• Home
• 2024 General Session
• H.B. 239

H.B. 239 State Employee Cybersecurity Training Requirements

• Bill Text
• Status
• Hearings/Debate

Bill Sponsor: Rep. Albrecht, Carl R.

Floor Sponsor: Sen. Vickers, Evan J.

• Drafting Attorney: Scott Elder
• Fiscal Analyst: Heidi Jo Tak

---

• Bill Text
  • Introduced
  • Amended
    • Amended Pages Only
  • Enrolled

---

• Related Documents
  • Fiscal Note
  • House Transmittal Letter 1
  • Senate Transmittal Letter 1
  • House Committee Amendment 1(passed)
  • House Floor Amendment 2

---

• Information
  • Last Action: 21 Mar 2024, Governor Vetoed
  • Last Location: Lieutenant Governor's office for filing

---

• Similar Bills
  • Public Utilities and Technology
  • State Officers and Employees
  • Data and Cyber Security

---

Enrolled

Printer Friendly

H.B. 239

3 67-27-105

1

STATE EMPLOYEE CYBERSECURITY TRAINING REQUIREMENTS 2024 GENERAL SESSION STATE OF UTAH Chief Sponsor: Carl R. Albrecht Senate Sponsor: Evan J. Vickers

2

3

LONG TITLE

4

General Description:

5

This bill provides for a state cybersecurity awareness training program for all state

6

executive branch employees.

7

Highlighted Provisions:

8

This bill:

9

▸requires the Division of Technology Services to create a yearly cybersecurity training

10

course; and

11

▸requires all state executive branch employees to complete the cybersecurity training

12

course once a year.

13

Money Appropriated in this Bill:

14

None

15

Other Special Clauses:

16

None

17

Utah Code Sections Affected:

18

ENACTS:

19

67-27-105, Utah Code Annotated 1953

20

21

Be it enacted by the Legislature of the state of Utah:

22

23

22

Section 1, Section 67-27-105 is enacted to read:

23

67-27-105. Required cybersecurity training.

24

(1) (a) The Division of Technology Services shall institute, develop, conduct, and

25

otherwise provide for a cybersecurity training program for all employees of the state

26

executive branch.

27

(b) A state executive branch employee that is not issued a computer, tablet, or cell

28

phone, and has no access to state systems as part of the state executive branch

29

employee's employment, is not required to participate in the cybersecurity training

30

program described in Subsection (1).

31

(2) The Division of Technology Services shall design the cybersecurity training program to

32

provide instruction regarding:

33

(a) secure computing practices;

34

(b) recognizing and responding to potential cyber threats;

35

(c) protecting sensitive data and information;

36

(d) password management and multi-factor authentication;

37

(e) appropriate use of technology resources; and

38

(f) any other matter the Division of Technology Services determines should be included

39

in the training program.

40

(3) All state executive branch employees shall be required to complete the cybersecurity

41

training program described in Subsection (1):

42

(a) within 30 days after beginning employment; and

43

(b) at least once in each calendar year.

44

(4) Each state agency shall be responsible for monitoring and verifying completion of

45

cybersecurity training by their employees.

46

46

Section 2. Effective date. This bill takes effect on May 1, 2024.