California's security standard.
And every state contract inherits it.

They're two layers of the same requirement. SAM Chapter 5300 is the policy: the executive-branch State Administrative Manual section establishing the information security and privacy requirements every California state entity must meet. The SIMM 5300 series is the implementation — the Statewide Information Management Manual, owned by the California Department of Technology's Office of Information Security (OIS), translating that policy into specific controls based on NIST 800-53 with California-specific parameters.

In practice you comply with SAM by implementing SIMM. The series includes a confidential California control set (SIMM 5300-A, available to designated personnel and to vendors under NDA in procurement), a public Foundational Framework (SIMM 5300-B), maturity assessments (SIMM 5300-C), and the reporting and certification instruments in the SIMM 5330 series. The whole structure is anchored in Government Code sections 11545 through 11549.4.

If you provide IT or data services to California state agencies, the requirements effectively flow down to you, even though the certification obligation sits with the agency. The framework binds the state entity, but agencies are responsible for the security of the data they entrust to vendors, so procurement and contract terms push the relevant controls onto contractors that handle state information. That's also why the confidential control set, SIMM 5300-A, is shared with vendors under NDA during procurement — the state expects you to meet it.

For a vendor, demonstrating you can operate to the SIMM 5300 baseline is increasingly a prerequisite to winning and keeping state work, and a real differentiator on vehicles like CMAS. WatchUr6 holds CMAS #3-25-06-1018 and has prior performance with the State of California and the California DMV, so we help both state entities and their contractors meet the standard from either side.

SIMM 5330-B is the Information Security and Privacy Program Compliance Certification each California state entity submits to OIS every year. Government Code section 11549.3 requires covered agencies to certify annually that they comply with adopted state security policies, standards, and procedures — and that certification must include a plan of action and milestones for any gaps. It's submitted on the schedule in SIMM 5330-C, due to OIS by the last business day of the entity's scheduled reporting month.

It's paired with the SIMM 5330-A designation letter, through which the entity head formally names the agency's CIO, Information Security Officer, Technology Recovery Coordinator, and Privacy Officer to OIS, with updates required when those roles change. Because it's signed at the agency-head level and backed by statute, it isn't a formality — it's a personal attestation of the program's state, which is exactly why the maturity assessment and evidence behind it matter.

SAM-5300 is built on NIST. The underlying control catalog for SIMM 5300 is NIST 800-53 (with its 800-53B baselines), which California tailors with state-specific parameters in the confidential SIMM 5300-A, referencing FIPS 199 and FIPS 200 for categorization. California has also explicitly aligned its program with NIST CSF 2.0, including the Govern function that sits above identify, protect, detect, respond, and recover.

So an organization with a mature 800-53 or CSF program already shares most of the substance — the work is usually less about building controls from scratch and more about tailoring to California's parameters, mapping into the SIMM structure, running the SIMM 5300-C maturity assessment, and producing the evidence the annual OIS certification depends on. One caution: the SIMM series is updated frequently, with new and revised standards issued by CDT on an ongoing basis, so staying compliant means keeping pace with the current standards rather than treating the framework as static.