Bill > HB2809

This bill mandates that Arizona implement a statewide cybersecurity system utilizing "post-quantum encryption," which refers to advanced encryption methods designed to withstand attacks from both current and future quantum computers, exceeding standards set by the National Institute of Standards and Technology. This system must meet or surpass the initial validation of "CMMC 2.0," a cybersecurity standard developed by the U.S. Department of Defense. The system will be deployed across state agencies handling sensitive data, including personal information, election data, and infrastructure-related information. Procurement of this system is restricted to U.S.-based companies that exclusively use U.S.-developed and manufactured components and meet or exceed U.S. Department of Defense cybersecurity standards, with no foreign parent companies or dependencies. The Auditor General will serve as the independent custodian of the master encryption keys, responsible for secure management, audits, and reporting any noncompliance, while state agencies are prohibited from having sole control over these keys and must ensure their systems are properly installed, validated, and continuously compliant. Vendors involved will be required to provide training, support, and documentation of compliance, and both vendors and agencies that fail to comply face potential consequences ranging from corrective action plans to budget restrictions. The legislature finds that these measures are necessary due to increasing cybersecurity threats and the emerging risk posed by quantum computing to current encryption methods.

Business and Industry

https://apps.azleg.gov/BillStatus/BillOverview/84632