Bill > HB0165

This bill establishes new provisions to protect Utah's critical infrastructure, defined as vital systems and assets operated by governmental entities that are essential for public security, economic stability, and health, including emergency services, power, water, transportation, and data systems, from threats posed by foreign adversaries. The Utah Cyber Center (Cyber Center) will develop and update guidance for governmental entities on identifying and mitigating cybersecurity risks associated with technology, software, or services from foreign adversaries, which are defined as countries listed in a specific federal regulation as of January 1, 2026, and their associated entities or individuals. This guidance will include best practices for risk assessment, security controls, limiting access, and developing manual operational contingency plans. Governmental entities can request security assessments from the Cyber Center if they are considering or currently using technology from foreign adversaries, with assessments prioritized based on data sensitivity and potential impact. Starting July 1, 2026, the Cyber Center will maintain a list of prohibited companies and technologies that pose a risk of foreign adversary control over critical infrastructure, and governmental entities and critical infrastructure providers will be barred from contracting with or using technology from entities on this list, unless no reasonable alternative exists. Additionally, no entity involved with critical infrastructure can enter into agreements with foreign principals from foreign adversaries if those agreements allow direct or remote access or control of critical infrastructure, again with an exception for situations where no reasonable alternative exists.

Justice, Transportation and Infrastructure

https://le.utah.gov/~2026/bills/static/HB0165.html