SB 272 - Enterprise Systems

What is SB 272?
SB 272 requires local agencies (excluding school districts) to create catalogs of all enterprise systems that store information about the public, and to post this catalog on their websites, if they have websites. If they do not have a website, they are required to publish the catalog in a way that can be provided to anyone who asks. This law applies to all California special districts, cities and counties, and compliance is required by July 1, 2016.

Governor Brown approved SB 272 in October 2015, adding section 6270.5 to the California Public Records Act (the “Act,” Government Code Sections 6250-6276.48). Because it was added to the Public Records Act, local agencies will not be able to seek reimbursement from the State for costs associated with compliance.

For the full text of the bill, click or copy and paste this link: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201520160SB272.

What is covered by SB 272?
Section 6270.5 states, "(1) “Enterprise system” means a software application or computer system that collects, stores, exchanges, and analyzes information that the agency uses that is both of the following:
          (A) A multidepartmental system or a system that contains information collected about the public.
          (B) A system of record.

SB 272 requires local agencies to create a catalog of multidepartmental systems or systems containing information about the public that store original records and post the catalog on their agency website.

What is required for the catalog?
For each enterprise system included in the catalog list, agencies must disclose:

• Current system vendor
• Current system product
• The purpose of the system
• What kind of data is stored in it
• The department that serves as the system's primary custodian
• How frequently system data is collected
• How frequently system data is updated
  

SB 272 Catalog of Enterprise Systems - Updated 6/24/2023

Product	Vendor	Purpose	Data Category	Custodian	Collection Frequency	Update Frequency
Adobe Reader X	Adobe	Document imaging and form creation	Document management	Administration	As needed	As needed
Asyst	Asyst	Accounts Payable and Accounts Receivable	Accounting	Accounting	As needed	As needed
Emergency Reporting       NFIRS 5.1	Emergency Reporting NFIRS 5.1	Records Management system for Fire Departments. Store data for incidents. National    Fire Incident Reporting System (NFIRS).	All departments	All departments	24/7 whenever FD is called out	24/7 whenever FD is called out
Facebook	Facebook	Public information	Social media	Administration	As needed	As needed
Microsoft Office 7 Word and Excel	Microsoft, Inc.	Email, Calendars, agenda, minutes, daily deposits, creation and organization of digital work product and the running of applications	Other departments	All departments	Daily	Daily
Publisher 2013	Publisher	Document imaging and form creation	Document management	Administration	As needed	As needed

What is excluded?
Enterprise systems do not include cybersecurity systems, infrastructure and mechanical control systems, or information that would reveal vulnerabilities to, or otherwise increase the potential for an attack on, a public agency's IT system.

Additionally, section 6270.5 does not automatically require disclosure of the specific records that the IT systems collect, store, exchange or analyze, however, the Act's other provisions pertaining to disclosure of such records still apply.