The commission shall:

1. (1) identify and inform the governor of:

   1. (a) cyber threats and vulnerabilities towards Utah's critical infrastructure;
   2. (b) cybersecurity assets and resources; and

   3. (c) an analysis of:

      1. (i) current cyber incident response capabilities;
      2. (ii) potential cyber threats; and

      3. (iii) areas of significant concern with respect to:

         1. (A) vulnerability to cyber attack; or
         2. (B) seriousness of consequences in the event of a cyber attack;

2. (2) provide resources with respect to cyber attacks in both the public and private sector, including:

   1. (a) best practices;
   2. (b) education; and
   3. (c) mitigation;
3. (3) promote cyber security awareness;
4. (4) share information;
5. (5) promote best practices to prevent and mitigate cyber attacks;
6. (6) enhance cyber capabilities and response for all Utahns;
7. (7) provide consistent outreach and collaboration with private and public sector organizations;
8. (8) share cyber threat intelligence to operators and overseers of Utah's critical infrastructure; and

9. (9) in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, make rules establishing minimum cybersecurity standards for a local education agency, as that term is defined in Section 53G-3-402, that:

   1. (a) align with industry recognized cybersecurity frameworks and standards, including frameworks developed by the National Institute of Standards and Technology, the Center for Internet Security, or a successor organization;
   2. (b) take into account varying local education agency resources, capacity, and needs;
   3. (c) establish phased implementation timelines based on local education agency size, existing cybersecurity infrastructure, and available resources; and

   4. (d) as appropriate based on the local education agency's size, risk profile, and available resources, shall address:

      1. (i) identity and access management;
      2. (ii) asset management and inventory of hardware, software, and data systems;
      3. (iii) data protection;
      4. (iv) security monitoring and logging capabilities;
      5. (v) vulnerability management, including regular security assessments and patching procedures;
      6. (vi) incident response and recovery planning;
      7. (vii) security awareness training requirements for staff and administrators;
      8. (viii) third-party risk management for vendors with access to local education agency systems or data;
      9. (ix) network security controls;
      10. (x) backup and disaster recovery procedures; and
      11. (xi) governance structures for cybersecurity oversight within a local education agency.

Amended by Chapter 170, 2026 General Session