Senate passes bill requiring multi-factor authentication across state agencies

The Idaho Senate voted 31-4 on Feb. 18, 2025, to pass House Bill 35, legislation aiming to strengthen cybersecurity across state agencies by requiring multi-factor authentication and other best practices.

Sponsor Sen. Cook described the bill as "a critical piece of legislation that will strengthen Idaho's cyber security framework and protect our state's data infrastructure," explaining that multi-factor authentication asks for "more than just a password" and can include codes sent to a phone or biometric factors.

Cook said the requirement is intended to reduce unauthorized access to agency systems and protect state data. Debate on the floor was brief and concluded without amendments. The bill's passage sends it back to the House for further action.

Supporters emphasized practical measures—password plus a second factor such as a device code or fingerprint—rather than technical mandates for any single vendor. Opponents did not press an extended floor debate; the roll call produced 31 votes in favor and 4 against. The Senate approved the bill’s title and returned it to the House of Representatives for the next steps.