state of michigan

100th Legislature

Regular session of 2020

Introduced by Reps. VanWoerkom, Schroeder, Webber, Hall, LaFave and LaGrand

ENROLLED HOUSE BILL No. 5427

AN ACT to amend 2017 PA 132, entitled An act to create a program under which volunteers may provide services to organizations in this state to respond to cybersecurity incidents; to provide for protection from liability for personal injury and property damage; to provide for the powers and duties of state governmental officers and agencies; and to create the Michigan cyber civilian corps advisory board and prescribe its powers and duties, by amending sections 9 and 10 (MCL 18.229 and 18.230).

The People of the State of Michigan enact:

Sec. 9. (1) The Michigan cyber civilian corps advisory board is created as an advisory body within the department.

(2) The Michigan cyber civilian corps advisory board is composed of the adjutant general, the director of the department, the director of the department of state police, and the director of the department of talent and economic development or their designees.

(3) The Michigan cyber civilian corps advisory board shall review and make recommendations to the department regarding the policies and procedures used by the department in implementing this act.

(4) The advisory board must meet at least twice annually.

(5) The advisory board shall review and make recommendations on individuals applying for nondeployable advisor status.

 

Sec. 10. (1) After consultation with the advisory board, the chief information officer shall do all of the following:

(a) Approve the set of tools that the Michigan cyber civilian corps may use in response to a cybersecurity incident.

(b) Determine the standards of expertise necessary for an individual to become a member of the Michigan cyber civilian corps.

(c) Establish and maintain a formal process to track volunteer and advisor trainings and compliance with standards as determined by the department.

(2) After consultation with the advisory board, the department shall publish guidelines for the operation of the Michigan cyber civilian corps program. At a minimum, the published guidelines must include the following:

(a) An explanation of the standard the department will use to determine whether an individual may serve as a Michigan cyber civilian corps volunteer and an explanation of the process by which an individual may become a Michigan cyber civilian corps volunteer.

(b) An explanation of the requirements the department will impose for a client to receive the assistance of the Michigan cyber civilian corps and an explanation of the process by which a client may request and receive the assistance of the Michigan cyber civilian corps.

(c) An explanation of the process by which the Michigan cyber civilian corps will select and prioritize which prospective clients should receive assistance.

(3) The department may enter into contracts with clients as a condition to providing assistance through the Michigan cyber civilian corps.

(4) The department may provide appropriate training to individuals who wish to participate in the Michigan cyber civilian corps and to existing Michigan cyber civilian corps volunteers and advisors.

(5) The department may provide compensation for actual and necessary travel and subsistence expenses incurred by Michigan cyber civilian corps volunteers on a deployment at the discretion of the department.

(6) The department may establish a fee schedule for clients that wish to use the assistance of the Michigan cyber civilian corps. The department may recoup expenses through the fees but may not generate a profit.

(7) Information voluntarily given to the Michigan cyber command center or obtained under this act that would identify or provide a means of identifying a person that may, as a result of disclosure of the information, become a victim of a cybersecurity incident or that would disclose a persons cybersecurity plans or cybersecurity-related practices, procedures, methods, results, organizational information system infrastructure, hardware, or software is exempt from disclosure under the freedom of information act, 1976 PA 442, MCL 15.231 to 15.246.

 

Enacting section 1. This amendatory act does not take effect unless House Bill No. 5426 of the 100th Legislature is enacted into law.

 

Clerk of the House of Representatives

Secretary of the Senate

Approved___________________________________________

____________________________________________________

Governor