Bill > HB0165

This bill establishes new provisions to protect Utah's critical infrastructure, which are systems and assets vital to the state's security, economy, and public health, including emergency services, power, water, transportation, and data systems, from threats posed by foreign adversaries, defined as countries listed in a specific federal regulation as of January 1, 2026, and entities or individuals associated with them. The Utah Cyber Center (Cyber Center) will develop and maintain guidance for government entities on identifying and mitigating cybersecurity risks related to foreign adversary technology, software, or services used in critical infrastructure, including best practices for security, access limitations, and contingency plans for manual operations. Government entities can request security assessments from the Cyber Center if they are considering or currently using technology from a foreign adversary, with the Cyber Center prioritizing these assessments based on risk. Starting July 1, 2026, the Cyber Center will maintain a list of prohibited companies and technologies that pose a risk of foreign adversary control over critical infrastructure, and government entities and critical infrastructure providers will be barred from contracting with or using technology from entities on this list, unless no reasonable alternative exists. Additionally, no entity involved with critical infrastructure can contract with a foreign principal from a foreign adversary if the agreement allows direct or remote access or control of that infrastructure, again with an exception for when no reasonable alternative is available.

Justice, Transportation and Infrastructure

https://le.utah.gov/~2026/bills/static/HB0165.html