All Dedicated County SPOCs and Technical Contacts:
April 2, 2026, UPDATE: CWS/CMS Operations would like to share an important update regarding how all Zscaler support requests will be handled moving forward. These changes will help streamline the process and ensure users receive consistent and timely support.
Effective immediately, all Zscaler-related support requests must be directed to the CMS/CMS Help Desk. This includes:
- Creating new user accounts
- Granting access or requesting unblocked URLs
- Troubleshooting login, access, or connectivity issues
Please encourage users to review the latest Okta & Zscaler User Guide, which is attached to this message. The guide includes:
- Step-by-step instructions for logging in to Zscaler
- How to reset passwords
- How to reset MFA
- Q&A section covering common issues and solutions
- Support contact information
CMS/CMS Help Desk Contact Information:
- CWS/CMS Service Desk Email: cmshelp@kyndryl.com
- CWS/CMS Service Desk Phone Number: 1-800-428-8268
Following these updated procedures will help ensure faster resolution times and a smoother experience for all users.
Thank you for your cooperation and continued partnership.
____________________________________________________________________________________
February 6, 2026, UPDATE: The CWDS Infrastructure team would like to extend their most sincere gratitude to everyone on their ongoing participation either directly or indirectly with the Zscaler effort.
Updates:
During our deployment, this past January 28th we had some setbacks that caused the rollback process for Lassen, Plumas and Sutter site 1. CWS Ops has been diligently working on a solution for the counties affected. Currently this has been solved and confirmed for Lassen and Plumas County. For Sutter County we are still working on the fix to be applied. Once the fix is confirmed, we will work with SPOCs directly to provide next steps.
Next STEPS for Lassen and Plumas County:
- Zscaler to be released once again on Monday February 9th
- Please reboot your workstation before the start of the day
- Login to Zscaler to be able to access the CWS/CMS resources
____________________________________________________________________________________
January 26, 2026 UPDATE: The CWDS Infrastructure team would like to remind you to reboot your workstation on Wednesday, January 28, 2026. This will ensure your computer is ready with the latest changes before you login and start using Zscaler.
Attached is a copy of the “New User Guide Okta & Zscaler v1.2.” Please review if you have any questions or concerns with the user login and activation process.
Also attached is the calendar invite to allow users to join the call to address any concerns or issues during the deployment of Zscaler.
Zscaler release dates:
Phase 1 of release COMPLETED:
January 21 2026: Shasta, Del Norte, Imperial, Sierra, and Amador to start using Zscaler.
NOTE: Reboot CWS/CMS workstations prior to logging in on Wednesday, January 21, 2026.
Phase 2 of release:
January 28 2026: The remaining Dedicated Counties and Tribes.
NOTE: Reboot CWS/CMS workstations prior to logging in on Wednesday, January 28, 2026.
____________________________________________________________________________________________________
January 16, 2026 UPDATE: Appreciation to everyone who joined today’s “CWS Ops Zscaler User Group” meeting. We are excited as we move forward with this project. Your support and participation is valued.
In this communication we have attached the New User Guide – Okta & Zscaler v1.1 document. Please use this guide for user account activation, enabling Multi-Factor Authentication (MFA), and using Zscaler.
This is a friendly reminder for those who have not yet done so, to please complete their Zscaler account activation. Please do not delay this step to prevent a possible disruption of service on your State-issued CWS workstation.
Important! Release dates have been updated:
Phase 1 of release: January 21 2026: Shasta, Del Norte, Imperial, Sierra, and Amador Counties to start using Zscaler.
NOTE: Phase 1 users – Make sure you reboot your workstation before using Zscaler on January 21, 2026.
Phase 2 of release: January 28 2026: Everyone else to start using Zscaler.
NOTE: Phase 2 users – Make sure you reboot your workstation before using Zscaler on January 28, 2026.
Also, please add the attached ‘CWS Ops Zscaler Production Support’ Outlook invite to your calendar. You may join the call on January 21, 2026, or January 28, 2026, for Zscaler questions or concerns.
Thank you for your support and participation.
____________________________________________________________________________________
January 13, 2026 UPDATE: The CWDS Infrastructure team thanks everyone for their continued support with the Zscaler implementation project. Below is the recount from the latest Zscaler User Group meeting on Friday, January 9, 2026:
Updates
Appreciation to Shasta, Del Norte, and Imperial Counties for your participation as testers. Please continue to share any feedback as it allows us to improve and close any issues.
We have attached the New User Guide – Okta & Zscaler v1.1 document. Please utilize this guide for user account activation, enabling Multi-Factor Authentication (MFA), and using Zscaler.
You can now review the previous Zscaler User group sessions at your own pace. These sessions are located on the CWDS website at this link: https://cwds.ca.gov/pages/hardware_technical_information.
Users who have not yet completed their Zscaler account activation will receive an invitation to activate their account. Please ensure users complete their activation as soon as possible. Do not delay on this step so that no disruption is experienced on your State-issued workstation. Once the account is created, wait for the release date before using Zscaler.
Zscaler Release Date
The CWDS Infrastructure team plans to make one final firewall network change in preparation to the release date. This change should not impact users. It is scheduled for Tuesday, January 13, 2026, at 12:00 Noon, Pacific Time.
Phase 1 of release: January 21 2026, at 12:00 Noon. Shasta, Del Norte, Imperial, Sierra and Amador Counties to start using Zscaler.
Phase 2 of release: January 28 2026, at 12:00 Noon. All remaining Dedicated Counties to start using Zscaler.
Q&A Highlight
Q: What is the process to request a ZScaler account?
A: Send an email to cwsoperationsteam@otsi.ca.gov to request a Zscaler account.
________________________________________________________________________________
December 22, 2025 UPDATE: The CWDS Infrastructure team thanks everyone for their continued collaboration with the Zscaler implementation project. Below is the recount from the latest Zscaler User Group meeting on Friday, December 19, 2025:
Zscaler Release Date
The CWDS Infrastructure team plans to release Zscaler on Wednesday, January 21, 2026, at 12:00 Noon Pacific Time.
Q&A Highlight
Q: If new remote user credentials are needed, should counties delay requesting Cisco AnyConnect credentials and wait for Zscaler?
A: No. Please continue with your county’s standard process to request Cisco AnyConnect credentials. In addition, request Zscaler credentials for any users who do not already have them.
Next Steps & Holiday Message
The session on Friday, December 19, 2025, was the final Zscaler User Group meeting for 2025. The CWDS Infrastructure team looks forward to connecting again early in January as the Zscaler release date approaches. In the meantime, the team wishes you, your families, and your loved ones a safe and joyful holiday season.
_________________________________________________________________
December 15, 2025 UPDATE: The CWDS Infrastructure team expresses their appreciation for those who have joined the weekly Zscaler User Group meetings in November and December and for your continued engagement. Your participation helps keep our efforts on track to quickly identify and address any issues that arise.
Here are the newest questions and answers that arose from the most recent status meeting:
Q: When will the recordings of the previous Zscaler User Group meetings be saved to the CWDS website?
A: The CWDS Web team is working on receiving the necessary approvals. We will provide an update once the CWDS Infrastructure team receives word from the Web team.
Q: When will Zscaler be ready for customers to use?
A: Zscaler testing is nearly completed. An exact implementation date to use Zscaler should be provided by the next Zscaler User Group meeting on Friday, December 19, 2025.
Zscaler Client Connector Deployment Status
CWS Ops is nearing completion of the Zscaler Client Connector deployment across all workstations. Only a small number of workstations remain without the installation. For those machines, we kindly ask that you leave them powered on for an extended period to allow the deployment to complete. If you are a remote user and utilize Cisco AnyConnect, please ensure you are logged in so we can complete the installation successfully.
CWDS appreciates your cooperation and support for this project.
____________________________________________________________________
November 24, 2025 UPDATE: The CWDS Infrastructure team appreciates your continued participation and support during this Zscaler migration project. Following our last status meeting on Friday, November 21, 2025, the team is pleased to share that they have made steady progress and are now moving forward with this project, as expected. Your ongoing engagement and valuable contributions play an essential role in helping to maintain momentum to achieve these shared goals. We remain grateful for your commitment and look forward to the continued collaboration.
Here are the newest questions and answers that arose from the most recent status meeting:
Q: When will additional Okta authentication login options be available?
A: As of Friday, November 21, 2025, users should have the ability to not have to rely on the ‘Okta Verify’ option from a mobile device. Users now have the ability to obtain the multi-factor authentication (MFA) one-time-use code through their email.
Q: Does this effort involving Zscaler and Okta affect the Server Based Computing (SBC) users login?
A: SBC users will continue to login as they normally do; this Zscaler/Okta effort has no impact on SBC.
Q: When can users expect to receive the email to create the Zscaler/Okta account?
A: Users should have already received an Okta account email from the CWDS Infrastructure team. If users have not yet received the email, please inform the CWDS Infrastructure team at cwsoperationsteam@otsi.ca.gov with the list of users who need to receive the account creation email. Please include the first name, last name, and the email address for each user on the list.
Q: When will the Zscaler client be installed on the CWS workstations?
A: Starting at 6:00 PM on Wednesday, November 26, 2025, the CWDS Infrastructure team and IBM/Kyndryl will start deploying the Zscaler Client Connector to the CWS workstation, using the BigFix installer. The installation process will use a rolling deployment, so as not to cause too large of impact to the network at one time.
If possible, please leave the CWS workstations powered on over the Thanksgiving holiday. Note: please also be connected to the Virtual Private Network (VPN) if the workstation uses VPN. This process will occur silently in the background.
Once completed, the user will notice the Zscaler application loaded on the workstation. This is an automatic loading process; however, no further action is needed as of this time. The user can close the Zscaler application to continue to do their daily work. Further instruction will be provided when Zscaler is expected to be in use. For now, this current activity is only to load the Zscaler application onto the workstation.
Please direct any questions regarding this process to the CWDS Customer Relations mailbox at CWS_CustRel@otsi.ca.gov.
_______________________________________________________________________
November 10, 2025 UPDATE: The CWDS Infrastructure team will be sending out emails to the Dedicated Counties to create their Zscaler accounts. The attached New User Guide Okta & Zscaler document will assist counties with solving any questions that Counties may have during the transition to Zscaler and Okta. The Infrastructure team will continue to leverage the Friday ‘CWS Ops Zscaler User Group’ meetings to communicate the next steps in this project and to answer any questions that the Counties may have.
Here are a couple questions and answers that arose from last week’s meeting:
Q: Will users that rely on Citrix to login into the CWS/CMS application be impacted when this Virtual Private Network (VPN) change occurs?
A: No impact will be reflected if a user is using Citrix to access the CWS/CMS application.
Q: Since Zscaler depends on the use of Okta, is it possible to receive directions outlining Okta verification process?
A: The attached New User Guide Okta & Zscaler document provides instructions on installing the “Okta verify application” function on iOS and Android mobile devices. The CWDS Infrastructure team is researching the possibility of installing the Okta application on the CWS/CMS workstations, but are currently requesting Dedicated Counties to allow the installation on mobile devices.
Action Required
The only action currently required of the Dedicated County is to create their Zscaler accounts when the email invite is delivered to their Outlook mailbox.
Please continue to attend the Zscaler meetings on Fridays in November and December to learn about the transition from AnyConnect VPN to Zscaler and to share any questions or concerns that you have regarding this project.
___________________________________________________________________
The CWDS Infrastructure team, along with IBM/Kyndryl, currently use AnyConnect Virtual Private Network (VPN) for Dedicated County remote access to the CWS/CMS application. In an effort to achieve higher security standards and to move away from obsolete technologies, CWDS is switching to the Zscaler tool for remote access. Additionally, Zscaler will replace the McAfee proxy that is used to whitelist specific websites for the Dedicated Counties. In collaboration with Zscaler, CWDS will also use the Okta identity management tool.
Zscaler is a cloud native security platform that allows users to connect to applications and surf the internet securely. Okta is an identify management platform that allows user to securely authenticate to services.
The CWDS Infrastructure team will create accounts for all Dedicated County users. On November 19, 2025, IBM/Kyndryl will use the BigFix tool to deploy Zscaler on the Dedicated County workstations. Users will receive emails from Zscaler and Okta as the accounts are created and are rolled out to the workstations.
In December 2025, CWDS will transition from Cisco AnyConnect VPN and McAfee Proxy to Zscaler and Okta. In January 2026, the transition will be completed. Cisco AnyConnect VPN and McAfee Proxy will no longer be used; Dedicated Counties will be fully using only Zscaler and Okta.
To help users with the transition to Zscaler and Okta, the CWDS Infrastructure team will hold weekly meetings every Friday afternoon at 1:00 PM, beginning on November 7, 2025, and running through to the end of the calendar year. The CWDS Infrastructure team will use these meetings to cover the Zscaler project, why it is occurring, the timeline and activities, and to answer questions and concerns regarding the project.
Action Required
Please attend the Zscaler transition meetings, Fridays in November and December, to learn about the transition from AnyConnect VPN to Zscaler and to share any questions or concerns that you have regarding this project.
