Read the full stored bill text
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
83rd OREGON LEGISLATIVE ASSEMBLY--2025 Regular Session
A-Engrossed
House Bill 2454
Ordered by the House May 27
Including House Amendments dated May 27
Introduced and printed pursuant to House Rule 12.00. Presession filed (at the request of House Interim Committee
on Rules for Representatives Ben Bowman, David Gomberg, Emily McIntire, Mark Owens, Nathan Sosa, Kim
Wallan)
SUMMARY
The following summary is not prepared by the sponsors of the measure and is not a part of the body thereof subject
to consideration by the Legislative Assembly. It is an editor’s brief statement of the essential features of the
measure. The statement includes a measure digest written in compliance with applicable readability standards.
Digest: The Act creates an oversight officer position in the legislative branch, and directs
the officer to perform audits, look at things agencies do, look at public complaints and report
back to the JLAC. The Act tells the officer to do other tasks if told to do so by the JLAC.
The Act says the officer is to start duties on 1/1/2026. (Flesch Readability Score: 61.9).
[Digest: The Act creates an LAO position and directs the LAO to perform audits and to report
findings to the JLAC. (Flesch Readability Score: 63.8). ]
Authorizes the Joint Legislative Audit Committee to appoint a Legislative [ Audit] Performance
Oversight and Government Accountability Officer and to direct the officer to perform specified
duties, including investigating, reviewing activities of and oversight of executive branch agencies,
taking in and investigating complaints of members of the public concerning executive branch agency
programs, conducting performance audits of executive branch agencies and reporting to the com-
mittee on work undertaken by the officer. Authorizes the officer to hire necessary staff and to enter
into contracts to carry out the functions assigned to the officer.
Provides that the duties the officer must perform become operative January 1, 2026.
Takes effect on the 91st day following adjournment sine die.
A BILL FOR AN ACT
Relating to legislative oversight of executive branch actions; creating new provisions; amending ORS
171.415, 171.425, 171.430, 171.580, 171.585, 171.590, 244.050, 276A.306, 297.050 and 297.070; and
prescribing an effective date.
Be It Enacted by the People of the State of Oregon:
SECTION 1.
(1) The Joint Legislative Audit Committee, with the approval of the Presi-
dent of the Senate and the Speaker of the House of Representatives, shall select a Legislative
Performance Oversight and Government Accountability Officer, who shall serve at the
pleasure of the committee.
(2) Subject to the limitations otherwise provided by law for expenses of state officers, the
officer shall be reimbursed for actual and necessary expenses incurred or paid by the officer
in the performance of duties of the officer.
SECTION 2.
(1) The Legislative Performance Oversight and Government Accountability
Officer shall, subject to available resources and at the direction of the Joint Legislative Audit
Committee:
(a) Investigate, review the activities and actions of, and conduct oversight of executive
branch agencies, programs and functions to identify opportunities and areas of improvement
to make agency functions, operations and programs more effective, transparent and re-
sponsive;
NOTE:Matter in boldfaced type in an amended section is new; matter [ italic and bracketed] is existing law to be omitted.
New sections are in boldfaced type.
LC 2604
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
(b) Take in and act upon complaints made by members of the public concerning executive
branch agency actions by investigating and ascertaining the extent to which agency func-
tions or program objectives are aligned with authorizing legislation and being met, and re-
port findings to the committee and complainants;
(c) Conduct performance audits of executive branch agencies or programs and report
findings to the committee;
(d) Undertake other evaluations, audits or tasks described in ORS 171.585;
(e) Report to the appropriate policy and budget committees of the Legislative Assembly
on the results of audits undertaken by the officer or by the Division of Audits, including
supplying any relevant information related to an audit the officer is reporting on;
(f) Issue reports, findings and studies on the work undertaken by the officer; and
(g) Perform other related duties as assigned.
(2) The officer may employ and fix the compensation of such professional assistants and
other employees as the officer deems necessary for the work under the charge of the officer.
(3) The officer may enter into contracts to carry out the functions of the officer.
SECTION 3.
ORS 171.580 is amended to read:
171.580. (1) There is created a Joint Legislative Audit Committee consisting of the cochairs of
the Joint Committee on Ways and Means, members of the House of Representatives appointed by
the Speaker and members of the Senate appointed by the President.
(2) The committee has a continuing existence and may meet, act and conduct its business during
sessions of the Legislative Assembly or any recess thereof and in the interim between sessions.
(3)(a) The term of a member shall expire upon the earlier of:
(A) The date of the convening of the odd-numbered year regular session of the Legislative As-
sembly next following the commencement of the member’s term; or
(B) The date of the convening of an organizational session of the odd-numbered year regular
session of the Legislative Assembly next following the commencement of the member’s term.
(b) When a vacancy occurs in the membership of the committee in the interim between an odd-
numbered year regular session and the earlier of the date of the convening of the next following
odd-numbered year regular session or the date of the convening of an organizational session of the
next following odd-numbered year regular session, until such vacancy is filled, the membership of
the committee shall be considered not to include the vacant position for the purpose of determining
whether a quorum is present and a quorum is a majority of the remaining members.
(4) Members of the committee shall receive an amount equal to that authorized under ORS
171.072 from funds appropriated to the Legislative Assembly for each day spent in the performance
of their duties as members of the committee or any subcommittee thereof in lieu of reimbursement
for in-state travel expenses. However, when engaged in out-of-state travel, members shall be entitled
to receive their actual and necessary expenses therefor in lieu of the amount authorized by this
subsection. Payment shall be made from funds appropriated to the Legislative Assembly.
(5) The committee may not transact business unless a quorum is present. A quorum consists of
a majority of committee members from the House of Representatives and a majority of committee
members from the Senate.
(6) Action by the committee requires the affirmative vote of a majority of committee members
from the House of Representatives and a majority of committee members from the Senate.
(7) The Legislative [ Fiscal Office ] Performance Oversight and Government Accountability
Officer shall furnish to the committee such services of personnel and such other facilities as are
[2]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
necessary to enable the committee to carry out its functions as directed by law, with such assistance
as the Division of Audits and Oregon Department of Administrative Services can provide.
SECTION 4.
ORS 171.585 is amended to read:
171.585. (1) The Joint Legislative Audit Committee shall:
(a) Select audit reports for review and make recommendations for change or remediation by the
audited entity to the Emergency Board, the Joint Interim Committee on Ways and Means, the Joint
Committee on Ways and Means or other appropriate legislative committees and to other persons
receiving the audit report under ORS 192.245.
(b) Review requests for performance audits and proposed legislation relating to audits.
(c) Recommend audits and audit follow-up reviews to be conducted by the Division of Audits or
by the Legislative Performance Oversight and Government Accountability Officer .
(d)(A) Review audits and audit follow-up reviews completed by legislative staff.
(B) Select audit follow-up reviews completed by the Division of Audits for review.
(e) Assign tasks related to the duties of the Joint Legislative Audit Committee to the Legislative
[Fiscal Office ] Performance Oversight and Government Accountability Officer , including di-
recting [ staff] the officer to conduct performance assessments of state agency programs and man-
agement, reviews of agency or statewide processes, sunset reviews, change of director reviews,
reviews of audits conducted by the Secretary of State or contract auditors and audit follow-up re-
views. The [ Legislative Fiscal ] officer shall notify the Division of Audits before conducting a review
directed by the committee.
(f) At the request of the standing or interim Joint Committee on Ways and Means, review state
agency performance measures and make recommendations for change.
(2) As used in this section, “audit follow-up review” means a review to determine:
(a) Whether an audited entity has appropriately acted upon audit findings; and
(b) Whether implementation of audit recommendations achieved the anticipated benefits identi-
fied in an audit report or in an audited entity’s response to an audit report.
SECTION 5.
ORS 171.590 is amended to read:
171.590. (1) In carrying out specific audits, evaluations and reviews, the Legislative [ Fiscal Of-
fice] Performance Oversight and Government Accountability Officer may request the services
of the Division of Audits, the Oregon Department of Administrative Services and other statutory
agencies of the Legislative Assembly.
(2) If requested by the officer, the Division of Audits shall, for each audit recommended by the
Joint Legislative Audit Committee and included in the audit plan described in ORS 297.076:
(a) Verify with the [ committee] officer that the identified scope of the audit meets the goals of
the committee; and
(b) Provide periodic updates to the officer and committee on the status of the audit.
SECTION 6.
ORS 171.415 is amended to read:
171.415. (1) Except as provided in subsections (2) and (3) of this section, a committee or em-
ployee of the Legislative Assembly having possession of legislative records that are not required for
the regular performance of official duties shall, within 10 days after the adjournment sine die of a
regular or special session, deliver all such legislative records to the Legislative Administration
Committee.
(2) The chairperson, member or employee of a legislative interim committee responsible for
maintaining the legislative records of that committee shall, within 10 days after the committee
ceases to function or before January 1 next preceding the beginning of an odd-numbered year reg-
[3]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
ular session of the Legislative Assembly, whichever is earlier, deliver all such legislative records to
the Legislative Administration Committee.
(3) This section does not apply to the records of the Emergency Board, the Legislative Admin-
istration Committee, the Legislative Counsel Committee, the Legislative Policy and Research Com-
mittee, the Joint Committee on Conduct and the Legislative Equity Officer , the Joint Legislative
Audit Committee or the Joint Committee on Ways and Means.
SECTION 7.
ORS 171.425 is amended to read:
171.425. The State Archivist shall allow the Legislative Fiscal Officer, the Legislative Adminis-
trator, the Legislative Counsel, the Legislative Revenue Officer , the Legislative Performance
Oversight and Government Accountability Officer or the Legislative Policy and Research Di-
rector to borrow and temporarily have possession of such legislative records as such officer re-
quests.
SECTION 8. ORS 171.430 is amended to read:
171.430. (1) Except for legislative records borrowed under ORS 171.425 and except as provided
in subsection (2) of this section, the Emergency Board, the Legislative Administration Committee,
the Legislative Counsel Committee, the Legislative Policy and Research Committee , the Joint
Legislative Audit Committee or the Joint Committee on Ways and Means may cause any legisla-
tive records in its possession to be destroyed or otherwise disposed of, if such legislative records
are considered by such committee to be of no value to the state or the public and are no longer
necessary under or pursuant to any statute requiring their creation or maintenance or affecting
their use. However, such committee shall prior to destruction or disposal notify the State Archivist
and transfer to the official custody of the State Archivist any such legislative records that are req-
uisitioned by the State Archivist, except those designated as confidential by statute or by rule or
resolution of the Legislative Assembly or of such committee.
(2) The Emergency Board, the Legislative Administration Committee, the Legislative Counsel
Committee, the Legislative Policy and Research Committee , the Joint Legislative Audit Commit-
tee and the Joint Committee on Ways and Means shall cause sound recordings of its hearings or
meetings to be retained or, if not retained, to be delivered to the State Archivist. The archivist shall
be official custodian of the sound recordings so delivered.
SECTION 9.
ORS 297.050 is amended to read:
297.050. (1) The Division of Audits of the office of the Secretary of State shall supply the Joint
Legislative Audit Committee and the Legislative [ Fiscal] Performance Oversight and Government
Accountability Officer with a copy of each audit report made by or for the Division of Audits.
(2) The Division of Audits shall cause a periodic peer review to be completed as required by the
standards of the United States Government Accountability Office. The Division of Audits shall sup-
ply a copy of each peer review report to the committee.
SECTION 10. ORS 297.070 is amended to read:
297.070. (1) Performance audits of all state departments, boards, commissions, institutions and
state-aided institutions and agencies conducted by the Division of Audits shall be based on standards
for audit services established by nationally recognized entities including, but not limited to, the
United States Government Accountability Office.
(2) The Secretary of State may subpoena witnesses, may require the production of books and
papers and rendering of reports in the manner and form that the Secretary of State requires and
may do all things necessary to secure a full and thorough audit. If a person fails to comply with any
subpoena issued under this subsection, a judge of the circuit court of any county, on application of
[4]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
the Secretary of State, shall compel obedience by proceedings for contempt as in the case of diso-
bedience of the requirements of a subpoena issued from the circuit court.
(3) The Secretary of State, as State Auditor, may contract with qualified private sector auditors
to conduct audits if the Secretary of State determines that it is in the public interest to do so. All
contracts for conducting performance audits under this section shall be in a form prescribed or ap-
proved by the Secretary of State. The Secretary of State shall employ or contract with auditors upon
terms and for compensation as the Secretary of State determines are advantageous and advisable.
(4) An audit conducted under contract as provided in subsection (3) of this section shall be
considered to be conducted by the Division of Audits for purposes of ORS 297.020, 297.050 and
297.535.
(5) The Secretary of State may enter into an agreement with the department, board, commission,
institution, state-aided institution or agency that is the subject of a performance audit for payment
of the expenses incurred by the Secretary of State in conducting the audit.
(6) An audit report that includes information on leading practices must:
(a) Provide information on whether it is reasonable to believe that adoption of such practices
will require resources beyond currently legislatively approved resource levels, and, if so, the po-
tential magnitude of additional resources needed; and
(b) Identify states or comparable government entities that have implemented identified leading
practices.
(7) An audit report must indicate whether:
(a) Issues identified in the report are already under consideration by the audited entity; and
(b) Recommendations identified in the report are already in the process of being implemented.
(8) The Division of Audits shall publish all performance audit reports and shall notify the Leg-
islative Assembly and the Legislative [ Fiscal] Performance Oversight and Government Ac-
countability Officer when such audits are publicly available.
(9) An audited entity shall submit written reports to the Division of Audits and the Legislative
[Fiscal] Performance Oversight and Government Accountability Officer regarding the findings
and recommendations of an audit of the entity. The reports must include specific responses to each
recommendation, including whether the entity can implement the recommendation without legisla-
tive action and anticipated timeframes for implementation of recommendations not requiring legis-
lative action. The reports required under this subsection must be made in a timely manner, as
determined by the Division of Audits and the Legislative [ Fiscal] Performance Oversight and
Government Accountability Officer.
(10) After receiving a report under subsection (9) of this section, both the Division of Audits and
the Legislative [ Fiscal] Performance Oversight and Government Accountability Officer may
conduct an audit follow-up review and may submit a written report regarding the audit follow-up
review to the Joint Legislative Audit Committee. The Division of Audits and the Legislative
[Fiscal] Performance Oversight and Government Accountability Officer shall notify one another
about the intent to conduct an audit follow-up review prior to initiation of the review.
(11) As used in this section:
(a) “Audit follow-up review” has the meaning given that term in ORS 171.585.
(b) “Performance audit” means an audit, the objectives of which include:
(A) Assessing the extent to which legislative, regulatory and organizational goals and objectives
are being achieved and the current status or condition of program operations or progress in imple-
menting legislative requirements within the legislatively approved budget;
[5]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
(B) Assessing the ability of alternative approaches to yield improved performance or eliminate
factors that inhibit effectiveness;
(C) Determining whether a program produced documented intended results, including key per-
formance measures, and whether such measures are reliable, valid and relevant;
(D) Determining whether a program operates within the context of statutory parameters, is ac-
cessible to eligible individuals, duplicates, overlaps, or conflicts with other programs, utilizes sound
financial practices and information and is efficient and effective in achieving intended results within
the legislatively approved budget;
(E) Determining whether the purpose of a program, the manner in which it is conducted, ser-
vices delivered, outcomes, the population served, incurred or proposed costs, and revenue received
are in compliance with provisions of laws, regulations, contracts, grant agreements or other relevant
requirements; and
(F) Addressing identified risks and weaknesses.
SECTION 11.
ORS 244.050 is amended to read:
244.050. (1) On or before April 15 of each year the following persons shall file with the Oregon
Government Ethics Commission a verified statement of economic interest as required under this
chapter:
(a) The Governor, Secretary of State, State Treasurer, Attorney General, Commissioner of the
Bureau of Labor and Industries, district attorneys and members of the Legislative Assembly.
(b) Any judicial officer, including justices of the peace and municipal judges, except any pro tem
judicial officer who does not otherwise serve as a judicial officer.
(c) Any candidate for a public office designated in paragraph (a) or (b) of this subsection.
(d) The Deputy Attorney General.
(e) The Deputy Secretary of State.
(f) The Legislative Administrator, the Legislative Counsel, the Legislative Fiscal Officer, the
Legislative Policy and Research Director, the Secretary of the Senate, the Chief Clerk of the House
of Representatives [ and], the Legislative Equity Officer and the Legislative Performance Over-
sight and Government Accountability Officer .
(g) The president and vice presidents, or their administrative equivalents, in each public uni-
versity listed in ORS 352.002.
(h) The following state officers:
(A) Adjutant General.
(B) Director of Agriculture.
(C) Manager of State Accident Insurance Fund Corporation.
(D) Water Resources Director.
(E) Director of the Department of Environmental Quality.
(F) Director of the Oregon Department of Administrative Services.
(G) State Fish and Wildlife Director.
(H) State Forester.
(I) State Geologist.
(J) Director of Human Services.
(K) Director of the Department of Consumer and Business Services.
(L) Director of the Department of State Lands.
(M) State Librarian.
(N) Administrator of the Oregon Liquor and Cannabis Commission.
[6]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
(O) Superintendent of State Police.
(P) Director of the Public Employees Retirement System.
(Q) Director of Department of Revenue.
(R) Director of Transportation.
(S) Public Utility Commissioner.
(T) Director of Veterans’ Affairs.
(U) Executive director of Oregon Government Ethics Commission.
(V) Director of the State Department of Energy.
(W) Director and each assistant director of the Oregon State Lottery.
(X) Director of the Department of Corrections.
(Y) Director of the Oregon Department of Aviation.
(Z) Executive director of the Oregon Criminal Justice Commission.
(AA) Director of the Oregon Business Development Department.
(BB) Director of the Oregon Department of Emergency Management.
(CC) Director of the Employment Department.
(DD) State Fire Marshal.
(EE) Chief of staff for the Governor.
(FF) Director of the Housing and Community Services Department.
(GG) State Court Administrator.
(HH) Director of the Department of Land Conservation and Development.
(II) Board chairperson of the Land Use Board of Appeals.
(JJ) State Marine Director.
(KK) Executive director of the Oregon Racing Commission.
(LL) State Parks and Recreation Director.
(MM) Executive director of the Oregon Public Defense Commission.
(NN) Chairperson of the Public Employees’ Benefit Board.
(OO) Director of the Department of Public Safety Standards and Training.
(PP) Executive director of the Higher Education Coordinating Commission.
(QQ) Executive director of the Oregon Watershed Enhancement Board.
(RR) Director of the Oregon Youth Authority.
(SS) Director of the Oregon Health Authority.
(TT) Deputy Superintendent of Public Instruction.
(i) The First Partner, the legal counsel, the deputy legal counsel and all policy advisors within
the Governor’s office.
(j) Every elected city or county official.
(k) Every member of a city or county planning, zoning or development commission.
(L) The chief executive officer of a city or county who performs the duties of manager or prin-
cipal administrator of the city or county.
(m) Members of local government boundary commissions formed under ORS 199.410 to 199.519.
(n) Every member of a governing body of a metropolitan service district and the auditor and
executive officer thereof.
(o) Each member of the board of directors of the State Accident Insurance Fund Corporation.
(p) The chief administrative officer and the financial officer of each common and union high
school district, education service district and community college district.
(q) Every member of the following state boards, commissions and councils:
[7]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
(A) Governing board of the State Department of Geology and Mineral Industries.
(B) Oregon Business Development Commission.
(C) State Board of Education.
(D) Environmental Quality Commission.
(E) Fish and Wildlife Commission of the State of Oregon.
(F) State Board of Forestry.
(G) Oregon Government Ethics Commission.
(H) Oregon Health Policy Board.
(I) Oregon Investment Council.
(J) Land Conservation and Development Commission.
(K) Oregon Liquor and Cannabis Commission.
(L) Oregon Short Term Fund Board.
(M) State Marine Board.
(N) Mass transit district boards.
(O) Energy Facility Siting Council.
(P) Board of Commissioners of the Port of Portland.
(Q) Employment Relations Board.
(R) Public Employees Retirement Board.
(S) Oregon Racing Commission.
(T) Oregon Transportation Commission.
(U) Water Resources Commission.
(V) Workers’ Compensation Board.
(W) Oregon Facilities Authority.
(X) Oregon State Lottery Commission.
(Y) Pacific Northwest Electric Power and Conservation Planning Council.
(Z) Columbia River Gorge Commission.
(AA) Oregon Health and Science University Board of Directors.
(BB) Capitol Planning Commission.
(CC) Higher Education Coordinating Commission.
(DD) Oregon Growth Board.
(EE) Early Learning Council.
(FF) The Oversight and Accountability Council.
(r) The following officers of the State Treasurer:
(A) Deputy State Treasurer.
(B) Chief of staff for the office of the State Treasurer.
(C) Director of the Investment Division.
(s) Every member of the board of commissioners of a port governed by ORS 777.005 to 777.725
or 777.915 to 777.953.
(t) Every member of the board of directors of an authority created under ORS 441.525 to 441.595.
(u) Every member of a governing board of a public university listed in ORS 352.002.
(v) Every member of the district school board of a common school district or union high school
district.
(w) Every member of the board of directors of an authority created under ORS 465.600 to
465.621.
(2) By April 15 next after the date an appointment takes effect, every appointed public official
[8]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
on a board or commission listed in subsection (1) of this section shall file with the Oregon Govern-
ment Ethics Commission a statement of economic interest as required under ORS 244.060, 244.070
and 244.090.
(3) By April 15 next after the filing deadline for the primary election, each candidate described
in subsection (1) of this section shall file with the commission a statement of economic interest as
required under ORS 244.060, 244.070 and 244.090.
(4) Not later than the 40th day before the date of the statewide general election, each candidate
described in subsection (1) of this section who will appear on the statewide general election ballot
and who was not required to file a statement of economic interest under subsections (1) to (3) of this
section shall file with the commission a statement of economic interest as required under ORS
244.060, 244.070 and 244.090.
(5) Subsections (1) to (3) of this section apply only to persons who are incumbent, elected or
appointed public officials as of April 15 and to persons who are candidates on April 15.
(6) If a statement required to be filed under this section has not been received by the commis-
sion within five days after the date the statement is due, the commission shall notify the public of-
ficial or candidate and give the public official or candidate not less than 15 days to comply with the
requirements of this section. If the public official or candidate fails to comply by the date set by the
commission, the commission may impose a civil penalty as provided in ORS 244.350.
SECTION 12.
ORS 276A.306 is amended to read:
276A.306. (1) As used in this section:
(a) “Information resources” means data and the means for storing, retrieving, connecting or us-
ing data, including but not limited to records, files, databases, documents, software, equipment and
facilities that a state agency owns or leases.
(b) “Information security assessment” means:
(A) An organized method to determine a risk to or a vulnerability of a state agency’s informa-
tion system or a third party information service to which a state agency subscribes; and
(B) An independent examination and review of records, logs, policies, activities and practices to:
(i) Assess whether a state agency’s information system is vulnerable to an information security
incident;
(ii) Ensure compliance with rules, policies, standards and procedures that the State Chief In-
formation Officer or a state agency, under the state agency’s independent authority, adopts or oth-
erwise promulgates; and
(iii) Recommend necessary changes to a state agency’s rules, policies, standards and procedures
to ensure compliance and prevent information security incidents.
(c) “Information security incident” means an incident that creates a risk of harm to a state
agency or the state agency’s operations and in which:
(A) Access to, or viewing, copying, transmission, theft or usage of, a state agency’s sensitive,
protected or confidential information occurs without authorization from the state agency;
(B) A failure of compliance with a state agency’s security or acceptable use policies or practices
occurs that results in access to a state agency’s information system or information resources for
viewing, copying, transmission, theft or use without the state agency’s authorization; or
(C) A state agency’s information system or information resources or a third party information
service to which a state agency subscribes becomes unavailable in a reliable and timely manner to
authorized individuals or organizations, or is modified or deleted under circumstances that the state
agency does not intend, plan or initiate.
[9]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
(d)(A) “Information system” means a system of computers and related hardware, software, stor-
age media and networks and any other means by which a state agency collects, uses or manages the
state agency’s information resources.
(B) “Information system” does not include a third party information service to which a state
agency subscribes if the third party information service incorporates or uses hardware, software,
storage media and networks that the state agency does not own or lease or that the state agency
does not have the legal authority to directly monitor or control.
(e) “State agency” means an officer, board, commission, department, agency or institute of state
government, as defined in ORS 174.111, except:
(A) Public universities listed in ORS 352.002; and
(B) The Oregon State Lottery and entities with which the Oregon State Lottery has a contract
or agreement with respect to the Oregon State Lottery’s gaming systems or networks.
(2) A state agency shall promptly notify the Legislative Fiscal Office of an information security
incident and describe the actions the state agency has taken or must reasonably take to prevent,
mitigate or recover from damage to, unauthorized access to, unauthorized modifications or deletions
of or other impairments of the integrity of the state agency’s information system or information re-
sources.
(3) Each state agency shall periodically conduct or contract for an information security assess-
ment of the state agency’s information system and information resources and shall request results
from a third party’s information security assessment of an information service that the third party
provides and to which the state agency subscribes. Each state agency shall notify the Legislative
Fiscal Office of the information security assessment after the state agency receives the results of
the information security assessment.
(4)(a) The State Chief Information Officer, the Secretary of State, the State Treasurer, the At-
torney General, the State Court Administrator and the Legislative Administrator shall each submit
to, and present in an appropriate hearing or other proceeding before, the Joint Legislative Com-
mittee on Information Management and Technology an annual report concerning the security of the
information systems and information resources over which the State Chief Information Officer, the
Secretary of State, the State Treasurer, the Attorney General, the State Court Administrator or the
Legislative Administrator has direct or supervisory control.
(b) The annual report described in paragraph (a) of this subsection may not include information
security information or other materials that are exempt from disclosure under ORS 192.311 to
192.478.
(5)(a) The Legislative Fiscal Office shall use the notifications the office receives under sub-
sections (2) and (3) of this section, and any other information about an information security assess-
ment or an information security incident that a state agency provides to the office, via a method
and at a level of detail to which the state agency and the office agree, solely for the purpose of
providing support and assistance to the Joint Legislative Committee on Information Management
and Technology[ ,] and the Joint Committee on Ways and Means [ and the Joint Legislative Audit
Committee].
(b)(A) Except as provided in subparagraph (B) of this paragraph, the Legislative Fiscal Officer
or an employee of the Legislative Fiscal Office may not disclose to any other person the nature or
contents of the notifications that the office receives under subsections (2) and (3) of this section or
any other information described in paragraph (a) of this subsection to the extent that the notifica-
tions or the information are exempt from disclosure under ORS 192.311 to 192.478.
[10]
A-Eng. HB 2454
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
(B) The Legislative Fiscal Officer or an employee of the Legislative Fiscal Office may disclose
the nature or contents of the notifications or information described in subparagraph (A) of this
paragraph if the officer or employee obtains the written consent of:
(i) The State Chief Information Officer, with respect to notifications and information that a state
agency within the executive department, as defined in ORS 174.112, provided;
(ii) The Secretary of State, with respect to notifications and information that the office of the
Secretary of State provided;
(iii) The State Treasurer, with respect to notifications and information that the office of the
State Treasurer provided;
(iv) The Attorney General, with respect to notifications and information that the Department
of Justice provided;
(v) The State Court Administrator, with respect to notifications and information that a court
or a state agency within the judicial department, as defined in ORS 174.113, provided; or
(vi) The Legislative Administrator, with respect to notifications and information that a state
agency within the legislative department, as defined in ORS 174.114, provided.
SECTION 13.
Section 2 of this 2025 Act and the amendments to ORS 171.415, 171.425,
171.430, 171.580, 171.585, 171.590, 244.050, 276A.306, 297.050 and 297.070 by sections 3 to 12 of
this 2025 Act become operative January 1, 2026.
SECTION 14. This 2025 Act takes effect on the 91st day after the date on which the 2025
regular session of the Eighty-third Legislative Assembly adjourns sine die.
[11]