section does not apply to institutions of higher
19 education.
20 NEW SECTION. Sec. 3. A new section is added to chapter 43.105
21 RCW to read as follows:
22 (1) The information technology security account is created in the
23 custody of the state treasurer. All receipts from legislative
24 appropriations to the account must be deposited in the account.
25 Expenditures from the account may only be used for the purposes
26 specified in subsection (2) of this section. Only the director of the
27 consolidated technology services agency or the director's designee
28 may authorize expenditures from the account. The account is subject
29 to allotment procedures under chapter 43.88 RCW, but an appropriation
30 is not required for expenditures.
31 (2) State agencies may apply to the consolidated technology
32 services agency to receive a disbursement from the account for the
33 purposes of procuring immutable data backup and disaster recovery
34 services for mission critical and business essential applications or
35 other critical information technology systems. When selecting
36 agencies to receive disbursements from the account, the consolidated
37 technology services agency must consider the agency's prioritized
38 application list created under section 2 of this act, in order to
p. 4 2SHB 2044
1 ensure that funding is allocated to protecting the most vulnerable
2 systems containing the most sensitive public information.
3 (3) Moneys in the account must supplement, and may supplant,
4 existing funding to the consolidated technology services agency or
5 the office of the state chief information officer.
6 NEW SECTION. Sec. 4. A new section is added to chapter 42.56
7 RCW to read as follows:
8 The reports and information compiled pursuant to section 2 (4)
9 and (5)(b) of this act are confidential and may not be disclosed
10 under this chapter.
11 Sec. 5. RCW 43.105.020 and 2021 c 176 s 5223 and 2021 c 40 s 2
12 are each reenacted and amended to read as follows:
13 The definitions in this section apply throughout this chapter
14 unless the context clearly requires otherwise.
15 (1) "Agency" means the consolidated technology services agency.
16 (2) "Board" means the technology services board.
17 (3) "Cloud computing" has the same meaning as provided by the
18 special publication 800-145 issued by the national institute of
19 standards and technology of the United States department of commerce
20 as of September 2011 or its successor publications.
21 (4) "Customer agencies" means all entities that purchase or use
22 information technology resources, telecommunications, or services
23 from the consolidated technology services agency.
24 (5) "Director" means the state chief information officer, who is
25 the director of the consolidated technology services agency.
26 (6) "Enterprise architecture" means an ongoing activity for
27 translating business vision and strategy into effective enterprise
28 change. It is a continuous activity. Enterprise architecture creates,
29 communicates, and improves the key principles and models that
30 describe the enterprise's future state and enable its evolution.
31 (7) "Equipment" means the machines, devices, and transmission
32 facilities used in information processing, including but not limited
33 to computers, terminals, telephones, wireless communications system
34 facilities, cables, and any physical facility necessary for the
35 operation of such equipment.
36 (8) "Information" includes, but is not limited to, data, text,
37 voice, and video.
p. 5 2SHB 2044
 1 (9) "Information security" means the protection of communication
2 and information resources from unauthorized access, use, disclosure,
3 disruption, modification, or destruction in order to:
4 (a) Prevent improper information modification or destruction;
5 (b) Preserve authorized restrictions on information access and
6 disclosure;
7 (c) Ensure timely and reliable access to and use of information;
8 and
9 (d) Maintain the confidentiality, integrity, and availability of
10 information.
11 (10) "Information technology" includes, but is not limited to,
12 all electronic technology systems and services, automated information
13 handling, system design and analysis, conversion of data, computer
14 programming, information storage and retrieval, telecommunications,
15 requisite system controls, simulation, electronic commerce, radio
16 technologies, and all related interactions between people and
17 machines.
18 (11) "Information technology portfolio" or "portfolio" means a
19 strategic management process documenting relationships between agency
20 missions and information technology and telecommunications
21 investments.
22 (12) "K-20 network" means the network established in RCW
23 43.41.391.
24 (13) "Local governments" includes all municipal and quasi-
25 municipal corporations and political subdivisions, and all agencies
26 of such corporations and subdivisions authorized to contract
27 separately.
28 (14) "Office" means the office of the state chief information
29 officer within the consolidated technology services agency.
30 (15) "Oversight" means a process of comprehensive risk analysis
31 and management designed to ensure optimum use of information
32 technology resources and telecommunications.
33 (16) "Proprietary software" means that software offered for sale
34 or license.
35 (17) "Public agency" means any agency of this state or another
36 state; any political subdivision or unit of local government of this
37 state or another state including, but not limited to, municipal
38 corporations, quasi-municipal corporations, special purpose
39 districts, and local service districts; any public benefit nonprofit
p. 6 2SHB 2044
 1 corporation; any agency of the United States; and any Indian tribe
2 recognized as such by the federal government.
3 (18) "Public benefit nonprofit corporation" means a public
4 benefit nonprofit corporation as defined in RCW 24.03A.245 that is
5 receiving local, state, or federal funds either directly or through a
6 public agency other than an Indian tribe or political subdivision of
7 another state.
8 (19) "Public record" has the definitions in RCW 42.56.010 and
9 chapter 40.14 RCW and includes legislative records and court records
10 that are available for public inspection.
11 (20) "Public safety" refers to any entity or services that ensure
12 the welfare and protection of the public.
13 (21) "Security incident" means an accidental or deliberative
14 event that results in or constitutes an imminent threat of the
15 unauthorized access, loss, disclosure, modification, disruption, or
16 destruction of communication and information resources.
17 (22) "State agency" means every state office, department,
18 division, bureau, board, commission, or other state agency, including
19 offices headed by a statewide elected official.
20 (23) "Telecommunications" includes, but is not limited to,
21 wireless or wired systems for transport of voice, video, and data
22 communications, network systems, requisite facilities, equipment,
23 system controls, simulation, electronic commerce, and all related
24 interactions between people and machines.
25 (24) "Utility-based infrastructure services" includes personal
26 computer and portable device support, servers and server
27 administration, security administration, network administration,
28 telephony, email, and other information technology services commonly
29 used by state agencies.
30 (25) "Immutable" means data that is stored unchanged over time or
31 unable to be changed. For the purposes of backups, this means that,
32 once ingested, no external or internal operation can modify the data
33 and must never be available in a read/write state to the client.
34 "Immutable" specifically applies to the characteristics and
35 attributes of a backup system's file system and may not be applied to
36 temporary systems state, time-bound or expiring configurations, or
37 temporary conditions created by a physical air gap as is implemented
38 in most legacy systems. An immutable file system must demonstrate
39 characteristics that do not permit the editing or changing of any
p. 7 2SHB 2044
 1 data backed up to provide agencies with absolute recovery
2 capabilities.
3 (26) "Malicious cyber activities" means activities, other than
4 those authorized by or in accordance with United States law, that
5 seek to compromise or impair the confidentiality, integrity, or
6 availability of computers, information or communications systems,
7 networks, physical or virtual infrastructure controlled by computers
8 or information systems, or information resident thereon.
9 (27) "Ransomware" means any type of malicious software code,
10 executable, application, payload, or digital content designed to
11 encrypt, steal, exfiltrate, delete, destroy, or deny access to any
12 data, databases, systems, applications, networks, data centers, cloud
13 computing environment, cloud service, or other mission critical or
14 business essential infrastructure.
15 Sec. 6. RCW 43.105.054 and 2021 c 291 s 9 are each amended to
16 read as follows: