Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 280 Fourth Substitute (2022GS)

Sponsor

Rep. Handy, S.

Final action

Governor Signed 3/22/2022

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• creates the Cybersecurity Commission (the commission);
• directs the appointment of members to the commission;
• directs the commission to gather information about cybersecurity:
• vulnerabilities; and
• best practices;
• authorizes the commission to share information it gathers with the governor;
• directs the commission to establish guidelines and best practices with respect to cybersecurity protections;
• directs the commission to analyze cybersecurity practices in the private and the public sectors; and
• requires the commission to report annually to the Public Utilities, Energy, and Technology Interim Committee.

Every vote on this bill

Bill text

CYBERSECURITY COMMISSION
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Stephen G. Handy
Senate Sponsor: 
____________
LONG TITLE
General Description:
This bill creates the Cybersecurity Commission to gather information and share best
practices on cybersecurity.
Highlighted Provisions:
This bill:
▸ creates the Cybersecurity Commission (the commission);
▸ directs the appointment of members to the commission;
▸ directs the commission to gather information about cybersecurity:
• vulnerabilities; and
• best practices;
▸ authorizes the commission to share information it gathers with the governor;
▸ directs the commission to establish guidelines and best practices with respect to
cybersecurity protections;
▸ directs the commission to analyze cybersecurity practices in the private and the
public sectors; and
▸ requires the commission to report annually to the Public Utilities, Energy, and
Technology Interim Committee.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
ENACTS:
63C-25-101
, Utah Code Annotated 1953
63C-25-201
, Utah Code Annotated 1953
63C-25-202
, Utah Code Annotated 1953
63C-25-203
, Utah Code Annotated 1953
63C-25-204
, Utah Code Annotated 1953
63C-25-205
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
63C-25-101
 is enacted to read:
CHAPTER 25. CYBERSECURITY COMMISSION
Part 1. General Provisions
 63C-25-101.
Definitions.
As used in this chapter:
(1) "Commission" means the Cybersecurity Commission created in this chapter.
(2) "Critical infrastructure" includes:
(a) information and communication systems;
(b) financial and banking systems;
(c) any transportation systems intended for the transportation of persons or property;
(d) any public utility service, including the power, energy, and water supply systems;
(e) sewage and water treatment systems;
(f) health care facilities as listed in Section 
26-21-2
, and emergency fire, medical, and
law enforcement response systems;
(g) public health facilities systems;
(h) food distribution systems; and
(i) other government operations and services.
Section 2. Section 
63C-25-201
 is enacted to read:
Part 2. Cybersecurity Commission
 63C-25-201.
Cybersecurity Commission created.
(1) There is created the Cybersecurity Commission.
(2) The commission shall be composed of twelve members:
(a) one member the governor designates to serve as the governor's designee;
(b) the commissioner of the Department of Public Safety;
(c) the lieutenant governor, or an election officer, as that term is defined in Section
20A-1-102, the lieutenant governor designates to serve as the lieutenant governor's designee;
(d) the chief information officer of the Department of Technology Services;
(e) the chief information security officer, as described in Section 
63A-16-210
;
(f) the chairman of the Public Service Commission;
(g) the executive director of the Utah Department of Transportation;
(h) the director of the Division of Finance;
(i) The governor shall appoint:
(i) one representative from the Utah National Guard; and
(ii) one representative from the Governor's Office of Economic Opportunity;
(j) the president of the Senate shall appoint one member of the Senate; and
(k) the speaker of the House of Representatives shall appoint one member of the House
of Representatives.
(3) (a) The governor's designee shall serve as cochair of the commission.
(b) The commissioner of the Department of Public Safety shall serve as cochair of the
commission.
(4) In addition to the membership described in Subsection (2), the commission shall
seek information and advice from state and private entities with expertise in:
(a) chemical manufacturing;
(b) the commercial sector;
(c) telecommunications;
(d) manufacture of critical goods;
(e) defense;
(f) education;
(g) emergency services;
(h) energy;
(i) the financial industry;
(j) food production;
(k) healthcare and public health;
(l) information technology;
(m) transportation; and
(n) water delivery and wastewater management.
(5) As necessary to improve information and protect potential vulnerabilities, the
commission shall seek information and advice from federal entities including:
(a) the Cybersecurity and Infrastructure Security Agency;
(b) the Federal Energy Regulatory Commission;
(c) the Federal Bureau of Investigation; and
(d) the United States Department of Transportation.
(6) (a) Except as provided in Subsections (6)(b) and (6)(c), a member is appointed for a
term of four years.
(b) A member shall serve until the member's successor is appointed and qualified.
(c) Notwithstanding the requirements of Subsection (6)(a), the governor shall, at the
time of appointment or reappointment, adjust the length of terms to ensure that the terms of
commission members are staggered so that approximately half of the commission members
appointed under Subsection (2)(i) are appointed every two years.
(7) (a) If a vacancy occurs in the membership of the commission, the member shall be
replaced in the same manner in which the original appointment was made.
(b) An individual may be appointed to more than one term.
(c) When a vacancy occurs in the membership for any reason, the replacement shall be
appointed for the unexpired term.
(8) (a) A majority of the members of the commission is a quorum.
(b) The action of a majority of a quorum constitutes an action of the commission.
(9) The commission shall meet at least two times a year.
Section 3. Section 
63C-25-202
 is enacted to read:
 63C-25-202.
Commission duties.
The commission shall:
(1) identify and inform the governor of:
(a) cyber threats and vulnerabilities towards Utah's critical infrastructure;
(b) cybersecurity assets and resources;
(c) an analysis of:
(i) current cyber incident response capabilities;
(ii) potential cyber threats; and
(iii) areas of significant concern with respect to:
(A) vulnerability to cyber attack; or
(B) seriousness of consequences in the event of a cyber attack;
(2) provide resources with respect to cyber attacks in both the public and private sector,
including:
(a) best practices;
(b) education; and
(c) mitigation;
(3) promote cyber security awareness;
(4) share information;
(5) promote best practices to prevent and mitigate cyber attacks;
(6) enhance cyber capabilities and response for all Utahns;
(7) provide consistent outreach and collaboration with private and public sector
organizations; and
(8) share cyber threat intelligence to operators and overseers of Utah's critical
infrastructure.
Section 4. Section 
63C-25-203
 is enacted to read:
 63C-25-203.
Compensation of members.
(1) A member who is not a legislator may not receive compensation or benefits for the
member's service, but may receive per diem and travel expenses incurred as a member of the
council at the rates established by the Division of Finance under:
(a) Sections 
63A-3-106
 and 
63A-3-107
; and
(b) rules made by the Division of Finance in accordance with Sections 
63A-3-106
 and
63A-3-107
.
(2) Compensation and expenses of a member who is a legislator are governed by
Section 
36-2-2
 and Legislative Joint Rules, Title 5, Legislative Compensation and Expenses.
Section 5. Section 
63C-25-204
 is enacted to read:
 63C-25-204.
Staffing.
The Department of Public Safety shall provide staff and support to the commission.
Section 6. Section 
63C-25-205
 is enacted to read:
 63C-25-205.
Reporting requirement.
On or before November 30, the commission shall report to the Public Utilities, Energy,
and Technology Interim Committee:
(1) an assessment of cyber threats to Utah;
(2) recommendations for legislation that would reduce the state's vulnerability to
attack; and
(3) recommendations for best practices for state government with respect to
cybersecurity.