Relating to the enforceability of certain state agency and local government contract language regarding required security incident notifications.

HB 5331 clarifies that contracts between state agencies or local governments and vendors (such as cybersecurity insurers) cannot include terms that prevent compliance with mandatory security incident notification requirements. Specifically, it makes void and unenforceable any contract language prohibiting or restricting government entities from reporting security incidents as required by law. This bill directly affects state and local government agencies that enter into contracts for goods, services, or cybersecurity insurance. It does not change existing notification requirements but ensures contract terms cannot bypass these legal obligations. The law took effect immediately upon the governor's signature on June 20, 2025.