Rules Committee sends ordinance to create Office of Cybersecurity and city CISO to full Board

SAN FRANCISCO — The Rules Committee on March 7 voted 3-0 to send an ordinance to the full Board that would formally establish an Office of Cybersecurity in the Administrative Code and create a city chief information security officer (CISO) role.

Deputy City Administrator Ken Bukowski told the committee the ordinance mostly codifies existing Committee on Information Technology (COIT) policies and the mayor’s executive directive. ‘‘The office of cybersecurity is designed to centralize and coordinate the city's response to cybersecurity threats,’’ Bukowski said, describing duties that would include promulgating citywide information-security standards, overseeing incident response under the San Francisco Unified Cyber Command Plan, and working with departmental information security officers.

The proposal would add section 22I to Chapter 22 of the Administrative Code, require each department to designate a departmental information security officer, and require departments to conduct cybersecurity risk assessments every 24 months and maintain cybersecurity emergency response plans. The ordinance also adds the CISO as a permanent COIT member and updates appointment language for the city CIO.

A remote commenter, David Pilpel, urged technical edits — including correcting a section-numbering error on page 3 and inserting the word "officer" after "information" on page 7 — and said he supported the legislation. The committee, with Deputy City Attorney Pearson present, approved the technical amendments Pilpel suggested (change section numbering on page 3 and add the word "officer" on page 7) but declined one suggested change regarding the MTA provision; the chair then moved to send the amended ordinance to the full Board with a positive recommendation. Roll call was Supervisor Connie Chan — Aye; Vice Chair Rafael Mandelmann — Aye; Chair Aaron Peskin — Aye.

Bukowski noted that the city previously discussed creating a chief privacy officer but that a proposed position was cut during the Board's budget process and is not currently staffed. The ordinance, as amended by the committee, will be scheduled for consideration by the full Board.