2017 ORS 276A.323¹
State agency coordination

(1) As used in this section:

(a) “Executive department” has the meaning given that term in ORS 174.112 (“Executive department” defined), except that “executive department” does not include:

(A) The Secretary of State.

(B) The State Treasurer.

(C) The Attorney General.

(D) The Oregon State Lottery.

(E) Public universities listed in ORS 352.002 (Public universities).

(b) “State agency” means an agency, as defined in ORS 183.310 (Definitions for chapter), in the executive department.

(2) All state agencies shall:

(a) Cooperate with the office of the State Chief Information Officer in the implementation of a continuing statewide agency-by-agency risk-based information technology security assessment and remediation program.

(b) Cooperate in the development of, and follow, the plans, rules, policies and standards adopted by the State Chief Information Officer with regard to the unification of agency information technology security functions in this state.

(c) Conduct and document the completion of annual information technology security awareness training for all agency employees.

(d) Report security metrics using methodologies developed by the office of the State Chief Information Officer.

(e) Participate in activities coordinated by the office of the State Chief Information Officer in order to better understand and address security incidents and critical cybersecurity threats to the state.

(3) The State Chief Information Officer shall determine and allocate the costs to state agencies associated with providing information technology services, third-party security evaluations, vulnerability assessments and remediation measures. State agencies shall pay the costs to the State Chief Information Officer in the same manner as the state agency pays other claims. The State Chief Information Officer shall deposit into the State Information Technology Operating Fund established under ORS 276A.209 (State Information Technology Operating Fund) all moneys that the State Chief Information Officer receives from state agencies for purposes of providing information technology services and administering and enforcing the duties, functions and powers under this section. [2017 c.513 §2]

1 Legislative Counsel Committee, CHAPTER 276A—Information Technology, https://­www.­oregonlegislature.­gov/­bills_laws/­ors/­ors276A.­html (2017) (last ac­cessed Mar. 30, 2018).
2 OregonLaws.org contains the con­tents of Volume 21 of the ORS, inserted along­side the per­tin­ent statutes. See the preface to the ORS An­no­ta­tions for more information.
3 OregonLaws.org assembles these lists by analyzing references between Sections. Each listed item refers back to the current Section in its own text. The result reveals relationships in the code that may not have otherwise been apparent.