HB 2736 Arizona House · 57th Legislature - First Regular Session

cybersecurity; data encryption; pilot program

HB 2736 establishes a five-year pilot program requiring Arizona state agencies to implement and upgrade data encryption systems meeting strict security criteria. It directly affects the Secretary of State, Department of Revenue, Department of Administration, and the Legislature, each implementing the system in sequential fiscal years starting in 2026. The bill mandates that encryption systems must be U.S.-owned, quantum-proof, use U.S. patents, allow key resets without third-party access, and include detailed audit trails. The Department of Administration must report annually on progress and security, with a final evaluation due in 2031, and the program expires June 30, 2032.
Bill status passed 3 of 5 stages cleared
Introduction
Feb 2025
Committee Review
Feb 2025
House Passage
Mar 2025
Senate Passage
Governor
Introduced Feb 10, 2025 Last action Mar 24, 2025
Maddy AI version diff · 1 comparison

What changed between versions

Introduced Version House Engrossed Version · 6 edits · Mar 11, 2025
MODERATE
The bill was significantly rewritten to shift from a five-year pilot program run by the Department of Administration to a seven-year study run by the Department of Homeland Security. The new version replaces the mandate to immediately purchase and install encryption systems with a requirement to first conduct studies and prepare reports for legislative review. Additionally, the timeline for final reports and the repeal of the section was extended.
Scope change
The bill's scope changed from an immediate implementation of a data encryption system to a phased study and planning process. The responsible agency changed from the Department of Administration to the Department of Homeland Security.
TIMELINE

The program duration was extended from five years to seven years.

The repeal date was extended from June 30, 2032, to June 30, 2034.

The deadline for submitting the final effectiveness report was extended from fiscal year 2030-2031 to fiscal year 2031-2032.

ELIGIBILITY

The responsible agency changed from the Department of Administration to the Department of Homeland Security.

REQUIREMENT

The requirement to immediately implement and purchase a data encryption system was replaced with a requirement to conduct studies and prepare reports for legislative review.

TECHNICAL

The duration of the annual audit period was increased from five years to seven years.

Floor votes · House Mar 11, 2025

How they voted

3522
Passed · 3 other
Total votes 60
Mar 11, 2025
D Democratic27
4 Yea 22 Nay 1
81% Nay
R Republican33
31 Yea 2
93% Yea
Vote distribution
All Yea All Nay Mixed No data
Full legislative history

Actions timeline

Total actions
13
Key actions
6
Committee
1
Amendments
3
Mar 24, 2025
Upper · Passed
DPA
upper
Mar 11, 2025
Lower · Passed
PASSED
lower
Mar 10, 2025
Lower · Passed
DPA
lower
Mar 10, 2025
Lower · Passed
PASSED
lower
Mar 4, 2025
Lower · Passed
DPA
lower
Feb 19, 2025
Lower · Passed
DP
lower
1 primary · 15 co-sponsors

Sponsors