California state entities must certify annually.
Contractors servicing state agencies inherit the requirements.

Yes if you are a contractor providing IT services to California state entities, and the flow-down is contractual rather than nominally regulatory.

State Administrative Manual Chapter 5300 directly binds California state agencies, departments, divisions, bureaus, boards, and commissions as defined in Government Code § 11546.1. But state contracts uniformly include flow-down clauses requiring contractors providing information technology services to comply with applicable SAM-5300 / SIMM 5300 requirements at the level of detail appropriate to the work being performed. The California Multiple Award Schedule (CMAS), master service agreements, and individual agency contracts all carry these obligations.

The practical implication for IT contractors is that their security program must demonstrate alignment with the California-specific NIST 800-53 parameters in SIMM 5300-A, the operational standards in the SIMM 5340-5360 series, and the annual certification cadence per SIMM 5330-B for the contracted scope of work.

For organizations holding CMAS contracts specifically, the SAM-5300 flow-down is a standing capability requirement that must be demonstrable on contract performance and during California Department of General Services contract compliance reviews.

WatchUr6 holds CMAS contract #3-25-06-1018, which positions us to operate as both an SAM-5300-compliant contractor and a readiness partner for California state entities and other contractors carrying the same obligations.

Understanding the document hierarchy is essential because each layer plays a distinct role:

SAM Chapter 5300 is the policy authority. The State Administrative Manual is California's executive branch policy manual, owned by the Department of General Services. SAM 5300 establishes the high-level policy requirement that state entities maintain an information security program aligned with statewide standards. The legal-policy anchor that gives the program enforceability.

SIMM 5300 series is the implementation manual. The Statewide Information Management Manual is owned by the California Department of Technology and its Office of Information Security under Government Code § 11549.3. The SIMM 5300 series translates SAM policy into specific implementation standards.

SIMM 5300-A (confidential): California-specific security parameters for NIST SP 800-53 controls. Not publicly available because it contains sensitive control implementation details. Agencies receive it through their authorized OIS relationship.

SIMM 5300-B (public): Foundational Framework for Information Security. The prioritization framework agencies use to sequence their information security program development.

SIMM 5300-C: maturity assessments. The structured assessment tool agencies use to measure their information security program maturity against the framework.

The other SIMM 5300-series documents (5310, 5315, 5320, 5325, 5330, 5335, 5340, 5345, 5350, 5355, 5360) are operational standards covering specific control areas.

SIMM 5300 is California's specific application of NIST SP 800-53 plus state-defined parameters and operational standards.

NIST SP 800-53 Rev 5 is the underlying control catalog California has adopted as the technical baseline for state cybersecurity. Where SIMM 5300 diverges from generic NIST 800-53 implementation is in three meaningful ways:

First, California-specific security parameters: SIMM 5300-A defines California's specific parameter selections for NIST 800-53 controls (parameter values for assignment statements, frequency requirements for periodic activities, scope specifications). These California-specific parameters are confidential and not publicly available.

Second, the Foundational Framework (SIMM 5300-B) provides California's specific prioritization of information security program activities, which differs from the generic NIST 800-53 baseline tiering.

Third, the operational standards (SIMM 5340-5360 series) layer specific implementation requirements on top of NIST 800-53 controls in areas California has prioritized for statewide consistency: incident response and reporting (SIMM 5340-A), vulnerability management (SIMM 5345-A), Zero Trust Architecture (SIMM 5350-A and 5350-B Roadmap), continuous security monitoring (SIMM 5335-B), MITRE ATT&CK Framework adoption (SIMM 5335-C).

Practical implication: organizations with mature NIST 800-53 programs have approximately 85% of the underlying technical foundation already in place; the SIMM-specific work concentrates on the California parameter tailoring, the operational standard layering, the annual compliance certification, and the OIS reporting cadence.

SIMM 5330-B is the Information Security and Privacy Program Compliance Certification — the annual written attestation that the California Office of Information Security examines as the artifact-of-record for state entity compliance.

The certification is signed by the state entity's CISO and submitted on the schedule established in SIMM 5330-C (the compliance reporting schedule, most recently updated April 2026). Independent and constitutional offices submit through the parallel SIMM 5330-F certification.

The certification covers attestation that the entity has:

(1) Implemented SAM 5300 policy requirements; (2) Aligned the information security program with the Foundational Framework (SIMM 5300-B) prioritization; (3) Applied the California-specific NIST 800-53 parameters from SIMM 5300-A; (4) Implemented the applicable operational standards from the SIMM 5340-5360 series; (5) Conducted the maturity assessment required by SIMM 5300-C; (6) Designated CISO and Information Security Officer per SIMM 5330-A; (7) Documented material findings and gaps in Plans of Action and Milestones (POA&Ms); (8) Responded to applicable Technology Letters issued by OIS in the reporting period.

The certification is not just a checkbox: the SIMM 5330-H Information Security Policy Compliance and Enforcement Standard establishes OIS authority to address non-compliance through escalating enforcement steps.

For contractors providing IT services to state entities, the SIMM 5330-B mechanics matter because contractor performance feeds the state entity's certification — gaps in contractor security posture flow up into the state entity's annual attestation.

The 2025-2026 update cycle has been unusually active, with several material new standards and refreshes issued by OIS through formal Technology Letters.

Technology Letter 25-03 (June 2025): Introduced SIMM 5320-A Phishing Exercise Standard, establishing requirements for simulated phishing exercise plans including guidelines for collaboration with third-party vendors conducting phishing simulations. State entities must now run defensible phishing exercises against documented program standards.

Technology Letter 25-04 (August 2025): Introduced two related standards. SIMM 5335-B Continuous Security Monitoring and Event Management Standard moves California state entities meaningfully toward operational SOC capability. SIMM 5335-C MITRE ATT&CK Framework formalizes a threat-actor-behavior framework that state entities must align their detection and response capabilities against.

SIMM 5350-A Zero Trust Architecture Standard updated January 2026, with SIMM 5350-B Zero Trust Architecture Roadmap (XLSX format) updated December 2025. State entities are now expected to be on a documented Zero Trust roadmap.

SIMM 5340-A Information Security Incident Response and Reporting updated February 2026, refreshing IR and personal information breach response requirements.

SIMM 5330-A Designation Letter updated April 2026, with SIMM 5330-D Instructions updated May 2025 — refreshing who within the state entity is formally designated to carry information security responsibilities.

The cumulative implication: 2026 SIMM 5330-B certifications must reflect implementation of (or documented POA&Ms toward) these new and refreshed standards.

CMAS contracts (California Multiple Award Schedule, administered by the DGS Procurement Division) carry SAM-5300 / SIMM 5300 obligations as standing capability requirements that must be demonstrable on contract performance and during DGS contract compliance reviews.

The specific obligations vary by the scope of services in your CMAS contract, but the standard pattern for IT services contractors:

First, the contractor's security program must align with the California-specific NIST 800-53 parameters in SIMM 5300-A at the level of detail appropriate to the services being performed.

Second, the contractor must comply with the operational standards in the SIMM 5340-5360 series that touch the contracted scope: if you're providing cloud services, SIMM 5315-B Cloud Security Standard applies; if you're providing endpoint management, SIMM 5355-A and 5355-B apply; if you're providing security operations, SIMM 5335-B Continuous Security Monitoring and SIMM 5340-A Incident Response apply.

Third, the contractor must support the state entity's annual SIMM 5330-B certification by providing evidence of security posture — contractor gaps flow up into the state entity's attestation.

Fourth, the contractor must respond to applicable Technology Letters as they are issued by OIS, even if those letters are addressed primarily to state entities.

Fifth, for contractors holding multiple state contracts simultaneously, the compliance burden compounds: each contracting agency may have additional flow-down requirements layered on top of the baseline CMAS terms.

WatchUr6's CMAS #3-25-06-1018 status reflects the operator credentials California state contracting expects, and our service to other CMAS holders and state entities is anchored on this practical knowledge of how the obligations actually flow.