Committee adopts amendment to shift cybersecurity bill toward assessments, sends measure to Ways and Means

Co‑Chair Nathanson on Friday opened a work session on House Bill 3,228 and, after discussion, the Joint Committee on Information Management and Technology voted to adopt a dash‑1 amendment and to report the bill to the Joint Committee on Ways and Means.

The dash‑1 amendment narrows the bill’s original focus from a broad study of public‑body cyber insurance to a program of assessments and targeted assistance. The amendment directs the Oregon Cybersecurity Advisory Council to conduct more detailed assessments that identify and document cybersecurity vulnerabilities and “recommend actions to address the reasons that public bodies are unable to meet cybersecurity insurance coverage requirements,” and it extends the advisory council’s reporting deadline to the interim committees of the Legislative Assembly from December 31, 2025, to September 30, 2026. The amendment also extends a scheduled repeal date from January 2, 2026, to January 2, 2027, and allows monies in the Cybersecurity Resilience Fund to pay for assessments, documentation of coverage shortfalls and cybersecurity training in addition to the fund’s originally listed uses.

Why it matters: Committee members said many smaller local governments, school districts and special districts still cannot meet insurers’ underwriting requirements even as more…