statewide cybersecurity encryption system; requirements

HB 2809 requires Arizona state agencies to implement a statewide cybersecurity system using post-quantum encryption - which protects against future quantum computing threats - for all agencies handling sensitive data like personal information, election systems, public safety records, and infrastructure data. The bill mandates that the system must meet or exceed U.S. Department of Defense’s CMMC 2.0 standards, with all vendors required to be U.S.-based, have no foreign dependencies, and avoid foreign-owned technology. The Auditor General will independently manage encryption keys, conduct regular audits, and report noncompliance to the Governor and Legislature, with agencies facing corrective plans or IT budget restrictions for failing to adhere to requirements.