SB 272 defines an “enterprise system” as a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses and that meets the following conditions: (1) it is a multi-departmental system or a system that contains information about the public; and (2) it is a “system of record” — that is, a system that serves as an original source of data within the agency.

Under SB 272, enterprise systems do not include information technology (IT) security systems (including firewalls and other cybersecurity systems); physical access control systems; employee identification management systems; video monitoring and other physical control systems; infrastructure and mechanical control systems (including those that control or manage street lights, electrical, natural gas, water, or sewer functions); systems related to emergency services (such as 911 dispatch and operations); or data and information that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, the agency’s IT system.