Committee advances House Bill 35 to require multi-factor authentication across state agencies

Senator Kevin Cook, an Idaho state senator from Legislative District 32, introduced House Bill 35 to the Senate State Affairs Committee as legislation "that will strengthen Idaho's cyber security framework and protect our data's infrastructure." The measure would require state agencies to implement multi‑factor authentication (MFA) on accounts that access state systems.

Senator Cook explained MFA in plain terms: "Multi‑factor authentication is a simple way to protect your online accounts by requiring more than just a password," and described the three standard authentication factors as "something you know, something you have, and something you are." He told the committee the technology already exists in many applications and described the change as providing a "huge ROI" against ransomware and account compromise.

Committee members asked about costs and implementation. Senator Shippey asked whether the bill would require additional personnel or software. Senator Cook answered that the fiscal note estimated "none to minimal" additional cost, explaining that the state's IT service provider already offers many of the tools and major applications already support MFA, though adoption is not yet universal.

Senator Taves moved that House Bill 35 be sent to the Senate floor with a due‑pass recommendation; the motion was seconded and the chair announced the motion carried. No public testimony was recorded in favor or opposition during the short hearing.

The committee did not adopt textual amendments. The sponsor told the panel he would be available for questions and follow‑up on implementation details if needed.