An act relating to the creation of the Cybersecurity Advisory Council

Council membership changed: the passed version included one House member (appointed by the Speaker) and one Senate member (appointed by the Committee on Committees); the enacted version removed both legislative seats, reducing the Council from 13 to 11 members.

Appointment authorities for four Council seats changed: the passed version had the Governor appoint representatives from electrical utilities, municipal water systems, hospitals/accountable care organizations, and essential supply chain businesses; the enacted version returned these appointments to the Commissioner of Public Service, Secretary of Natural Resources, President of the Vermont Association of Hospitals and Health Systems, and Chair of the Vermont Business Roundtable respectively.

The passed version included a new Section 4663 requiring the Council to review and approve cybersecurity standards for critical infrastructure domains beginning July 1, 2024 and biennially thereafter, with eight specific standard categories and requirements that the Public Utility Commission and Green Mountain Care Board develop their own sector-specific standards. This entire section was removed in the enacted version.

The enacted version adds a Council duty to advise on opportunities to access cyber-insurance, including increasing availability and affordability for critical industries (sub-item H). This advisory role was not in the passed version.

The passed version gave the Council an explicit duty to 'review and approve the State's cybersecurity standards for critical infrastructure domains.' The enacted version replaced this with a softer duty to 'conduct an inventory and review of cybersecurity standards and protocols' and make recommendations on whether improvements are necessary.

The passed version included a repeal provision sunsetting the entire Cybersecurity chapter on June 30, 2026. The enacted version contains no sunset or repeal date.

The enacted version adds a definition of 'essential supply chain' (Section 4661(3)) covering medical supplies, infrastructure maintenance articles, disaster reconstruction materials, food systems, and thermal systems/fuels. This definition was absent from the passed version.

The definition of 'critical infrastructure' in 11 V.S.A. Section 1701 was modified: the enacted version adds 'thermal fuels and systems' to the list, while the passed version omitted that phrase.

The hospital seat was narrowed in the enacted version: the passed version allowed a representative from 'a Vermont hospital or accountable care organization,' while the enacted version limits it to 'a representative from a Vermont hospital.'

The enacted version includes a separate Section 3 requiring the Council to submit a report to legislative committees by January 15, 2024. The passed version folded reporting into the Council's ongoing annual reporting duty without this specific early deadline.

Entire Section 4663 (Cybersecurity Standards for Critical Infrastructure) was deleted. This removed the requirement that the Council biennially review and approve cybersecurity standards for critical infrastructure domains starting July 1, 2024, including specific standards on security controls, incident response plans, training, and compliance.

A new duty was added requiring the Council to advise on access to cyber-insurance, including how to increase availability and affordability for critical industries.

A new Section 3 requires the Council to include in its January 15, 2024 report recommendations on whether to amend the 'essential supply chain' definition to include additional supply chains.

The annual report description was changed from reporting 'on information acquired pursuant to activities required under subsection (c)' to providing 'a status update on the work of the Council.'

Two legislative members (one House member appointed by the Speaker and one Senate member appointed by the Committee on Committees) were removed from Council membership, along with the compensation provision for legislators attending meetings during adjournment.

The Council's advisory purpose was expanded from 'infrastructure, standards, and safeguards' to include 'best practices, communications protocols, standards, training, and safeguards.'

Appointment authority shifted from the Governor to sector-specific bodies: the electrical utility representative is now appointed by the Commissioner of Public Service (and broadened from 'State electrical public utility' to 'distribution or transmission utility'), the water system representative by the Secretary of Natural Resources, the hospital representative by the President of the Vermont Association of Hospitals and Health Systems (and narrowed to exclude accountable care organizations), and the business representative by the Chair of the Vermont Business Roundtable.

A new definition of 'essential supply chain' was added, covering medical supplies and PPE, articles essential to critical infrastructure operation, disaster construction materials, food systems (including livestock feed), and thermal systems and fuels.

A new permanent public records exemption (Section 4662(h)) was added: any Council records regarding cybersecurity standards, protocols, and incident responses that would jeopardize public safety if disclosed are exempt from the Public Records Act and explicitly 'shall not be reviewed for repeal.'

A new executive session provision (Section 4662(f)(3)) was added, authorizing closed sessions to consider testimony about cybersecurity incidents or discussions of standards where public disclosure would jeopardize public safety.

The sunset/repeal date for Chapter 208 was extended from June 30, 2026 to June 30, 2028, giving the Council two additional years of operation.

Removed legislative tracking header including sponsor names (Reps. Sibilia and Chase), committee referral line, subject line, and statement of purpose - standard when moving from unofficial to official format

Page headers changed from 'AS PASSED BY HOUSE' to 'BILL AS PASSED BY HOUSE' throughout the document

Removed internal tracking footer 'VT LEG #369032 v.1' from all pages

A duplicated effective date provision appears at the end of the official version: 'Sec. 3. EFFECTIVE DATE' is inserted before the repeal section, creating a numbering conflict where both the new effective date and the repeal are labeled Sec. 3, followed by Sec. 4 which is also an effective date - this appears to be a clerical drafting error with no substantive policy impact

A new Section 3 was added that repeals 20 V.S.A. chapter 208 (Cybersecurity) in its entirety on June 30, 2026, giving the entire framework a three-year sunset.

A 13th Council member was added: the President of Vermont Information Technology Leaders or designee, expanding the Council beyond government and utility representatives to include a private-sector IT leadership voice.

A new subsection (h) on compensation and reimbursement was added. Legislative members receive per diem pay from General Assembly appropriations under 2 V.S.A. section 23, while other unpaid members receive per diem pay from Agency of Digital Services appropriations under 32 V.S.A. section 1010.

The effective date provision was renumbered from Section 3 to Section 4 to accommodate the new repeal section.

A reference in subsection (b)(2) of section 4663 was corrected from 'Green Mountain Board' to 'Green Mountain Care Board.'