LEGISLATIVE FISCAL ESTIMATE
ASSEMBLY, No. 1912
STATE OF NEW JERSEY
221st LEGISLATURE
DATED: FEBRUARY 10, 2025
SUMMARY
|
Synopsis: |
Requires certain State employees to receive training in cybersecurity best practices. |
|
Type of Impact: |
Annual State expenditure increase. |
|
Agencies Affected: |
New Jersey Office of Homeland Security and Preparedness; Legislative Branch; Certain Other State Employees. |
|
Fiscal Impact |
First Year |
Thereafter |
|
|
Annual State Expenditure Increase |
Indeterminate |
At least $0.1 million |
|
|
|
|
||
· The Office of Legislative Services (OLS) finds that the bill will result in an annual State expenditure increase for cybersecurity training for State employees with computer access. Currently, the New Jersey Cybersecurity and Communications Integration Cell in the Office of Homeland Security and Preparedness provides cybersecurity training to certain Executive Branch employees.
· The New Jersey Cybersecurity and Communications Integration Cell may incur administrative expenses for an additional full-time staff position to expand and maintain the cybersecurity awareness program and for system and training updates in future years.
BILL DESCRIPTION
This bill requires State employees to receive cybersecurity training regarding using best safety practices while utilizing State computers.
The bill requires the New Jersey Cybersecurity and Communications Integration Cell in the New Jersey Office of Homeland Security and Preparedness to establish the cybersecurity training program for all State employees who have access to a State agency computer in the executive and legislative branches and, to the extent consistent with law, any interstate agency to which New Jersey is a party and any independent State authority, commission, instrumentality or agency.
The bill requires the Office of Homeland Security and Preparedness to adopt guidelines to implement the program. The training is to include a review of best practices for using State computers including updating passwords; detecting phishing scams; preventing ransomware, spyware infections, and identity theft; and preventing and responding to data breaches.
FISCAL ANALYSIS
EXECUTIVE BRANCH
A representative from the New Jersey Cybersecurity and Communications Integration Cell in the Office of Homeland Security and Preparedness provided the OLS with an informal assessment indicating that training is currently provided to Executive Branch agency employees, as per guidance in the Statewide Information Security Manual. However, the office indicated that this bill might expand the scope to not only the Legislative Branch, but also potentially to the Judicial Branch and the Port Authority of New York and New Jersey.
Information provided by the office indicated that the current cost for the cybersecurity awareness training content is about $4 per employee per year. In addition to the per employee annual cost, the office would require at least one full-time equivalent employee to help administer the program. The Civil Service Commission’s Learning Management System is utilized by Executive Branch employees for the training. However, the office is uncertain of the additional funds needed to expand the system to include additional employees as required by the bill.
OFFICE OF LEGISLATIVE SERVICES
The OLS finds that the bill will result in an indeterminate annual State expenditure increase for cybersecurity training for State employees with computer access. The New Jersey Cybersecurity and Communications Integration Cell may incur administrative expenses for an additional full-time staff position to expand and maintain the cybersecurity awareness program and for system and training updates in future years. The OLS assumes the new staff member would receive total annual compensation, including fringe benefits, of at least $100,000.
According to the New Jersey Cybersecurity and Communications Integration Cell, the majority of Executive Branch employees utilizing computers already receive cybersecurity training. Under the bill, the training would be expanded to the Legislative Branch and other areas of State government, based on the bill’s provisions.
For reference only, the OLS notes that based on information from its Information Technology Unit, there are approximately 1,200 computer users in the Legislative Branch. Also for reference only, the OLS notes that to the extent Judicial Branch employees may receive cybersecurity training, there were approximately 8,328 Judiciary employees as of FY 2023. As noted above, the cybersecurity cell indicated that the current cost for the cybersecurity awareness training content is about $4 per employee per year.
The OLS does note that expanding cybersecurity training to additional State employees may result in an overall cost savings to the State of New Jersey, as this relatively low-impact training may help to reduce the cost of data breaches and other security incidents.
|
Section: |
|
|
Analyst: |
Lead Fiscal Analyst |
|
Approved: |
Thomas Koenig Legislative Budget and Finance Officer |
This legislative fiscal estimate has been produced by the Office of Legislative Services due to the failure of the Executive Branch to respond to our request for a fiscal note.
This fiscal estimate has been prepared pursuant to P.L.1980, c.67 (C.52:13B-6 et seq.).