House committee advances bill requiring municipal cybersecurity plans, prompting debate over state-held details

The House Government Regulatory Committee advanced an amended bill that would require municipalities to develop cybersecurity plans that meet state-set parameters and provide those plans to the state, following a committee vote to move the measure as amended.

Committee members and a witness debated whether asking local governments and utilities to share plan details with the state could create new security vulnerabilities. A witness used a key metaphor to describe the concern: “You've given everybody a copy of your key ... and the state is holding this, a copy of the key. And then that leaves everybody else in that same vulnerable vulnerable state of if this door were broken into that has all of these keys, then they have the ability to break into every other unit and breach information,” the witness said.

Representative Lehman, a committee member, replied that the bill’s main aim is to ensure entities have a plan and that the state would act as a resource. “The underlying bill basically is saying you have to have a plan. It addresses the fact that there are public entities who do not have a plan. So you have to now work with the state,” Lehman said. “This bill says you gotta have a key and and we're gonna give you some parameters, and we'll help you with guidelines on how to build that key. So we're here more as a resource, and then we're gonna hold that information as well because we wanna know what you're getting into.”

Committee leadership asked if members had further questions and then accepted an amendment by consent. The committee then moved the amended bill and called the roll. Representatives recorded as voting yes were: Hatcher, Bartlett, Harris, Campbell, Karakoff, O'Brien, Engleman, Schonkweiler, Jordan, King, Green and Abbott. Representative Miller was recorded as excused. The clerk announced a tally of 12 votes in favor; no no votes or abstentions were recorded in the transcript.

The discussion in committee focused on clarifying the bill’s scope — emphasizing it would require municipalities to have a cybersecurity plan that conforms to state-provided parameters and that the state would provide guidance and retain information about plans. Committee members and the witness contrasted existing agreements between utilities and municipalities with the bill’s broader reach to ensure all public entities have a plan.

The committee concluded its consideration of the measure and moved on to the next scheduled item on the agenda.