SB 123: Privacy and Cybersecurity Amendments - Utah

Substitute #1 → Substitute #2 · 6 edits

MODERATE

This bill updates the Utah Cyber Center's operations by extending the deadline for its strategic cybersecurity plan from June 2024 to January 2027, adding the Department of Environmental Quality as a required collaboration partner, and formally including local education agencies in the Center's duties. It also creates a new restricted funding account for the Center and designates this money as nonlapsing, ensuring funds are not lost if the state budget is not passed on time. Additionally, the bill restructures the Cybersecurity Commission to include a representative from the Utah Education and Telehealth Network.

Scope change

The bill expands the Utah Cyber Center's scope to explicitly include local education agencies and adds the Department of Environmental Quality as a mandatory collaboration partner. It also adds a repeal of Section 63A-16-214, which previously governed government cybersecurity duties.

TIMELINE

The deadline for developing the statewide strategic cybersecurity plan was moved from June 30, 2024, to January 1, 2027.

SCOPE

The Department of Environmental Quality is now explicitly listed as an entity the Cyber Center must collaborate with.

Local education agencies are now explicitly included in the Cyber Center's duties for threat mitigation and incident response.

FISCAL

A new 'Utah Cyber Center Restricted Account' was created, and funds from this account are designated as nonlapsing to prevent expiration if the budget is delayed.

REQUIREMENT

The Cybersecurity Commission membership was updated to include a representative from the Utah Education and Telehealth Network.

TECHNICAL

Section 63A-16-214, which previously outlined government cybersecurity duties, is repealed.

Amended 3/5/2026 19:03:676 → Substitute #1 · 5 edits

MODERATE

This bill updates Utah's cybersecurity framework by extending the deadline for the statewide strategic plan from 2024 to 2027, formally adding the Department of Environmental Quality as a collaboration partner, and expanding the Cyber Center's duties to explicitly include local education agencies. It also creates a new nonlapsing restricted account to fund these cybersecurity efforts and adjusts the composition of the Cybersecurity Commission.

Scope change

The bill expands the scope of the Utah Cyber Center's responsibilities to include local education agencies and adds the Department of Environmental Quality as a required collaboration partner.

TIMELINE

The deadline to develop the statewide strategic cybersecurity plan was extended from June 30, 2024, to January 1, 2027.

SCOPE

The Utah Cyber Center's duties now explicitly include providing cybersecurity services, incident response, and resilience planning for local education agencies.

The Department of Environmental Quality is added as a specific entity the Cyber Center must collaborate with.

FISCAL

A new 'Utah Cyber Center Restricted Account' is created within the General Fund to support cybersecurity activities, and appropriations from this account are designated as nonlapsing.

REQUIREMENT

The composition of the Cybersecurity Commission was adjusted to ensure a representative from the Utah Education and Telehealth Network is included.

Amended Excerpts 3/5/2026 19:03:676 → Amended 3/5/2026 19:03:676 · 6 edits

MODERATE

This bill updates the Utah Cyber Center's role to include local education agencies and the Department of Environmental Quality as partners. It extends the deadline for creating a statewide cybersecurity plan from June 2024 to January 2027 and adds specific duties for handling threats in schools. The changes aim to broaden cybersecurity protection across more sectors of the state government and education system.

Scope change

The bill expands the Utah Cyber Center's scope to include local education agencies and the Department of Environmental Quality as entities it must collaborate with, in addition to existing executive branch agencies.

SCOPE

Added the Department of Environmental Quality and local education agencies as entities the Utah Cyber Center must collaborate with.

TIMELINE

Extended the deadline for developing the statewide strategic cybersecurity plan from June 30, 2024, to January 1, 2027.

REQUIREMENT

Added specific duties for the Cyber Center to identify, analyze, and mitigate cyber threats specifically for local education agencies.

Added a duty to promote cybersecurity standards for local education agencies aligned with the Center for Internet Security.

Added a duty to coordinate cybersecurity incident response for data breaches affecting local education agencies.

DEFINITION

Added a specific definition for 'local education agency' referencing Section 53E-1-102.

Enrolled → Amended Excerpts 3/5/2026 19:03:676 · 4 edits

MODERATE

This amendment updates the Utah Cyber Center's duties to include local education agencies and aligns cybersecurity standards with the Center for Internet Security. It also adjusts the deadline for the statewide cybersecurity plan from June 30, 2024, to January 1, 2027, and ensures the Cyber Center is listed as a nonlapsing appropriation account.

Scope change

The bill's scope was expanded to explicitly include local education agencies alongside executive branch agencies for cybersecurity coordination and assistance.

TIMELINE

The deadline to develop the statewide strategic cybersecurity plan was extended from June 30, 2024, to January 1, 2027.

SCOPE

Local education agencies were added to the list of entities the Cyber Center must assist and coordinate with regarding cyber threats and data breaches.

REQUIREMENT

Cybersecurity standards and best practices are now required to be developed in alignment with controls published by the Center for Internet Security.

FISCAL

The Utah Cyber Center Restricted Account was added to the list of accounts containing nonlapsing appropriations, ensuring funds do not expire at the end of the fiscal year.

Introduced → Enrolled · 6 edits · Mar 17, 2026

MODERATE

This bill updates the Utah Cyber Center's operations by extending the deadline for its strategic cybersecurity plan from June 2024 to January 2027 and adding the Department of Environmental Quality as a required collaboration partner. It also expands the Cybersecurity Commission to include a representative from the Utah Education and Telehealth Network and creates a new restricted funding account to support cybersecurity initiatives. Additionally, the bill clarifies that the Cyber Center must align its best practices with the Center for Internet Security standards.

Scope change

The bill expands the scope of the Utah Cyber Center's duties to explicitly include local education agencies and broadens the Cybersecurity Commission's membership to better represent the education and telehealth sectors.

TIMELINE

The deadline to develop the statewide strategic cybersecurity plan was moved from June 30, 2024, to January 1, 2027.

SCOPE

The Utah Cyber Center is now required to collaborate with the Department of Environmental Quality.

The Cyber Center's duties were expanded to include local education agencies for threat mitigation, incident response, and resilience planning.

FISCAL

A new 'Utah Cyber Center Restricted Account' was created within the General Fund to finance cybersecurity tools, training, and assessments.

REQUIREMENT

The Cybersecurity Commission was modified to include a representative from the Utah Education and Telehealth Network.

The Cyber Center is now required to promote cybersecurity standards in alignment with the Center for Internet Security.

Privacy and Cybersecurity Amendments

What changed between versions

How they voted

Actions timeline

Sponsors