Senate committee backs House Bill 35 to require multi‑factor authentication for state agencies

The Senate State Affairs Committee on Friday voted to send House Bill 35 to the Senate floor with a due pass recommendation after a brief presentation and limited questions.

Sponsor Senator Kevin Cook (R., District 32) described the bill as a measure to strengthen Idaho’s cybersecurity by adopting best practices, including a requirement that state agencies use multi‑factor authentication (MFA) for access to systems. Cook said MFA mixes at least two of three authentication factors—something you know (a password), something you have (a code sent to a phone or a hardware key), and something you are (biometrics)—and that adding these protections reduces risk from ransomware and account compromise.

“Multi factor authentication is a simple, very simple way to protect your online accounts by requiring more than just a password,” Cook said.

Committee members asked about cost and implementation. Senator Shippey asked whether the change would require additional funding or staffing. Cook replied the fiscal note anticipates little to no additional expenditure because existing tools are available through the state’s central IT services and many major software providers already support MFA; the sponsor described any implementation costs as “negligible.”

Senator Toews moved and Senator Dan Hartog seconded the motion to send HB 35 to the Senate floor with a due pass recommendation. The committee approved the motion by voice vote; no roll‑call tally was recorded in the transcript.

What happens next: HB 35 will proceed to the full Senate for committee of the whole consideration and a floor vote. If enacted, the bill would require agencies to implement MFA consistent with the bill’s timetable and exemptions (if any) to be specified in legislative text.