SB 1037, known as the DIGITAL NC Act, creates a new nine-member Board of Governors to oversee North Carolina's state information technology enterprise. This board will develop a comprehensive twenty-year plan to modernize the state's IT infrastructure, consolidate technical staff, and enhance cybersecurity defenses. The bill designates the Board's members through appointments by the Governor, House Speaker, and Senate President Pro Tempore, requiring specific expertise in technology leadership, cybersecurity, and digital transformation. The resulting plan will recommend significant changes, such as transitioning the state to a 'cloud-first' approach and potentially reorganizing the Department of Information Technology into a new Digital Sovereignty Authority.
HB 215 requires the Charlotte Firefighters' Retirement System to maintain data breach and cyber liability insurance specifically covering participants and beneficiaries. It mandates that annual reports to the City Council include details about any data breaches affecting the system, including incident costs and response steps. The bill directly affects current and future firefighters who participate in the retirement system by adding transparency and financial safeguards for their personal data. These provisions update existing system rules to address modern cybersecurity risks without changing benefit calculations or eligibility.
SB 562 establishes a 21-member commission to study how quantum computing might threaten North Carolina's current cybersecurity systems, including state government IT, critical infrastructure, and smart city/IoT networks that rely on older encryption methods. The commission will assess vulnerabilities, research quantum-resistant security solutions, and develop recommendations for upgrading systems, with a final report due by July 2026. The bill appropriates $250,000 from the state general fund to cover the commission's work, including research and stakeholder meetings. This study directly affects state systems and infrastructure security planning, not individual citizens or private businesses.
SB 667, the Government Modernization Act of 2025, requires North Carolina state agencies to upgrade outdated computer systems, enhance cybersecurity protections, and expand online public services. It mandates agencies to conduct IT assessments, implement multi-factor authentication and encryption, and create mobile-friendly portals for licenses, taxes, and business filings. The bill also directs a study on using blockchain technology to secure records, verify licenses, and improve procurement transparency. These changes aim to improve efficiency and accessibility for residents and businesses while reducing bureaucratic delays, with implementation beginning July 1, 2025.
HB 723 establishes the North Carolina Technology Coalitions Strategic Support Fund, allocating $10.5 million to support regional technology coalitions focused on sectors like AI, semiconductors, and cybersecurity. The fund provides grants to eligible organizations (including nonprofits, local governments, and academic institutions) operating within North Carolina to strengthen regional economic growth through coalition collaboration. Key provisions include funding for workforce training, market analysis, and matching funds to leverage private or federal investment, while requiring grantees to maintain operations in-state and avoid duplicate funding. The fund becomes effective July 1, 2025, with administration managed by the Department of Commerce’s Office of Science, Technology, and Innovation.
SB 269 revises North Carolina's Insurance Guaranty Association Act to specifically include cybersecurity insurance coverage under the law. It defines "cybersecurity insurance" to cover losses from data breaches, ransomware, cyberattacks, and similar events, and sets a $500,000 cap per policy for all first- and third-party claims arising from a single cyber incident. This affects North Carolina residents or property located in the state who hold cybersecurity insurance policies with an insolvent insurer. The bill ensures the Guaranty Association pays covered claims up to this cap for cybersecurity events, while excluding punitive damages, high-net-worth claimants ($50M+ net worth), and certain other excluded claims.
HB 808, the NC Infrastructure Protection Act, prohibits North Carolina government entities from contracting with companies owned by citizens of China, Iran, North Korea, Russia, or countries later designated as threats. It specifically blocks foreign-owned companies from gaining access to critical infrastructure like electric grids, water treatment facilities, and cybersecurity systems. The bill also mandates criminal background checks for all individuals granted access to these systems, applying to government contracts and public utility operations. These requirements will take effect for new contracts after the bill’s passage, with background check rules for utilities needing to be implemented by October 2026.
