LawSignals

Legislative intelligence for lawyers

Cybersecurity Legislation Tracker

September 2025

Data breach duties, critical infrastructure security, and public sector cyber resilience.

This month in numbers

MeasureBills
Matched to this Tracker148
New this month2
Moved a stage1
Passed a chamber0
Enacted0
Vetoed0

Where it happened

StateBills that moved
MA1

The month in brief

September 2025 was a quiet month for cybersecurity legislation, with only one bill advancing among the 148 tracked. All movement occurred in Massachusetts, where a cyberattack response bill cleared its policy committee and moved to fiscal review. No bills passed a chamber or reached the governor's desk.

What moved this month

Reported out of committee

StateBillTitleCurrent statusAction
MAH 82An Act relative to cyberattack response in Massachusetts
Companion: MA HD 1316
Passed committee17 September 2025
Addresses state response to cyberattacks. Reported favorably and referred to fiscal committee.

New and notable

StateBillTitleCurrent status
MDSB 25Income Tax - Cybersecurity Technology and Service Tax Credit - Alterations
Companion: MD HB 290
Passed chamber
OHHB 475Regards municipal cybersecurity, private cybersecurity contractsIn committee

Regulatory Watch

Open for comment

TypeDocumentDate
Proposed RuleCritical Infrastructure Protection Reliability Standard CIP-003-11-Cyber Security-Security Management Controls
Energy Department, Federal Energy Regulatory Commission
Proposed reliability standard for cyber security management controls on critical infrastructure.
Comments close 24 November 2025

Taking effect

TypeDocumentDate
RuleDefense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041)
Defense Department, Defense Acquisition Regulations System
Final rule implementing cybersecurity maturity model certification requirements for defense contractors and industrial base.
Effective 10 November 2025

Watchlist for next month

StateBillTitleCurrent status
MAH 82An Act relative to cyberattack response in Massachusetts
Companion: MA HD 1316
Passed committee

Every matched bill

StateBillTitleCurrent statusLast action
AKSB 139An Act relating to who may own or hold certain land; relating to certain agreements having to do with critical infrastructure; and providing for an effective date.In committee14 April 2025
AZHB 2736 †cybersecurity; data encryption; pilot programDead24 March 2025
AZHB 2809statewide cybersecurity encryption system; requirementsPassed chamber17 March 2026
CAAB 2281 †Office of Elections Cybersecurity.Passed chamber4 August 2026
CAAB 869State agencies: information security: Zero Trust architecture.Passed chamber29 August 2025
CTHB 5210 †AN ACT ESTABLISHING VARIOUS DATA SECURITY REQUIREMENTS APPLICABLE TO CERTAIN FINANCIAL INSTITUTIONS.Passed committee24 March 2026
CTSB 117 †AN ACT CONCERNING BREACHES OF SECURITY INVOLVING ELECTRONIC PERSONAL INFORMATION.Passed chamber30 April 2026
CTSB 1319 †AN ACT ESTABLISHING A CYBERSECURITY TASK FORCE.
Companion: CT SB 273
Passed committee1 April 2025
CTSB 403 †AN ACT CONCERNING CYBERSECURITY.In committee5 March 2026
DEHB 381 †AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO COMPUTER SECURITY BREACHES.Passed chamber25 June 2026
FLHB 1081Cybersecurity Experiential LearningSigned26 June 2026
FLHB 1085Local Government Cyber SecuritySigned26 May 2026
FLHB 1183Cybersecurity Incident LiabilityDead16 June 2025
FLHB 635Cybersecurity Standards and Liability
Companion: FL SB 692
Dead13 March 2026
FLHB 7023OGSR/CybersecurityPassed committee9 March 2026
FLHB 925Threats from Foreign NationsDead16 June 2025
FLSB 1216Cybersecurity of Mortgage Brokers and Lenders and Money Services BusinessesDead16 June 2025
FLSB 1576Cybersecurity Incident LiabilityDead16 June 2025
FLSB 7020OGSR/Agency Cybersecurity Information
Companion: FL SPB 7020
Signed20 May 2025
IAHF 2452A bill for an act establishing the data security program within the department of education, and making appropriations.In committee16 February 2026
IDH 168CYBERSECURITY AND RESILIENCY FUND – Adds to existing law to establish a cybersecurity and resiliency fund to address the state’s need for information technology and cybersecurity infrastructure.
Companion: ID H 421
Introduced10 February 2025
ILHB 1891SCH CD-COMPUTER SCIENCE REQIn committee21 March 2025
ILHB 3576WATER UTILITY CYBERSECURITYIn committee27 March 2026
ILHB 4528ELEC CD-CYBERSECURITY
Companion: IL SB 3058
In committee27 March 2026
ILHB 4966 †DCFS-SECURE ACTEnacted10 July 2026
ILHB 5206IEMA-OHS-SWICPassed chamber10 April 2026
INSB 459 †Environmental matters.Enacted1 May 2025
INSB 472 †Cybersecurity.Enacted1 May 2025
KYHB 280AN ACT relating to information technology systems and declaring an emergency.In committee4 March 2025
MAH 3363 †An Act relative to cyber procurement projectsIn committee12 March 2026
MAH 4528 †Order relative to extending until Wednesday, November 12, 2025 the time within which the committee on Advanced Information Technology, the Internet, and Cybersecurity is authorized to report on current House documentsIn committee30 July 2025
MAH 4592 †Order relative to extending until Friday, November 14, 2025 the time within which the committee on Advanced Information Technology, the Internet and Cybersecurity is authorized to report on current House documentsIn committee8 October 2025
MAH 82An Act relative to cyberattack response in Massachusetts
Companion: MA HD 1316
Passed committee17 September 2025
MAS 2634 †Order relative to authorizing the joint committee on Advanced Information Technology, the Internet and Cybersecurity to make an investigation and study of certain current Senate documents relative to advanced information technology, the internet and cybersecurity mattersPassed committee23 October 2025
MAS 42 †An Act protecting against cyber ransom
Companion: MA SD 2020
In committee9 October 2025
MAS 49An Act relative to cybersecurity and artificial intelligence
Companion: MA SD 873
Passed committee12 May 2025
MDHB 1309Cybersecurity – Standards, Compliance, and Audits – Alterations
Companion: MD SB 907
In committee8 March 2025
MDHB 1321Income Tax - Credit for Cybersecurity Measures Undertaken by Small BusinessesIn committee7 February 2025
MDHB 209State Finance and Procurement - Local Cybersecurity Preparedness and Response Plan and Assessment - RepealSigned22 April 2025
MDHB 235State Government - Information Technology - Cybersecurity RevisionsSigned22 April 2025
MDHB 333Healthcare Ecosystem Stakeholder Cybersecurity WorkgroupVetoed16 May 2025
MDHB 444Criminal Law – Interference With Critical Infrastructure or a Public Safety Answering Point – PenaltiesIn committee17 January 2025
MDHB 593Criminal Law - Interference With Critical Infrastructure or a Public Safety Answering PointSigned12 May 2026
MDHB 957Cybersecurity - Standards and Compliance - Alterations
Companion: MD SB 601
Signed14 April 2026
MDSB 153Senate Education, Energy, and the Environment Committee and House Environment and Transportation Committee - Code References - RevisionsPassed chamber20 March 2025
MDSB 244State Government - Information Technology - Cybersecurity RevisionsSigned22 April 2025
MDSB 25Income Tax - Cybersecurity Technology and Service Tax Credit - Alterations
Companion: MD HB 290
Passed chamber16 March 2026
MDSB 294Maryland Cybersecurity Council - AlterationsSigned20 May 2025
MDSB 482Criminal Law - Interference With Critical Infrastructure or a Public Safety Answering PointSigned12 May 2026
MDSB 691Healthcare Ecosystem Stakeholder Cybersecurity WorkgroupVetoed16 May 2025
MDSB 871Department of the Environment - Community Water and Sewerage Systems - Cybersecurity Planning and Assessments
Companion: MD HB 1062
Signed13 May 2025
MELD 2092An Act To Update Certain Terms And References Regarding Information Technology And CybersecuritySigned15 April 2026
MELD 2103An Act Requiring Hospitals To Adopt Cybersecurity PlansSigned13 April 2026
MIHB 5247Civil rights: public records; limited access to public records; provide for incarcerated individuals. Amends secs. 1, 2, 3 & 5 of 1976 PA 442 (MCL 15.231 et seq.).In committee13 November 2025
MIHB 5848Energy: other; cyber-physical security and operational technology protections for battery energy storage systems; provide for. Amends 2008 PA 295 (MCL 460.1001 - 460.1232) by adding sec. 112.In committee23 April 2026
MIHB 5849Businesses: other; cyber-physical security and operational technology protections for data centers; provide for. Creates new act.In committee23 April 2026
MIHB 5850Water supply: systems; cyber-physical security and operational technology protections for public water systems; provide for. Amends sec. 21 of 1976 PA 399 (MCL 325.1021) & adds sec. 8a.In committee23 April 2026
MIHB 6011Businesses: other; cybersecurity requirements for large-scale solar energy facilities; provide for. Amends 2008 PA 295 (MCL 460.1001 - 460.1232) by adding sec. 112a.In committee2 June 2026
MISB 980Consumer protection: other; cryptocurrency kiosks; prohibit the installation and operation of. Creates new act.In committee19 May 2026
MNHF 2610 †Cybersecurity permitted to be offered as an applied doctoral degree.In committee20 March 2025
MNHF 2630 †Crime of unauthorized computer access expanded to include accessing a computer without penetrating security system.In committee24 March 2025
MNHF 3860 †Cybersecurity legislative commission extended.
Companion: MN SF 3863
Passed chamber11 May 2026
MNSF 19 †Requirements governing data centers modificationsIntroduced9 June 2025
MNSF 2753 †Cybersecurity offering as an applied doctoral degree authorization provisionIn committee1 April 2025
MNSF 379 †State-funded county and city cybersecurity grant program establishmentIn committee20 March 2025
MNSF 4891School security systems requirement as a part of the State Fire CodeIn committee26 March 2026
MNSF 703 †Crime of unauthorized computer access expansion to include accessing a computer without penetrating a security systemIn committee27 January 2025
MSSB 2096 †MDITS and SOS; require to establish minimum cybersecurity standards for SEMS.Signed19 March 2026
MSSB 2471Cyber breach; limit liability for certain entities.Passed chamber4 March 2025
MTLC 3623 †Interim study on Montana home and cyber-security insuranceDead23 May 2025
NELB 1054 †Appropriate funds to the State Department of Education for grants for cybersecurity products and servicesDead17 April 2026
NELB 241Provide immunity from liability for cybersecurity eventsSigned17 March 2025
NELB 599Require the State Board of Education to adopt a policy relating to cybersecurityDead17 April 2026
NHHB 1728 †requiring sufficient cybersecurity protections for critical infrastructure and technology projects.Dead5 March 2026
NJA 1297Requires instruction on cybersecurity in grades nine through 12; requires Office of Secretary of Higher Education to develop cybersecurity model curricula; establishes loan redemption programs for individuals in certain cybersecurity occupations.In committee13 January 2026
NJA 1549Establishes Gaming Cybersecurity Intelligence and Response Council.In committee13 January 2026
NJA 1912Requires certain State employees to receive training in cybersecurity best practices.In committee19 September 2024
NJA 1928Requires State, county, and municipal employees and certain State contractors to complete cybersecurity awareness training.
Companion: NJ S 1511
In committee13 January 2026
NJA 2024Requires each government entity in this State to conduct review of cybersecurity infrastructure and make recommendations.
Companion: NJ S 3137
In committee13 January 2026
NJA 2199Requires businesses in financial, essential infrastructure, and health care industries to report cybersecurity incidents.In committee9 January 2024
NJA 2424Requires State, county, and municipal employees and certain State contractors to complete cybersecurity awareness training.
Companion: NJ S 4742
In committee9 January 2024
NJA 3231Requires businesses in financial, essential infrastructure, and health care industries to report cybersecurity incidents.In committee13 January 2026
NJA 3283Requires businesses in financial, essential infrastructure, and health care industries to develop cybersecurity plans.
Companion: NJ S 1262
In committee13 January 2026
NJA 3959Establishes Office of Cybersecurity Infrastructure.In committee13 January 2026
NJA 711Requires public institution of higher education to establish plans concerning cyber security and prevention of cyber attacks.In committee13 January 2026
NJA 843Increases penalty for "bombing" online meeting or teleconference under certain circumstances.In committee13 January 2026
NJS 1225Requires New Jersey Cybersecurity and Communications Integration Cell to study cybersecurity infastructure and establish cybersecurity guidelines.In committee13 January 2026
NJS 321Prohibits government entities from procuring and using technology products and services from companies owned by, controlled by, or domiciled in certain foreign countries.In committee13 January 2026
NJS 3222Requires instruction on cybersecurity in grades nine through 12; requires Office of Secretary of Higher Education to develop cybersecurity model curricula; establishes loan redemption programs for individuals in certain cybersecurity occupations.
Companion: NJ A 2999
Passed committee17 March 2025
NJS 3313Requires certain procedures and training for municipalities, counties, and school districts in response to cybersecurity incidents.*In committee30 January 2025
NJS 3557Requires certain State employees to receive training in cybersecurity best practices.In committee19 February 2026
NJS 3635Establishes "New Jersey Cybersecurity Grant Program"; appropriates $5 million from General Fund.In committee24 February 2026
NJS 3880Requires instruction on cybersecurity in grades nine through 12; requires Office of Secretary of Higher Education to develop cybersecurity model curricula; establishes loan redemption programs for individuals in certain cybersecurity occupations.In committee12 March 2026
NJS 728Prohibits government entities from procuring and using technology products and services from companies owned by, controlled by, or domiciled in certain foreign countries.In committee9 January 2024
NMSB 254CYBERSECURITY ACT & OFFICE CHANGESPassed chamber3 June 2025
NYA 1157 †Imposes a five-day time limit during which to disclose a breach in the security of a systemIn committee7 January 2026
NYA 1239 †Requires policies covering losses or damages from cyberattacks to include a requirement that the insured notify a law enforcement agencyIn committee7 January 2026
NYA 426Relates to procurement requirements for end point device security
Companion: NY S 2671
Signed14 February 2025
NYA 4746Relates to creating a cyber security enhancement fund and restricting the use of taxpayer moneys in paying ransoms
Companion: NY S 193
In committee7 January 2026
NYA 4987Enacts the New York veteran digital navigator program actIn committee7 January 2026
NYA 6301Enacts the Critical Infrastructure Standards and Procedures ActIn committee10 February 2026
NYA 7719Establishes a commission to study cyber security in the state
Companion: NY S 3344
In committee7 January 2026
NYJ 1865Memorializing Governor Kathy Hochul to proclaim October 2026, as Cyber Security Awareness Month in the State of New YorkPassed chamber21 April 2026
NYS 10635Relates to the use of smart access systems and the information that may be gathered from such systemsPassed chamber4 June 2026
NYS 1961Establishes the "secure our data act"
Companion: NY A 5739
Passed chamber25 February 2026
NYS 3258 †Requires the department of education to provide annual notifications to school districts to combat cyber crimeIn committee7 January 2026
NYS 5479 †Relates to unauthorized use of a mobile telephone or any data contained thereinIn committee7 January 2026
NYS 7672Relates to municipal cybersecurity incidents or ransomware attacks
Companion: NY A 6769
Signed26 June 2025
NYS 8169Requires all state entities to notify affected individuals in the event of a data breach where information is compromised
Companion: NY A 8614
Passed chamber1 June 2026
OHHB 283Require political subdivisions to adopt a cybersecurity program
Companion: OH SB 203
In committee21 May 2025
OHHB 475Regards municipal cybersecurity, private cybersecurity contractsIn committee1 October 2025
OKHB 1799 †Cybersecurity; Cybersecurity Act of 2025; effective date.
Companion: OK HB 1800, OK HB 1801, OK HB 1802
In committee4 February 2025
OKHB 1799 †Cybersecurity; Cybersecurity Act of 2025; effective date.
Companion: OK HB 1800, OK HB 1801, OK HB 1802
In committee4 February 2025
OKHB 4132Technology; liability protections; counties; municipalities; cybersecurity frameworks; State Auditor and Inspector; effective date.Passed chamber1 April 2026
OKSB 525Elections; requiring county election board to provide certain training to county law enforcement. Effective date.In committee4 February 2025
OKSB 525Elections; requiring county election board to provide certain training to county law enforcement. Effective date.In committee4 February 2025
ORHB 3238 †Relating to cybersecurity.
Companion: OR HB 3822
In committee28 June 2025
ORHB 4055Relating to information security; declaring an emergency.In committee7 March 2026
PAHB 2672 †An Act amending the act of April 9, 1929 (P.L.177, No.175), known as The Administrative Code of 1929, in organization of departmental administrative boards and commissions and of advisory boards and commissions, providing for Cybersecurity Coordination Board.In committee26 June 2026
PAHR 583 †A Resolution urging the Congress of the United States to pass H.R. 7658 and S. 3949, the Enhanced Cybersecurity for SNAP Act of 2026, or create and enact other legislation to require the implementation of stronger security measures to protect Supplemental Nutrition Assistance Program benefits.In committee30 June 2026
PASB 376An Act amending Title 71 (State Government) of the Pennsylvania Consolidated Statutes, providing for the prohibition of unauthorized applications.Passed chamber5 June 2025
PASB 415An Act amending Title 18 (Crimes and Offenses) of the Pennsylvania Consolidated Statutes, in computer offenses, providing for the offense of ransomware; and imposing duties on the Office of Administration.In committee10 March 2025
RIHB 5111AN ACT RELATING TO EDUCATION -- CURRICULUMDead22 April 2025
RIHB 5997AN ACT RELATING TO STATE AFFAIRS AND GOVERNMENT -- INSPECTOR GENERALDead9 April 2025
RIHB 7509AN ACT RELATING TO CRIMINAL OFFENSES -- IDENTITY THEFT PROTECTION ACT OF 2015Dead10 March 2026
RIHB 7590AN ACT RELATING TO STATE AFFAIRS AND GOVERNMENT -- INSPECTOR GENERAL
Companion: RI SB 2375
Dead29 April 2026
RISB 2341AN ACT RELATING TO ELECTIONS -- MAIL BALLOTSSigned31 March 2026
SCH 3201Computer Science Education Initiative ActPassed chamber10 April 2025
SCH 3369Government electronic devices
Companion: SC H 3375
In committee8 April 2025
TNHB 1033Civil Procedure - As introduced, creates an affirmative defense that may be utilized by a covered entity that is the subject of a data breach, if the covered entity’s cybersecurity program meets certain criteria at the time the breach occurs. - Amends TCA Title 20; Title 29 and Title 47, Chapter 18.
Companion: TN SB 1421
In committee11 February 2025
TNHB 2312 †Criminal Offenses - As introduced, clarifies that the criminal offense of knowingly accessing a communication or computer system for the purpose of fraud or theft includes accessing a cloud computing service. - Amends TCA Title 4; Title 10; Title 35; Title 37; Title 38; Title 39; Title 40; Title 45; Title 47; Title 65; Title 66; Title 67 and Title 71.
Companion: TN SB 2523
Introduced5 February 2026
TXHB 1172Relating to requiring the Department of Information Resources to conduct a study concerning the cybersecurity of small businesses.In committee7 March 2025
TXHB 150Relating to the establishment of the Texas Cyber Command and the transfer to it of certain powers and duties of the Department of Information Resources.Enacted2 June 2025
TXHB 2044Relating to certain offenses and conduct subject to expulsion that are associated with possessing, carrying, exhibiting, or using a firearm on or within 1,000 feet of school property.In committee14 March 2025
TXHB 3112Relating to the application of the open meetings law and public information law to government information related to certain cybersecurity measures.Enacted20 June 2025
TXHB 4231Relating to cybersecurity for retail public utilities that provide water or sewer service.
Companion: TX SB 1034
In committee31 March 2025
TXSB 1063Relating to prohibiting contracts or other agreements with foreign-owned companies in connection with agricultural land.In committee24 February 2025
TXSB 1686Relating to requiring the cybersecurity council to conduct a study concerning the cybersecurity of school districts.In committee11 March 2025
TXSB 2176Relating to the establishment of the Texas Cyber Command as a component institution of The University of Texas System and the transfer to it of certain powers and duties of the Department of Information Resources.In committee24 March 2025
TXSB 2404Relating to the continuation and functions of the Department of Information Resources, including the composition of the governing body of the department.In committee25 March 2025
TXSB 2610Relating to a limitation on civil liability of business entities in connection with a breach of system security.Enacted20 June 2025
USS. 1337 †Cybersecurity Information Sharing Extension ActIn committee8 April 2025
UTHB 42School Cybersecurity AmendmentsPassed chamber7 March 2026
VAHB 2299Computer trespass; Class 6 felony when committed against elementary and secondary schools, etc.In committee4 February 2025
VTH 630 †An act relating to adopting minimum security standards for connected devicesIntroduced9 January 2026
WASB 5014Concerning election security.Enacted17 May 2025
WASB 6231Removing a tax exemption for the replacement of equipment for data centers.Enacted1 April 2026
WVHB 5638 †Relating to the requirements of the state’s cyber security program and responsibilities and authority of the state chief information security officerEnacted29 June 2026

Source: Open States. Statuses show where each bill stood on 18 August 2026, when this issue was generated, rather than at the end of the period.

Tracker definitions are model-drafted and validated by retrieval measurement. They are not a lawyer's definition of a practice area.

The summary and the one-line notes under each bill were written by us.anthropic.claude-opus-4-5-20251101-v1:0 from the data in this issue. Every figure, bill and date is from the record; the sentences around them are not legal advice.

 † Matched on the bill's title alone, because the platform does not yet hold that bill's full text. Every other bill is matched on its whole document.

Published by LawSignals. Cybersecurity Legislation Tracker is issued monthly. lawsignals.com/cybersecurity