HB5483 103RD GENERAL ASSEMBLY

LRB103 37636 MXP 67763 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
HB5483

Introduced 2/9/2024, by Rep. Edgar Gonzalez, Jr.

SYNOPSIS AS INTRODUCED:

30 ILCS 5/3-2.4
30 ILCS 5/3-4	from Ch. 15, par. 303-4
30 ILCS 5/3-14	from Ch. 15, par. 303-14
30 ILCS 5/3-15	from Ch. 15, par. 303-15
30 ILCS 5/6-1	from Ch. 15, par. 306-1

Amends the Illinois State Auditing Act. Provides that in order to protect and preserve the integrity, security, and confidentiality of the network, infrastructure, and data of a State agency, any findings resulting from the testing conducted under the provisions shall be included within the applicable State agency's compliance examination report and made available only to the applicable State agency under review. Provides that in order to protect and preserve the integrity, security, and confidentiality of the network, infrastructure, and data of a State agency, any investigations, findings, and recommendations pertaining to State agencies and their information technology controls, privacy programs and practices, and cybersecurity programs and practices, must be redacted and withheld from public disclosure. Restricts the Auditor General from disclosing the contents of the specific findings or recommendations except as permitted. Provides that all audit reports shall be maintained in the Office of the Auditor General as a public record. Establishes that where records or information are required to be disclosed, the Office of the Auditor General shall collect, maintain, and store, all records or information classified as confidential, legally protected, or maintaining an equivalent or greater privacy designation, under the same or greater privacy and security requirements to which such records or information were disclosed by the State agency to the Office of the Auditor General. Effective immediately.

A BILL FOR

AN ACT concerning transportation.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The Illinois State Auditing Act is amended by changing Sections 3-2.4, 3-4, 3-14, 3-15, and 6-1 as follows:

(30 ILCS 5/3-2.4)

Sec. 3-2.4. Cybersecurity audit.

(a) In conjunction with its annual compliance examination program, the Auditor General shall review State agencies and their cybersecurity programs and practices, with a particular focus on agencies holding large volumes of personal information.

(b) The review required under this Section shall, at a minimum, assess the following:

(1) the effectiveness of State agency cybersecurity practices;

(2) the risks or vulnerabilities of the cybersecurity systems used by State agencies;

(3) the types of information that are most susceptible to attack;

(4) ways to improve cybersecurity and eliminate vulnerabilities to State cybersecurity systems; and

(5) any other information concerning the cybersecurity of State agencies that the Auditor General deems necessary and proper.

(c) In order to protect and preserve the integrity, security, and confidentiality of the network, infrastructure, and data of a State agency, any Any findings resulting from the testing conducted under this Section shall be included within the applicable State agency's compliance examination report and made available only to the applicable State agency under review. Each compliance examination report shall be issued in accordance with the provisions of Section 3-14. A copy of the report shall also be delivered to the head of the applicable State agency and posted on the Auditor General's website.

(Source: P.A. 100-914, eff. 1-1-19.)

(30 ILCS 5/3-4) (from Ch. 15, par. 303-4)

Sec. 3-4. Investigations.

The Auditor General shall make such investigations as are directed by either house of the General Assembly or by the Commission in a resolution specifying the acts, transactions or practices to be the subject of the investigation.

The resolution directing such an investigation may specify to whom the Auditor General shall make his findings and recommendations after the investigation and whether those findings and recommendations are to be made public.

Unless the resolution directing the investigation provides otherwise, the Auditor General shall direct and provide his findings and recommendations to the Commission, to the Governor, to the official in charge of each agency included in the investigation and to each person who was named individually as a subject of investigation by the directing resolution, except as restricted hereunder. No other publicity shall be given to the report and recommendations other than is provided by this paragraph.

The Auditor General may recommend to the Commission that an investigation be directed with regard to any matter which he believes to be in the public interest to investigate.

In order to protect and preserve the integrity, security, and confidentiality of the network, infrastructure, and data of a State agency, any investigations, findings, and recommendations pertaining to State agencies and their information technology controls, privacy programs and practices, and cybersecurity programs and practices, must be redacted and withheld from public disclosure.

Investigations, findings, and recommendations under this Section, pertaining to State agencies and their information technology controls, privacy programs and practices, and cybersecurity programs and practices, shall be made available only to the applicable State agency under review, shall be delivered to the official in charge of the agency included within the investigation, and shall be delivered to each person who was named individually as a subject of the investigation by the directing resolution.

When investigations are directed under this Section, and pertain to State agencies and their information technology controls, privacy programs and practices, and cybersecurity programs and practices, the Auditor General shall direct and provide the numerical number of findings and affirmatively state whether recommendations were made, to those specified by the resolution directing such an investigation and all others required by this Section. At no time may the Auditor General disclose the contents of the specific findings or recommendations except as permitted hereunder.

(Source: P.A. 78-884.)

(30 ILCS 5/3-14) (from Ch. 15, par. 303-14)

Sec. 3-14. Audit reports. Upon completion of any audit the Auditor General shall issue an audit report which shall include: a precise statement of the scope of the audit or review, a statement of the material findings resulting from the audit, a statement of the underlying cause, evaluative criteria used and the current and prospective significance thereof and a statement of explanation or rebuttal which may have been submitted by the agency audited relevant to the audit findings included in the report.

As part of this report the Auditor General shall prepare a signed digest of the legislatively significant matters of the report and, as may be applicable, a concise statement of (1) any actions taken or contemplated by persons or agencies subsequent to the completion of the audit but prior to the release of the report, which bear on matters in the report, (2) any actions the Auditor General considers necessary or desirable, and (3) any other information the Auditor General deems useful to the General Assembly in order to understand or act on any matters presented in the audit.

The Auditor General shall submit a copy of each audit report to the Commission, the Governor, the Speaker and minority leader of the House of Representatives and the President and minority leader of the Senate.

All audit reports shall be maintained in the Office of the Auditor General as a public record, subject to Section 3-11.

In order to protect and preserve the integrity, security, and confidentiality of the network, infrastructure, and data of a State agency, all audit reports containing findings and recommendations pertaining to State agencies and their information technology controls, privacy programs and practices, and cybersecurity programs and practices, must be redacted and withheld from public disclosure. The unredacted findings and recommendations pertaining to State agencies and their cybersecurity programs and practices shall be made available only to the applicable State agency under review; provided however, a State agency may disclose findings and recommendations to a duly authorized third-party who is providing services or otherwise assisting the State agency subject to the findings and recommendations with its cybersecurity plan and operations.

All audit reports shall be maintained in the Office of the Auditor General as a public record, subject to Section 3-11.

If the post audit of a State agency discloses an apparent violation of a penal statute or an apparent instance of misfeasance, malfeasance or nonfeasance, by any person, relating to the obligation, expenditure, receipt or use of public funds of the State, the Auditor General shall immediately make a written report to the Commission and the Governor stating that to be the case and setting forth the underlying facts that have led to that conclusion.

(Source: P.A. 82-368.)

(30 ILCS 5/3-15) (from Ch. 15, par. 303-15)

Sec. 3-15. Reports of Auditor General. By March 1, each year, the Auditor General shall submit to the Commission, the General Assembly and the Governor an annual report summarizing all audits, investigations and special studies made under this Act during the last preceding calendar year.

As it relates to information technology controls, privacy programs and practices, and cybersecurity findings and recommendations, in order to protect and preserve the integrity, security, and confidentiality of the network, infrastructure, and data of a State agency, reports under this Section may only contain the numerical number of information technology controls, privacy programs and practices, and cybersecurity findings and affirmatively state whether recommendations were made. At no time may the Auditor General disclose the contents of the specific findings or recommendations except as permitted hereunder.

Once each 3 months, the Auditor General shall submit to the Commission a quarterly report concerning the operation of his office, including relevant fiscal and personnel matters, details of any contractual services utilized during that period, a summary of audits and studies still in process and such other information as the Commission requires.

The Auditor General shall prepare and distribute such other reports as may be required by the Commission.

All post audits directed by resolution of the House or Senate shall be reported to the members of the General Assembly, unless the directing resolution specifies otherwise.

The requirement for reporting to the General Assembly shall be satisfied by filing copies of the report as required by Section 3.1 of the General Assembly Organization Act, and filing such additional copies with the State Government Report Distribution Center for the General Assembly as is required under paragraph (t) of Section 7 of the State Library Act.

(Source: P.A. 100-1148, eff. 12-10-18.)

(30 ILCS 5/6-1) (from Ch. 15, par. 306-1)

Sec. 6-1. Effect on other laws. The powers and duties of the Auditor General under this Act and the system of audits established by this Act are in addition to any other powers, duties or audits required or authorized by law.

Where records or information are classified as confidential, legally protected, or records or information with maintain an equivalent or greater privacy designation, by or pursuant to law, such records or information shall be disclosed to the Office of the Auditor General as necessary and to the extent required for the performance of an authorized post audit. Federal tax information shall only be provided in accordance with federal law and regulation applicable to the safeguarding of federal tax information.

Where records or information are required to be disclosed, the Office of the Auditor General shall collect, maintain, and store, all records or information classified as confidential, legally protected, or with maintaining an equivalent or greater privacy designation, under the same or greater privacy and security requirements to which such records or information were disclosed by the State agency to the Office of the Auditor General.

Confidential records or information disclosed to the Office of the Auditor General shall be subject to the same legal, confidentiality, legal confidentiality and protective restrictions in the Office of the Auditor General as such records and information have in the hands of the official authorized custodian. Any penalties applicable to the officially authorized custodian or his employees for the violation of any confidentiality or protective restrictions applicable to such records or information shall also apply to the officers, employees, contractors, and agents of the Office of the Auditor General.

The Office of the Auditor General may not publish any confidential legally protected, or records or information with an equivalent or greater privacy designation, information or records in any report, including data and statistics, if such information as published is directly or indirectly matchable to any individual.

The Office of the Auditor General may not publish any records or information in any report, generated by, through, in conjunction with, or on behalf of the Office of the Auditor General, which includes any of the following data disclosed by a State agency: Cybersecurity assessments, cybersecurity measures, and cybersecurity response policies or plans and the like, that are designed to identify, prevent, or respond to potential cyberattacks upon a public body or agency's personnel or systems, facilities, or installations, the destruction or exploitation of which would constitute a clear and present danger to the health, safety or security of the public body or agency. For the purposes of this Section, records and information detailing the mobilization and deployment of personnel, vendors, teams, or equipment in preparation or response to a cybersecurity policy or plan and the like, the cybersecurity or privacy product and solutions names or configurations and the like, the operation of communication systems or protocols and the like, or other cybersecurity operations and the like, may not be published.

Inside the Office of the Auditor General, confidential legally protected, or records or information with an equivalent or greater privacy designation, records or information may be used only for official purposes.

Any officer, employee, contractor, or agent of the Office of the Auditor General who violates any legal confidentiality or protective restriction, or privacy and security requirement, governing any records or information shall be guilty of a Class A misdemeanor unless a greater penalty is otherwise provided by law.

Where this Act expressly governs or grants authority for regulations to govern other auditing procedures, this Act supersedes all other statutes to the contrary. To the extent that this Act conflicts with another statute, this Act prevails.

Except as provided in this Section, this Act does not supersede or repeal by implication any other statute.

(Source: P.A. 102-61, eff. 7-9-21.)

Section 99. Effective date. This Act takes effect upon becoming law.