1. (1)

   1. (a) Except as provided in Subsection (2), the chief information officer shall, by rule made in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act:

      1. (i) establish standards that impose requirements on executive branch agencies related to the security of the statewide area network;
      2. (ii) establish standards for when an agency must obtain approval before obtaining items described in Subsection 63G-6a-109.5(2);
      3. (iii) specify the detail and format required in an agency information technology plan submitted in accordance with Section 63A-16-203;
      4. (iv) establish standards related to the privacy policies of websites operated by or on behalf of an executive branch agency;
      5. (v) subject to Subsection 63G-6a-109.5(9), establish standards for the acquisition, licensing, and sale of computer software;
      6. (vi) specify the requirements for the project plan and business case analysis required under Section 63G-6a-109.5;
      7. (vii) provide for project oversight of agency technology projects when required under Section 63G-6a-109.5;
      8. (viii) establish, in accordance with Subsection 63G-6a-109.5(3), the implementation of the needs assessment for information technology purchases;
      9. (ix) establish telecommunications standards and specifications in accordance with Subsection 63G-6a-109.5(25); and
      10. (x) establish standards for accessibility of information technology by individuals with disabilities in accordance with Section 63A-16-209.
   2. (b) The rulemaking authority granted by Subsection (1)(a) is in addition to any other rulemaking authority granted under this chapter.

2. (2)

   1. (a) Notwithstanding Title 63G, Chapter 3, Utah Administrative Rulemaking Act, and subject to Subsection (2)(b), the chief information officer may adopt a policy that outlines procedures to be followed by the chief information officer in facilitating the implementation of this title by executive branch agencies if the policy:

      1. (i) is consistent with the executive branch strategic plan; and
      2. (ii) is not required to be made by rule under Subsection (1) or Section 63G-3-201.

   2. (b)

      1. (i) A policy adopted by the chief information officer under Subsection (2)(a) may not take effect until 30 days after the day on which the chief information officer submits the policy to:

         1. (A) the governor; and
         2. (B) all cabinet level officials.
      2. (ii) During the 30-day period described in Subsection (2)(b)(i), cabinet level officials may review and comment on a policy submitted under Subsection (2)(b)(i).

3. (3)

   1. (a) Notwithstanding Subsection (1) or (2) or Title 63G, Chapter 3, Utah Administrative Rulemaking Act, without following the procedures of Subsection (1) or (2), the chief information officer may adopt a security procedure to be followed by executive branch agencies to protect the statewide area network if:

      1. (i) broad communication of the security procedure would create a significant potential for increasing the vulnerability of the statewide area network to breach or attack; and
      2. (ii) after consultation with the chief information officer, the governor agrees that broad communication of the security procedure would create a significant potential increase in the vulnerability of the statewide area network to breach or attack.
   2. (b) A security procedure described in Subsection (3)(a) is classified as a protected record under Title 63G, Chapter 2, Government Records Access and Management Act.

   3. (c) The chief information officer shall provide a copy of the security procedure as a protected record to:

      1. (i) the chief justice of the Utah Supreme Court for the judicial branch;
      2. (ii) the speaker of the House of Representatives and the president of the Senate for the legislative branch;
      3. (iii) the chair of the Utah Board of Higher Education; and
      4. (iv) the chair of the State Board of Education.

Amended by Chapter 43, 2023 General Session