A.R.S. tit. 41 ch. 41 — Arizona Revised Statutes Title 41 Chapter 41 — Arizona Department Of Homeland Security

41-4251. Definitions In this chapter, unless the context otherwise requires: 1. "Department" means the Arizona department of homeland security. 2. "Director" means the director of the department. 41-4252. Arizona department of homeland security; director; deputy director; assistant directors; divisions A. The Arizona department of homeland security is established. The direction, operation and control of the department are the responsibility of the director. B. The governor shall appoint the director pursuant to section 38-211. The director shall administer the department and serve at the pleasure of the governor. The director is entitled to receive compensation as determined under section 38-611. The director shall appoint a deputy director and a statewide chief information security officer and, subject to legislative appropriation, may appoint additional deputy directors and those assistant directors as the director deems appropriate. The positions of director, statewide chief information security officer and deputy director are exempt from chapter 4, articles 5 and 6 of this title relating to the state service. C. To be eligible for appointment as director a person must have a background or experience in one or more of the following areas: 1. Public administration. 2. Disaster response. 3. Law enforcement. 4. Business administration. 5. Cybersecurity. D. The director may organize the department into divisions the director deems appropriate. 41-4253. Department employees Subject to chapter 4, article 4 and, as applicable, articles 5 and 6 of this title, the director shall employ, determine the conditions of employment of and specify the duties of employees the director deems necessary. 41-4254. Department duties The department shall: 1. Formulate policies, plans and programs to enhance the ability of this state to prevent and respond to acts of terrorism, cybersecurity threats and other critical hazards. 2. Adhere to all federal grant terms and conditions. 3. Request appropriations or grants of monies for homeland security purposes. 4. Receive all awards granted to this state by the federal government for homeland security purposes. 5. Distribute monies to local jurisdictions and other organizations eligible under federal regulations based on criteria in the federal grant guidelines. 41-4255. Annual report A. On or before September 1 of each year, the Arizona department of homeland security shall submit a homeland security allocation and expenditure report to the governor, the president of the senate, the speaker of the house of representatives, the chairperson of the senate appropriations committee, the chairperson of the house appropriations committee and the staff and cochairpersons of the joint legislative budget committee. B. The director shall provide a copy of the report to the secretary of state. The department may redact sensitive information contained in the report if necessary. C. The report shall include: 1. Each local and state project that was awarded funding for the current year. 2. Expenditures for each local and state project that was awarded funding for the current year. 3. Expenditures from federal appropriations and grants that were used by the department for administrative and state agency purposes. 4. A narrative description detailing each state project awarded funding, including the goals and objectives of each state project. 5. The progress made on each project since the last report. 6. Project awards and expenditures for open grant projects by June 30 of each year. 7. A detailed plan on how homeland security efforts will be continued in the event of decreased federal funding. 41-4258. Arizona department of homeland security regional advisory councils; appointment; terms; duties A. The Arizona department of homeland security regional advisory councils are established. B. The department shall ensure reasonable distribution of area representation. A total of five councils are established as follows: 1. The north region is composed of the jurisdictions contained in the Coconino, Navajo and Apache county boundaries. 2. The east region is composed of the jurisdictions contained in the Graham, Greenlee, Gila and Pinal county boundaries. 3. The south region is composed of the jurisdictions contained in the Pima, Santa Cruz, Cochise and Yuma county boundaries. 4. The west region is composed of the jurisdictions contained in the Mohave, La Paz and Yavapai county boundaries. 5. The central region is composed of the jurisdictions contained in the Maricopa county boundaries. C. Each regional advisory council consists of twelve members who serve for a term of three years. Members shall reside or work in the region they represent, except for the representative from the department of public safety. For the purposes of limiting the membership in a county, the representative from the department of public safety and the tribal representative do not count toward the membership limit from a county. D. The governor shall appoint each member of a regional advisory council. The membership of the councils consists of: 1. A representative of a fire service from an urban or suburban area in the region. 2. A representative of a fire service from a rural area in the region. 3. A police chief. 4. A county sheriff or the sheriff's proxy. 5. A tribal representative. 6. An emergency manager. 7. Four at-large members. 8. A representative from the department of public safety. 9. A public health representative. E. A member must have a background in or experience with disaster response or law enforcement issues. F. Subject to approval by the director or deputy director, within a reasonable time frame before the meeting, members may be represented on the council by a person designated by that member to serve as the member's proxy. The proxy must have a background in or experience with disaster response or law enforcement issues. G. At the first meeting held after July 1 of each year, each regional advisory council shall elect a chairperson and vice chairperson. H. Each regional advisory council shall meet on an as-needed basis to conduct business. No actions may be taken without a quorum present. I. It is the duty of each regional advisory council member to maintain communication with and represent other offices and organizations within the members' professional discipline in the region. J. In coordination with the department, the regional advisory council shall: 1. Support and assist in implementing Arizona's comprehensive statewide risk assessment. 2. Support and assist an integrated regional approach to homeland security in this state. 3. Encourage baseline prevention and response capabilities throughout the region consistent with state and regional plans. 4. Develop a list of recommendations for state homeland security grant program monies and forward these recommendations to the director. 5. Recommend allocation of state homeland security grant program monies to eligible jurisdictions and other organizations based on regional, state and federal criteria. K. Members are not eligible to receive compensation but are eligible for reimbursement of expenses pursuant to title 38, chapter 4, article 2. L. Elected officials shall serve on the council in their capacity as elected officials. If an elected official is no longer in office that position on the regional advisory council shall be considered vacant and a new appointment shall be made. 41-4271. Definitions In this article, unless the context otherwise requires: 1. "Critical infrastructure" has the same meaning prescribed in section 41-1801. 2. "Fuel facility" means a commercial aviation fuel, petroleum or natural gas transmission facility in this state that is not located on the premises of a commercial airport. 41-4272. Protection of critical infrastructure; fuel facilities Notwithstanding any other law, on or before October 1 of each year the owners of a fuel facility shall provide a written report to the director regarding security measures being taken by the operators of the fuel facility and by any other agency or authority of this state or any political subdivision of this state and, to the extent practicable, of any federal entity, to protect the security of the critical infrastructure. The owners of the fuel facility and any other agency or authority of this state or any political subdivision of this state involved in the protection of this critical infrastructure shall coordinate and cooperate in the preparation of the report and shall make a good faith effort to include input from any federal entity involved in the protection of this critical infrastructure. As deemed appropriate by the director, the department may physically inspect the premises and review any audits or reports related to the security of the critical infrastructure, including audits or reports conducted at the request of any other agency or authority of this state or any political subdivision of this state or, to the extent practicable, of any federal entity. The operators of the fuel facility, in compliance with any federal and state requirements regarding the dissemination of this information, shall provide access to the director to the audits or reports regarding critical infrastructure. The exclusive custody and control of the audits and reports remain solely with the operators of the fuel facility. 41-4273. Reporting requirements; confidentiality A. Before January 1, 2010, and every five years thereafter, the director shall provide a report to the governor, the president of the senate, the speaker of the house of representatives and the operator of a fuel facility listing the director's recommendations to the legislature, the operators of a fuel facility or any appropriate state or federal regulating entity or agency of any additional security measures that are recommended to be implemented, if the director determines the measures are recommended considering among other factors the unique characteristics of each fuel facility. B. Before receiving the report required by subsection A, each recipient of the report shall develop confidentiality protocols, in consultation with the director for the maintenance and use of the report to ensure the confidentiality of the report and all information contained in the report. The confidential protocols are binding on the recipient that issues the protocols and anyone to whom the recipient shows a copy of the report. The report and any information contained or used in its preparation are exempt from and shall not be made available pursuant to title 39, chapter 1, article 2. The director shall also develop protocols for the department related to the maintenance and use of the report to ensure the confidentiality of the report and all information contained in the report. On each report, the director shall prominently display the following statement: "This report may contain information that if disclosed could endanger the life or safety of the public. This report is to be maintained and used in a manner consistent with protocols established to preserve the confidentiality of the information contained in this report in a manner consistent with law." 41-4281. Definitions In this article, unless the context otherwise requires: 1. "Breach" or "security system breach" has the same meaning prescribed in section 18-551. 2. "Budget unit" has the same meaning prescribed in section 18-101. 3. "Information technology" has the same meaning prescribed in section 18-101. 4. "Security incident" has the same meaning prescribed in section 18-551. 41-4282. Statewide information security and privacy office; duties; suspension of budget unit's information infrastructure A. The statewide information security and privacy office is established in the Arizona department of homeland security. The statewide information security and privacy office shall serve as the strategic planning, facilitation and coordination office for information security in this state. Individual budget units shall continue to maintain operational responsibility for information security. B. The director shall serve as or appoint the statewide chief information security officer to manage the statewide information security and privacy office. If other than the director, the statewide chief information security officer shall report to the director pursuant to section 41-4252. C. The statewide information security and privacy office shall: 1. Develop, implement, maintain and ensure compliance for each budget unit with statewide information security policies and a coordinated statewide assurance plan for information security and privacy. 2. Direct information security and privacy protection compliance reviews for each budget unit to ensure compliance with policies, standards and effectiveness of information security assurance plans as necessary. 3. Identify information security and privacy protection risks in each budget unit and direct agencies to adopt risk mitigation strategies, methods and procedures to minimize the risks. 4. Monitor and report compliance of each budget unit with state information security and privacy protection policies, standards and procedures. 5. Coordinate statewide information security and privacy protection awareness and training programs. 6. Establish a state security operations center for central detection, reporting and response efforts for security incidents and breaches across the state. 7. Develop other strategies as necessary to protect this state's information technology infrastructure and the data that is stored on or transmitted by the infrastructure. 8. Consult with the department of administration for a full review of the security aspects for information technology projects prescribed in section 18-104. 9. Operate the information security aspects of the enterprise-level infrastructure managed by the department of administration. D. The statewide information security and privacy office may temporarily suspend operation of information infrastructure that is owned, leased, outsourced or shared to isolate the source of, or stop the spread of, an information security system breach or other similar incident. A budget unit and the department of administration, as applicable, shall comply with directives to temporarily discontinue or suspend operations of information infrastructure. E. Each budget unit and its contractors shall identify and report security incidents to the statewide information security and privacy office immediately on discovery and deploy mitigation strategies as directed. F. The Arizona department of homeland security may examine all books, papers, records and documents in the office of any budget unit and may require any state officer of the budget unit to provide the information or statements necessary to carry out this section. G. Budget units shall demonstrate expertise to carry out security assurance plans, either by employing staff or contracting for outside services. H. A budget unit may enter into an agreement with the department of administration or the Arizona department of homeland security to meet the requirements of this section.