A BILL TO BE ENTITLED
AN ACT CONCERNING access to the general assembly computer SYSTEM.
The General Assembly of North Carolina enacts:
SECTION 1.  G.S. 147‑64.6(c)(18) reads as rewritten:
"§ 147‑64.6.  Duties and responsibilities.
(c)	The Auditor shall be responsible for the following acts and activities:
…
(18)	The Auditor shall, after consultation and in coordination with the State Chief Information Officer, assess, confirm, and report on the security practices of information technology systems. If an agency has adopted standards pursuant to G.S. 147‑33.111(a), the audit shall be in accordance with those standards. The Auditor's assessment of information security practices shall include an assessment of network vulnerability. The Auditor may conduct network penetration or any similar procedure as the Auditor may deem necessary, but this sentence does not apply to the General Assembly computer system. The Auditor may enter into a contract with a State agency under G.S. 147‑33.111(c) for an assessment of network vulnerability, including network penetration or any similar procedure, but this sentence does not apply to the General Assembly computer system. Any contract with the Auditor for the assessment and testing shall be on a cost‑reimbursement basis. The Auditor may investigate reported information technology security breaches, cyber attacks, and cyber fraud in State government. The Auditor shall issue public reports on the general results of the reviews undertaken pursuant to this subdivision but may provide agencies with detailed reports of the security issues identified pursuant to this subdivision which shall not be disclosed as provided in G.S. 132‑6.1(c). The Auditor shall provide the State Chief Information Officer with detailed reports of the security issues identified pursuant to this subdivision. For the purposes of this subdivision only, the Auditor is exempt from the provisions of Article 3 of Chapter 143 of the General Statutes in retaining contractors."
SECTION 2.  This act is effective when it becomes law.