All Dedicated County SPOCs and Technical Contacts:
November 24, 2025 UPDATE: The CWDS Infrastructure team appreciates your continued participation and support during this Zscaler migration project. Following our last status meeting on Friday, November 21, 2025, the team is pleased to share that they have made steady progress and are now moving forward with this project, as expected. Your ongoing engagement and valuable contributions play an essential role in helping to maintain momentum to achieve these shared goals. We remain grateful for your commitment and look forward to the continued collaboration.
Here are the newest questions and answers that arose from the most recent status meeting:
Q: When will additional Okta authentication login options be available?
A: As of Friday, November 21, 2025, users should have the ability to not have to rely on the ‘Okta Verify’ option from a mobile device. Users now have the ability to obtain the multi-factor authentication (MFA) one-time-use code through their email.
Q: Does this effort involving Zscaler and Okta affect the Server Based Computing (SBC) users login?
A: SBC users will continue to login as they normally do; this Zscaler/Okta effort has no impact on SBC.
Q: When can users expect to receive the email to create the Zscaler/Okta account?
A: Users should have already received an Okta account email from the CWDS Infrastructure team. If users have not yet received the email, please inform the CWDS Infrastructure team at cwsoperationsteam@otsi.ca.gov with the list of users who need to receive the account creation email. Please include the first name, last name, and the email address for each user on the list.
Q: When will the Zscaler client be installed on the CWS workstations?
A: Starting at 6:00 PM on Wednesday, November 26, 2025, the CWDS Infrastructure team and IBM/Kyndryl will start deploying the Zscaler Client Connector to the CWS workstation, using the BigFix installer. The installation process will use a rolling deployment, so as not to cause too large of impact to the network at one time.
If possible, please leave the CWS workstations powered on over the Thanksgiving holiday. Note: please also be connected to the Virtual Private Network (VPN) if the workstation uses VPN. This process will occur silently in the background.
Once completed, the user will notice the Zscaler application loaded on the workstation. This is an automatic loading process; however, no further action is needed as of this time. The user can close the Zscaler application to continue to do their daily work. Further instruction will be provided when Zscaler is expected to be in use. For now, this current activity is only to load the Zscaler application onto the workstation.
Please direct any questions regarding this process to the CWDS Customer Relations mailbox at CWS_CustRel@otsi.ca.gov.
_______________________________________________________________________
November 10, 2025 UPDATE: The CWDS Infrastructure team will be sending out emails to the Dedicated Counties to create their Zscaler accounts. The attached New User Guide Okta & Zscaler document will assist counties with solving any questions that Counties may have during the transition to Zscaler and Okta. The Infrastructure team will continue to leverage the Friday ‘CWS Ops Zscaler User Group’ meetings to communicate the next steps in this project and to answer any questions that the Counties may have.
Here are a couple questions and answers that arose from last week’s meeting:
Q: Will users that rely on Citrix to login into the CWS/CMS application be impacted when this Virtual Private Network (VPN) change occurs?
A: No impact will be reflected if a user is using Citrix to access the CWS/CMS application.
Q: Since Zscaler depends on the use of Okta, is it possible to receive directions outlining Okta verification process?
A: The attached New User Guide Okta & Zscaler document provides instructions on installing the “Okta verify application” function on iOS and Android mobile devices. The CWDS Infrastructure team is researching the possibility of installing the Okta application on the CWS/CMS workstations, but are currently requesting Dedicated Counties to allow the installation on mobile devices.
Action Required
The only action currently required of the Dedicated County is to create their Zscaler accounts when the email invite is delivered to their Outlook mailbox.
Please continue to attend the Zscaler meetings on Fridays in November and December to learn about the transition from AnyConnect VPN to Zscaler and to share any questions or concerns that you have regarding this project.
___________________________________________________________________
The CWDS Infrastructure team, along with IBM/Kyndryl, currently use AnyConnect Virtual Private Network (VPN) for Dedicated County remote access to the CWS/CMS application. In an effort to achieve higher security standards and to move away from obsolete technologies, CWDS is switching to the Zscaler tool for remote access. Additionally, Zscaler will replace the McAfee proxy that is used to whitelist specific websites for the Dedicated Counties. In collaboration with Zscaler, CWDS will also use the Okta identity management tool.
Zscaler is a cloud native security platform that allows users to connect to applications and surf the internet securely. Okta is an identify management platform that allows user to securely authenticate to services.
The CWDS Infrastructure team will create accounts for all Dedicated County users. On November 19, 2025, IBM/Kyndryl will use the BigFix tool to deploy Zscaler on the Dedicated County workstations. Users will receive emails from Zscaler and Okta as the accounts are created and are rolled out to the workstations.
In December 2025, CWDS will transition from Cisco AnyConnect VPN and McAfee Proxy to Zscaler and Okta. In January 2026, the transition will be completed. Cisco AnyConnect VPN and McAfee Proxy will no longer be used; Dedicated Counties will be fully using only Zscaler and Okta.
To help users with the transition to Zscaler and Okta, the CWDS Infrastructure team will hold weekly meetings every Friday afternoon at 1:00 PM, beginning on November 7, 2025, and running through to the end of the calendar year. The CWDS Infrastructure team will use these meetings to cover the Zscaler project, why it is occurring, the timeline and activities, and to answer questions and concerns regarding the project.
Action Required
Please attend the Zscaler transition meetings, Fridays in November and December, to learn about the transition from AnyConnect VPN to Zscaler and to share any questions or concerns that you have regarding this project.