2014 -- H 7533

========

LC004438

========

     STATE OF RHODE ISLAND

IN GENERAL ASSEMBLY

JANUARY SESSION, A.D. 2014

____________

A N   A C T

RELATING TO PUBLIC FINANCE - POST AUDIT OF ACCOUNTS

     Introduced By: Representatives Phillips, Casey, Abney, Tomasso, and Shekarchi

     Date Introduced: February 26, 2014

     Referred To: House Corporations

     (Administration)

It is enacted by the General Assembly as follows:

     SECTION 1. Chapter 35-7 of the General Laws entitled “Post Audit of Accounts” is

hereby amended by adding thereto the following section:

     35-7-15. Audit of information security systems. – (a) The general assembly recognizes

that the security of government computer systems is essential to ensuring the stability and

integrity of vital information gathered and stored by the government for the benefit of the

citizenry and the breach of security over computer systems presents a risk to the health, safety,

and welfare of the public. It is the intent of the legislature to insure that government computer

systems and information residing on these systems are protected from unauthorized access,

compromise, sabotage, hacking, viruses, destruction, illegal use, cyber attack or any other act

which might jeopardize or harm the computer systems and the information stored on them.

     (b) In conjunction with the powers and duties outlined in this chapter, the bureau of

audits may conduct reviews and assessments of the various government computer systems and

the security systems established to safeguard these computer systems. Computer systems subject

to this section shall include systems which pertain to federal, state, or local programs, and quasi-

governmental bodies, and the computer systems of any entity or program which is subject to audit

by the bureau of audits. The bureau of audit’s review may include an assessment of system

vulnerability, network penetration, potential security breaches, and susceptibility to cyber attack

and cyber fraud.

     (c) In the event the review by the bureau of audits indicates a computer system is

vulnerable, or security over the system is lacking, those findings shall not be disclosed publicly

and shall not be considered public records. Notwithstanding any other provision of law to the

contrary, the work papers developed in connection with the review of the computer system and

the security over the system shall not be deemed public records and are not subject to disclosure.

The bureau of audit’s findings may be disclosed at the discretion of the bureau of audits to the

chief information officer and the director of administration. Unless the bureau of audits authorizes

the release of information or findings gathered in the conduct of a review of computer system

security, all such information shall be deemed classified, confidential, secret, and non-public.

     (d) In order to maintain the integrity of the computer system, the bureau of audits may

procure the services of specialists in information security systems or other contractors deemed

necessary in conducting reviews under this section, and in procuring those services shall be

exempt from the requirements of the state purchasing law or regulation.

     (e) Any outside contractor or vendor hired to provide services in the review of the

security of a computer system shall be bound by the confidentiality provisions of this section.

SECTION 2. This act shall take effect upon passage.

========

LC004438

========

LC004438 - Page 2 of 3

EXPLANATION

BY THE LEGISLATIVE COUNCIL

OF

A N   A C T

RELATING TO PUBLIC FINANCE - POST AUDIT OF ACCOUNTS

***

     This act would provide that the bureau of audits may conduct reviews and assessments of

government computer systems and the security systems that safeguard the computer systems.

This act would further provide that in the event the bureau of audits determines a system to be

vulnerable or lacking such findings shall not be publicly disclosed or considered a public record.

     This act would take effect upon passage.

========

LC004438

========

LC004438 - Page 3 of 3