All Dedicated County SPOCs and Technical Contacts:
December 22, 2025 UPDATE: The CWDS Infrastructure team thanks everyone for their continued collaboration with the Zscaler implementation project. Below is the recount from the latest Zscaler User Group meeting on Friday, December 19, 2025:
Zscaler Release Date
The CWDS Infrastructure team plans to release Zscaler on Wednesday, January 21, 2026, at 12:00 Noon Pacific Time.
Q&A Highlight
Q: If new remote user credentials are needed, should counties delay requesting Cisco AnyConnect credentials and wait for Zscaler?
A: No. Please continue with your county’s standard process to request Cisco AnyConnect credentials. In addition, request Zscaler credentials for any users who do not already have them.
Next Steps & Holiday Message
The session on Friday, December 19, 2025, was the final Zscaler User Group meeting for 2025. The CWDS Infrastructure team looks forward to connecting again early in January as the Zscaler release date approaches. In the meantime, the team wishes you, your families, and your loved ones a safe and joyful holiday season.
_________________________________________________________________
December 15, 2025 UPDATE: The CWDS Infrastructure team expresses their appreciation for those who have joined the weekly Zscaler User Group meetings in November and December and for your continued engagement. Your participation helps keep our efforts on track to quickly identify and address any issues that arise.
Here are the newest questions and answers that arose from the most recent status meeting:
Q: When will the recordings of the previous Zscaler User Group meetings be saved to the CWDS website?
A: The CWDS Web team is working on receiving the necessary approvals. We will provide an update once the CWDS Infrastructure team receives word from the Web team.
Q: When will Zscaler be ready for customers to use?
A: Zscaler testing is nearly completed. An exact implementation date to use Zscaler should be provided by the next Zscaler User Group meeting on Friday, December 19, 2025.
Zscaler Client Connector Deployment Status
CWS Ops is nearing completion of the Zscaler Client Connector deployment across all workstations. Only a small number of workstations remain without the installation. For those machines, we kindly ask that you leave them powered on for an extended period to allow the deployment to complete. If you are a remote user and utilize Cisco AnyConnect, please ensure you are logged in so we can complete the installation successfully.
CWDS appreciates your cooperation and support for this project.
____________________________________________________________________
November 24, 2025 UPDATE: The CWDS Infrastructure team appreciates your continued participation and support during this Zscaler migration project. Following our last status meeting on Friday, November 21, 2025, the team is pleased to share that they have made steady progress and are now moving forward with this project, as expected. Your ongoing engagement and valuable contributions play an essential role in helping to maintain momentum to achieve these shared goals. We remain grateful for your commitment and look forward to the continued collaboration.
Here are the newest questions and answers that arose from the most recent status meeting:
Q: When will additional Okta authentication login options be available?
A: As of Friday, November 21, 2025, users should have the ability to not have to rely on the ‘Okta Verify’ option from a mobile device. Users now have the ability to obtain the multi-factor authentication (MFA) one-time-use code through their email.
Q: Does this effort involving Zscaler and Okta affect the Server Based Computing (SBC) users login?
A: SBC users will continue to login as they normally do; this Zscaler/Okta effort has no impact on SBC.
Q: When can users expect to receive the email to create the Zscaler/Okta account?
A: Users should have already received an Okta account email from the CWDS Infrastructure team. If users have not yet received the email, please inform the CWDS Infrastructure team at cwsoperationsteam@otsi.ca.gov with the list of users who need to receive the account creation email. Please include the first name, last name, and the email address for each user on the list.
Q: When will the Zscaler client be installed on the CWS workstations?
A: Starting at 6:00 PM on Wednesday, November 26, 2025, the CWDS Infrastructure team and IBM/Kyndryl will start deploying the Zscaler Client Connector to the CWS workstation, using the BigFix installer. The installation process will use a rolling deployment, so as not to cause too large of impact to the network at one time.
If possible, please leave the CWS workstations powered on over the Thanksgiving holiday. Note: please also be connected to the Virtual Private Network (VPN) if the workstation uses VPN. This process will occur silently in the background.
Once completed, the user will notice the Zscaler application loaded on the workstation. This is an automatic loading process; however, no further action is needed as of this time. The user can close the Zscaler application to continue to do their daily work. Further instruction will be provided when Zscaler is expected to be in use. For now, this current activity is only to load the Zscaler application onto the workstation.
Please direct any questions regarding this process to the CWDS Customer Relations mailbox at CWS_CustRel@otsi.ca.gov.
_______________________________________________________________________
November 10, 2025 UPDATE: The CWDS Infrastructure team will be sending out emails to the Dedicated Counties to create their Zscaler accounts. The attached New User Guide Okta & Zscaler document will assist counties with solving any questions that Counties may have during the transition to Zscaler and Okta. The Infrastructure team will continue to leverage the Friday ‘CWS Ops Zscaler User Group’ meetings to communicate the next steps in this project and to answer any questions that the Counties may have.
Here are a couple questions and answers that arose from last week’s meeting:
Q: Will users that rely on Citrix to login into the CWS/CMS application be impacted when this Virtual Private Network (VPN) change occurs?
A: No impact will be reflected if a user is using Citrix to access the CWS/CMS application.
Q: Since Zscaler depends on the use of Okta, is it possible to receive directions outlining Okta verification process?
A: The attached New User Guide Okta & Zscaler document provides instructions on installing the “Okta verify application” function on iOS and Android mobile devices. The CWDS Infrastructure team is researching the possibility of installing the Okta application on the CWS/CMS workstations, but are currently requesting Dedicated Counties to allow the installation on mobile devices.
Action Required
The only action currently required of the Dedicated County is to create their Zscaler accounts when the email invite is delivered to their Outlook mailbox.
Please continue to attend the Zscaler meetings on Fridays in November and December to learn about the transition from AnyConnect VPN to Zscaler and to share any questions or concerns that you have regarding this project.
___________________________________________________________________
The CWDS Infrastructure team, along with IBM/Kyndryl, currently use AnyConnect Virtual Private Network (VPN) for Dedicated County remote access to the CWS/CMS application. In an effort to achieve higher security standards and to move away from obsolete technologies, CWDS is switching to the Zscaler tool for remote access. Additionally, Zscaler will replace the McAfee proxy that is used to whitelist specific websites for the Dedicated Counties. In collaboration with Zscaler, CWDS will also use the Okta identity management tool.
Zscaler is a cloud native security platform that allows users to connect to applications and surf the internet securely. Okta is an identify management platform that allows user to securely authenticate to services.
The CWDS Infrastructure team will create accounts for all Dedicated County users. On November 19, 2025, IBM/Kyndryl will use the BigFix tool to deploy Zscaler on the Dedicated County workstations. Users will receive emails from Zscaler and Okta as the accounts are created and are rolled out to the workstations.
In December 2025, CWDS will transition from Cisco AnyConnect VPN and McAfee Proxy to Zscaler and Okta. In January 2026, the transition will be completed. Cisco AnyConnect VPN and McAfee Proxy will no longer be used; Dedicated Counties will be fully using only Zscaler and Okta.
To help users with the transition to Zscaler and Okta, the CWDS Infrastructure team will hold weekly meetings every Friday afternoon at 1:00 PM, beginning on November 7, 2025, and running through to the end of the calendar year. The CWDS Infrastructure team will use these meetings to cover the Zscaler project, why it is occurring, the timeline and activities, and to answer questions and concerns regarding the project.
Action Required
Please attend the Zscaler transition meetings, Fridays in November and December, to learn about the transition from AnyConnect VPN to Zscaler and to share any questions or concerns that you have regarding this project.
