1.1 	A bill for an act
1.2 	relating to state government; requirements for state information technology security; 
1.3 	amending Minnesota Statutes 2018, section 16E.03, by adding subdivisions.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. Minnesota Statutes 2018, section 16E.03, is amended by adding a subdivision 
1.6 	to read:
1.7 		Subd. 11.Web application security development. The chief information officer must 
1.8 	establish web application security development standards that require web application threat 
1.9 	modeling and support the following web application platforms: XML, (.NET), JAVA, and 
1.10 	PHP.

1.11 	Sec. 2. Minnesota Statutes 2018, section 16E.03, is amended by adding a subdivision to 
1.12 	read:
1.13 		Subd. 12.Open source software library. The chief information officer must develop 
1.14 	open source third-party software library policies and use standards to ensure software is 
1.15 	free of vulnerabilities and originates from credible sources.

1.16 	Sec. 3. Minnesota Statutes 2018, section 16E.03, is amended by adding a subdivision to 
1.17 	read:
1.18 		Subd. 13.Web application threat modeling. The chief information officer must 
1.19 	incorporate web application threat modeling within Agile software processes and incorporate 
1.20 	design, development, testing, deployment, postdeployment, and retirement during the entire 
1.21 	life cycle of a web application.