HB 42 Utah House · 2026 General Session

School Cybersecurity Amendments

HB 42 establishes minimum cybersecurity standards for Utah's public schools (local education agencies) and expands the Utah Cyber Center's role to provide dedicated security services to schools. It requires schools to implement specific measures like multi-factor authentication, patch management, and endpoint detection systems, while mandating incident reporting to the Cyber Center. The law also directs the State Board of Education to develop implementation guidelines and creates new reporting requirements for cybersecurity breaches in educational settings. These changes directly affect all Utah public schools and their cybersecurity practices, aiming to strengthen protection for student and school data. The bill contains no new funding and amends several existing Utah Code sections related to education and cybersecurity.

Issues: ✓ Education ✓ Technology

Bill status passed 4 of 5 stages cleared

Introduction

Jan 2026

Committee Review

Feb 2026

House Passage

Feb 2026

Senate Passage

Feb 2026

Governor

Introduced Jan 20, 2026 Last action Mar 7, 2026

Maddy AI version diff · 3 comparisons

What changed between versions

Substitute #2 → Substitute #3 · 3 edits

MINOR

The bill was updated to change the Senate sponsor from 'LONG TITLE' to a specific name, Ann Millner, and added a new coordination clause to ensure this cybersecurity bill works correctly with a separate school device revision bill. The substantive text of the cybersecurity standards, definitions, and reporting requirements remains unchanged.

Scope change

The bill now explicitly includes a coordination clause to align with S.B. 69, ensuring consistent implementation of device restrictions and cybersecurity rules across both bills.

REQUIREMENT

Added a new Section 8 requiring that if both bills pass, the device restriction rules in S.B. 69 will be updated to align with the terminology in this cybersecurity bill.

SCOPE

Updated the Senate Sponsor field from a generic placeholder to the specific name 'Ann Millner'.

TECHNICAL

Adjusted the effective date reference in the coordination clause from July 1, 2027, to July 1, 2026, to match the intended implementation timeline.

Introduced → Substitute #1 · 5 edits

MODERATE

The bill was revised to shift the responsibility for establishing cybersecurity standards from the Legislature directly to the State Board of Education, which must now create rules in collaboration with the Utah Education and Telehealth Network. The new version introduces a phased implementation timeline to allow schools time to prepare and clarifies the specific roles of the Cyber Center and UETN to prevent service duplication. While the core requirement for schools to report data breaches remains, the detailed list of specific technical controls (like multi-factor authentication) was removed from the statute to allow for more flexible, rule-based standards tailored to individual school district resources.

Scope change

The scope of the bill was narrowed regarding specific technical mandates; instead of listing exact requirements like 'multi-factor authentication' in the statute, the law now directs the State Board to define these standards via administrative rules, allowing for adjustments based on school size and resources.

REQUIREMENT

Specific technical mandates (e.g., multi-factor authentication, EDR) were removed from the statute and replaced with a directive for the State Board of Education to establish minimum cybersecurity standards through administrative rules.

TIMELINE

A phased implementation timeline was added, allowing the State Board to set compliance deadlines based on the size, capacity, and resources of individual school districts.

SCOPE

The State Board of Education is now explicitly tasked with developing implementation guidelines and providing technical assistance to LEAs, expanding its role beyond just setting policy.

DEFINITION

Definitions for 'AI glasses' and 'Emerging technology' were retained, but the detailed list of specific cybersecurity measures was removed from the text to be defined later by the State Board.

ENFORCEMENT

The bill now explicitly requires the State Board to establish a method to assess LEA compliance with the new cybersecurity standards.

Floor votes · House Feb 17, 2026

How they voted

This bill passed the Senate by voice vote (no roll call recorded).

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Feb 26, 2026

Upper · Passed

Senate/ committee report favorable [Senate Education Committee]

upper

Feb 26, 2026

Upper · Passed

Senate Comm - Favorable Recommendation [Senate Education Committee]

upper

Feb 23, 2026

Committee

Senate/ to standing committee [Senate Education Committee]

upper

Feb 20, 2026

Introduced

Senate/ 1st reading (Introduced)

upper

Feb 17, 2026

Upper · Passed

House/ passed 3rd reading

upper

Feb 6, 2026

Lower · Passed

House/ committee report favorable [House Law Enforcement and Criminal Justice Committee]

lower

Feb 5, 2026

Lower · Passed

House Comm - Favorable Recommendation [House Law Enforcement and Criminal Justice Committee]

lower

Feb 4, 2026

Committee

House/ to standing committee [House Law Enforcement and Criminal Justice Committee]

lower

Jan 20, 2026

Introduced

House/ 1st reading (Introduced)

lower

1 primary · 1 co-sponsor