Government cybersecurity laws by state

HB 207: Office of Information Technology, duties expanded to include cybersecurity and tasks previously performed by Division of Data Systems Management and Telecommunications Division of the Department of Finance

HB 4166: state budget implementation; 2026-2027

Budget units must submit information technology plans including quality assurance and disaster recovery plans to the department by May 15 each year. The department must approve or reject information technology projects costing $25,000 to $1,000,000 and make recommendations for projects exceeding $1,000,000. Projects exceeding $5,000,000 require independent third-party review before department recommendations.

HB 1666: To amend the law concerning the arkansas self-funded cyber response program.

This amendment adds Senator K. Hammer as a cosponsor to House Bill 1666, which amends the law concerning the Arkansas Self-Funded Cyber Response Program.

AB 2281: Office of Elections Cybersecurity.

The Office of Elections Cybersecurity within the Secretary of State must coordinate efforts between the Secretary of State and local elections officials to reduce cyber incidents affecting election security and integrity, monitor and counteract false or misleading electoral information online, develop best practices in consultation with federal, state, local agencies, academic researchers, and private organizations, and assess whether additional state resources are needed to replace federal election cybersecurity resources.

Takes effect 1 January 2027

AB 979: California Cybersecurity Integration Center: artificial intelligence.

The California Cybersecurity Integration Center must develop a California AI Cybersecurity Collaboration Playbook by January 1, 2027, in consultation with the Office of Information Security and the Government Operations Agency. The playbook must include mandatory information sharing mechanisms for state contractors and vendors providing artificial intelligence services regarding potential threats and vulnerabilities.

AB 370: California Public Records Act: cyberattacks.

Each agency must determine within 10 days whether a records request seeks disclosable public records and promptly notify the requester of the determination. Agencies may extend this deadline by written notice for no more than 14 days under unusual circumstances, including when a cyberattack prevents access to electronic servers or systems until the agency regains access.

Took effect 1 January 2026

HB 1252: Updates to State Emergency Response Departments & Divisions

Reorganizes state emergency management functions by designating the Office of Emergency Management as the primary agency for disaster recovery coordination, creating a State Recovery Task Force, establishing protections for disaster survivor information, and relocating the auxiliary communications unit while updating related statutes and tribal affairs coordination requirements.

SB 185: Enhance Security of Office of Information Technology

SB 7024: OGSR/Cybersecurity, Information Technology, and Operational Technology Information

Agencies must treat cybersecurity, information technology, and operational technology information as confidential and exempt from public records disclosure, including network schematics, hardware and software configurations, encryption information, detection and response practices, login credentials, risk assessments, and insurance coverage limits. Agencies must close meeting portions that would reveal such information.

HB 1085: Local Government Cyber Security

The Florida Digital Service must administer the Local Government Cybersecurity Protection Program, enter into data-sharing agreements with local governments, contract for and award information technology commodities and services to eligible local governments by December 1 annually, and submit annual reports beginning December 15, 2027.

Took effect 1 July 2026

SB 7020: OGSR/Agency Cybersecurity Information

Extends the scheduled repeal date of cybersecurity information exemptions from public records and meetings requirements from October 2, 2026 to October 2, 2027 under section 119.0725, and from October 2, 2025 to October 2, 2026 under section 282.318.

Took effect 1 July 2025

H 277: OFFICE OF INFORMATION TECHNOLOGY SERVICES – Amends existing law to provide for certain criminal history checks to be performed.

The Idaho office of information technology services must obtain a criminal history check based on a ten finger fingerprint card or scan on prospective employees and contractors who provide information technology services to external state agency customers and work in specified IT disciplines including network engineering, operations, software engineering, geographic information systems, database administration, systems engineering, information security engineering, architecture, management, remote sensing analysis, or data science.

Took effect 1 July 2025

H 35: INFORMATION TECHNOLOGY SERVICES – Amends and adds to existing law to require the implementation of cybersecurity best practices and the use of multifactor identification in Idaho state government.

State agencies must implement and maintain cybersecurity best practices and require multifactor identification to access information technology devices or services including email, cloud storage, web applications, networks, databases, and servers. The legislative branch, judicial branch, and elected constitutional officers and their staffs must also implement multifactor identification.

Took effect 1 July 2025

HB 1631: Doit-powers and duties

The Department of Innovation and Technology and the Secretary of State must adopt administrative rules within 6 months specifying how governmental agencies create, send, receive, store, and sign electronic records, including control processes for preservation, integrity, security, and auditability.

Took effect 1 January 2026

SB 472: Cybersecurity.

Political subdivisions, state agencies, school corporations, and state educational institutions must adopt technology resources and cybersecurity policies by December 31, 2025, and submit cybersecurity policies biennially to the office of technology. The office must develop standards, guidelines, and uniform policies for these entities.

Took effect 1 July 2025

SB 51: House Substitute for SB 51 by Committee on Legislative Modernization - Authorizing the chief information security officer to receive audit reports, updating statutes related to services provided by the chief information technology officer and authorizing the office of information technology services to provide certain services to political subdivisions and hospitals.

The executive chief information technology officer may enter into agreements with governmental units, hospitals, and nonprofit corporations to extend state information technology and cybersecurity services to those entities. The office of information technology services shall provide data processing, application hosting, and cloud services under the officer's supervision. The legislative division of post audit shall furnish written audit reports to the chief information security officer and other specified recipients.

HB 2574: Removing the expiration on certain cybersecurity requirements, modifying the duties of chief information security officers and cybersecurity programs, requiring assessment of executive branch agency compliance with cybersecurity requirements, providing for consideration of such compliance by the legislature during the budget process and creating the judicial branch technology oversight council.

Chief information security officers for each branch of government must develop cybersecurity programs complying with NIST CSF 2.0 and conduct periodic audits. Executive branch agency heads must designate information security officers, notify the CISO within 12 hours of data breaches, and comply with statewide cybersecurity standards.

HB 2313: Senate Substitute for HB 2313 by Committee on Federal and State Affairs - Prohibiting the use of the artificial intelligence platform DeepSeek and other artificial intelligence platforms controlled by a country of concern on state-owned devices and on any state network and the use of genetic sequencers or operational software used for genetic analysis that is produced in a foreign adversary.

State agencies must prohibit employees from using state-issued electronic devices to access artificial intelligence platforms of concern and must prohibit installation of applications allowing such access on state devices. State agencies must prohibit use of artificial intelligence platforms of concern on any network operated by the state agency. State agencies currently using such platforms must deactivate and delete their accounts.

SB 75: INFORMATION TECHNOLOGY: Provides for reimbursement to the state for cyber reinforcement support provided to noncompliant recipients. (8/1/26) (EN SEE FISC NOTE SG RV)

Authorizes the office to promulgate emergency rules for initial implementation of cyber reinforcement support reimbursement provisions for noncompliant recipients and related incident procedures.

LD 2092: An Act To Update Certain Terms And References Regarding Information Technology And Cybersecurity

The Chief Information Officer must approve acquisition and use of all information technology products, hardware, software and telecommunications services by state agencies. State agencies must comply with information security and cybersecurity standards established by the Chief Information Officer. The Chief Information Officer may procure cybersecurity services on a retainer basis when necessary to detect, prevent and respond to cyberattacks.

HB 1335: Department of Information Technology - Information Technology Staffing and Capability Assessment - Independent Study

The Department of Information Technology must procure a third-party entity to conduct an independent study comparing compensation of information technology and cybersecurity professionals at State agencies with comparable positions at federal, local, and private sector levels, evaluating the impact of salary adjustments and other compensation benefits, and recommending improvements for recruitment and retention. The Department must submit the study to the Governor and General Assembly by November 1, 2027.

Took effect 1 July 2026

HB 861: Department of Information Technology - Statewide Information Technology Master Plan - Reporting

The Secretary of Information Technology must develop and post a statewide information technology master plan on the Department's website and submit it to the General Assembly within 1 year after the Governor's inauguration in each gubernatorial term. If the deadline is missed, the Secretary must notify the Governor and specified legislative committees within 10 days with an explanation and new publication date not exceeding 3 months later. Each year the Secretary or designee must brief the General Assembly on plan implementation, material changes, and state management of initiatives.

Took effect 1 October 2026

SB 581: Department of Information Technology - Statewide Information Technology Master Plan - Reporting

The Secretary of Information Technology must post the Statewide Information Technology Master Plan publicly on the Department's website within 6 months after the Governor's inauguration in each gubernatorial term. If the deadline is missed, the Secretary must notify the Governor and specified legislative committees within 10 days with an explanation and new publication date not exceeding 3 months later. The Secretary or designee must provide annual briefings to the General Assembly on plan implementation, material changes, and state management of initiatives.

Took effect 1 October 2026

HB 957: Cybersecurity - Standards and Compliance - Alterations

Each local school system must designate a local point of contact for cybersecurity communications, comply with State minimum cybersecurity standards beginning in 2027, conduct a cybersecurity maturity assessment every 2 years, and certify compliance to the Office of Security Management by June 30, 2027 and every 2 years thereafter. The Office of Security Management must annually review and update the State minimum cybersecurity standards.

Took effect 1 July 2026

HB 376: Maryland Cybersecurity Council - Alterations

Alters the Maryland Cybersecurity Council membership by adding the Executive Director of the Cybersecurity Association, Inc., changing appointment authority from the Attorney General to the Governor, and replacing the Attorney General as permanent chair with a chair elected by council members every two years beginning October 1, 2025.

Took effect 1 October 2025

SB 294: Maryland Cybersecurity Council - Alterations

Alters Maryland Cybersecurity Council membership by adding representatives from various organizations and changing chair selection from the Attorney General to biennial election by Council members, with one state employee and one non-state employee. Requires the Council to assess cybersecurity threats from artificial intelligence and quantum computing.

Took effect 1 October 2025

HB 209: State Finance and Procurement - Local Cybersecurity Preparedness and Response Plan and Assessment - Repeal

Repeals a provision requiring county governments, local school systems, and local health departments to create or update cybersecurity preparedness and response plans and complete cybersecurity preparedness assessments, and renumbers subsequent sections accordingly.

Took effect 1 July 2025

HB 235: State Government - Information Technology - Cybersecurity Revisions

The Office of Security Management must develop and maintain a statewide cybersecurity strategy, establish security standards and requirements for state government information systems, assess implementation of those requirements, and direct remediation of vulnerabilities. The Cyber Preparedness Unit must develop cybersecurity training resources and assist local governments with preparedness plans.

Took effect 1 October 2025

SB 239: State Finance and Procurement - Local Cybersecurity Preparedness and Response Plan and Assessment - Repeal

Repeals State Finance and Procurement Section 3.5-405, which required county governments, local school systems, and local health departments to create or update cybersecurity preparedness and response plans and complete cybersecurity preparedness assessments. Renumbers subsequent sections accordingly.

Took effect 1 July 2025

SB 244: State Government - Information Technology - Cybersecurity Revisions

The Office of Security Management must support local governments in developing vulnerability assessments and cyber assessments, providing resources and best practices. The Office must report annually by December 31 on cybersecurity activities and preparedness. The Office must also report by the third Wednesday in January on state cybersecurity expenditures and budget recommendations.

Took effect 1 October 2025

SB 867: Cyber Maryland Program - Revisions

The Maryland Department of Labor shall administer the Cyber Maryland Program and Fund. Beginning in fiscal year 2026, the Program must award competitive grants or contracts for information technology or operational technology to enhance cybersecurity workforce development. The Program shall conduct research, facilitate partnerships, develop a statewide strategic plan, and ensure outcomes reflect racial, gender, ethnic, and geographic diversity.

SB 2654: State Security Operations Center; create within the Mississippi Department of Information Technology Services.

All state agencies subject to Section 25-53-201 must comply with cybersecurity policies and standards, report suspected incidents to the Enterprise Security Program and SSOC within ITS-set timeframes, cooperate with SSOC monitoring and incident response efforts, and implement corrective actions required by the CISO.

Took effect 1 July 2026

SB 2096: MDITS and SOS; require to establish minimum cybersecurity standards for SEMS.

The Department of Information and Technology Services, in consultation with the Secretary of State, must establish mandatory minimum cybersecurity standards and policies for county registrars and election commissioners by January 1, 2027. These standards must ensure the integrity of voter registration and election data in the Statewide Elections Management System and include assessments of adherence.

Took effect 1 July 2026

LB 937: Adopt the Prior Learning Act and the K-12 Education Cybersecurity Act and change provisions relating to student transfers, school absences, option enrollment, extracurricular activities, reports, school employment, the improvement grant program, monitoring or providing instruction, deadlines, the Nebraska Teacher Apprenticeship Program, the Nebraska Teacher Recruitment and Retention Act, and the College Pathway Program Act

Beginning with the 2027-28 school year, school boards and governing authorities of approved or accredited private, denominational, or parochial schools must require job applicants for positions involving regular contact with students to disclose employment history, authorization for record release, and any history of child abuse reports, discipline, or sexual misconduct allegations. Schools must review applicants' employment histories by contacting listed employers.

AB 1: Revises provisions relating to governmental administration. (BDR 19-22)

Using agencies must comply with cybersecurity policies and protocols developed by the Security Operations Center. Using agencies must report suspected cybersecurity incidents to the Office of Information Security and Cyber Defense and Security Operations Center within 24 hours. Persons attending closed meetings between Executive Department agencies and the Legislature regarding public security threats must not disclose information to persons outside the Executive Department or Legislature.

SB 467: Revises provisions relating to cybersecurity. (BDR 19-1149)

The Chief Information Officer must adopt regulations to coordinate cybersecurity activities of state agencies and local governments. The Office of Information Security and Cyber Defense must develop risk assessments, establish partnerships, prepare a statewide strategic plan updated every two years, and maintain cybersecurity incident response plans filed by political subdivisions. Each political subdivision must adopt and maintain a cybersecurity incident response plan.

Took effect 1 July 2025

SB 12: Revises provisions relating to the Office of the Chief Information Officer within the Office of the Governor. (BDR 19-280)

Renames the Office of the Chief Information Officer to the Governor's Technology Office, restructures its internal units and divisions, changes the Deputy Chief of the Office of Information Security from classified to unclassified service, and makes conforming changes throughout Nevada law.

Took effect 1 July 2025

HB 1031: enabling candidates for state office to use campaign funds to pay for security measures.

Campaign funds may be used by state candidates and state officeholders to pay for reasonable security measures for themselves, family members, and campaign or office employees. Such security measures shall not be considered personal use if they address ongoing dangers or threats arising from the individual's status as a state candidate or officeholder. Disbursements must be at usual and normal charges.

HB 626: directing the secretary of state to implement a vulnerability disclosure program for certain election systems.

The secretary of state must implement and operate a public vulnerability disclosure program within 180 days of the effective date that substantially meets or exceeds the recommendations in the Cybersecurity and Infrastructure Security Agency's Guide to Vulnerability Reporting for America's Election Administrators, to enable security researchers and the general public to report security vulnerabilities. The secretary shall work with the cybersecurity advisory committee.

S 3259: Relates to prohibiting the procurement of certain technology and products which pose a state or national security risk

The state and its agencies, state authorities, and political subdivisions must not enter into or renew contracts to procure information and communications technology prohibited under federal law section 889 of Public Law 115-232 or listed as restricted by the chief information officer, except when a waiver is issued by authorized officials.

S 7672: Relates to municipal cybersecurity incidents or ransomware attacks

Municipal corporations and public authorities must report cybersecurity incidents to the commissioner of the division of homeland security and emergency services no later than seventy-two hours after reasonably believing an incident has occurred. Upon ransom payment, they must provide notice within twenty-four hours and a written explanation within thirty days.

A 426: Relates to procurement requirements for end point device security

The commissioner and all state agencies, when procuring end point devices, shall be consistent with any relevant standards, guidelines, or guidance developed as part of the National Institute of Standards and Technology Cybersecurity Framework.

SB 1157: Oklahoma State Bureau of Investigation; making an appropriation. Effective date. Emergency.

Appropriates $1,500,000 from the General Revenue Fund to the Cyber Crime and Fraud Unit Fund for the Oklahoma State Bureau of Investigation for fiscal year ending June 30, 2027. Effective July 1, 2026.

Took effect 1 July 2026

SB 75: amend the type of entities eligible to participate in the cybersecurity services initiative.

Amends the cybersecurity services initiative to expand eligible entities to include nonprofit entities providing drinking water and sanitary sewer utilities, in addition to counties, utilities operated by political subdivisions, and municipalities.

Took effect 1 July 2026

HB 3112: Relating to the application of the open meetings law and public information law to government information related to certain cybersecurity measures.

Governmental bodies may conduct closed meetings to deliberate cybersecurity measures, policies, or contracts solely intended to protect critical infrastructure facilities in their jurisdiction. Governmental bodies must withhold from public disclosure information relating to cybersecurity measures for critical infrastructure, insurance coverage details, cybersecurity incident information, and network configurations that would facilitate unauthorized access.

HB 3512: Relating to artificial intelligence training programs for certain employees and officials of state agencies and local governments.

State agencies and local governments must annually identify employees and officials who use computers for at least 25 percent of required duties and require them to complete certified cybersecurity and artificial intelligence training programs. The Department of Information Resources must certify at least five artificial intelligence training programs annually.

Took effect 1 September 2025

HB 5331: Relating to the enforceability of certain state agency and local government contract language regarding required security incident notifications.

State agencies and local governments must not include contract language in cybersecurity insurance contracts or other contracts for goods or services that prohibits, restricts, or circumvents their compliance with Section 2054.603 of the Government Code. Any such contract language is void and unenforceable.

HB 150: Relating to the establishment of the Texas Cyber Command and the transfer to it of certain powers and duties of the Department of Information Resources.

The Texas Cyber Command must prevent and respond to cybersecurity incidents affecting governmental entities and critical infrastructure. State agencies must complete biennial information security assessments and penetration tests. Governmental entities must report cybersecurity incidents to the command within 48 hours of discovery. All information resources employees of state agencies must complete annual certified cybersecurity training.

Took effect 1 September 2025

HB 1334: Militia state active duty; cyber-related support.

The Governor or his designee may call forth the militia to state active duty for cyber-related support, including preparedness, response, and mitigation, to assist state or local agencies or private entities providing critical infrastructure as defined in § 44-146.28:2.

Took effect 1 July 2026

SB 5892: Concerning protection of the voter registration database.

County elections offices that receive requests for records from the statewide voter registration database must not produce records but shall direct requestors to the secretary of state by the deadline in RCW 42.56.520. State or local election officers and designees with database access must not knowingly use, disclose, or alter information inconsistent with their duties.

SB 5014: Concerning election security.

Each county auditor must implement by July 1, 2027 cybersecurity measures including adopting the .gov domain, partitioning election IT infrastructure from other county assets, isolating ballot counting equipment from all networks, and restricting data transfers using single-use erased devices. Manufacturers, distributors, and vendors must disclose security breaches to the secretary of state and attorney general immediately upon discovery.

HB 5638: Relating to the requirements of the state’s cyber security program and responsibilities and authority of the state chief information security officer

Each information custodian receiving centralized support from the West Virginia Office of Technology must undergo cyber risk assessments, adhere to cybersecurity standards established by the Chief Information Security Officer, manage plans of action and milestones, and participate in at least one annual cybersecurity program review before November 30 each year.