Legislative Council adopts updated computer acceptable use policy, excepts AI section, after cybersecurity briefing

Following an executive session cybersecurity briefing, the Legislative Council voted to adopt an updated computer acceptable use policy on Nov. 5, while specifically excepting the proposed section on artificial intelligence (AI) from that approval.

Shay Wilson, chief information officer, summarized the edits to the policy, characterizing much of the work as language cleanup (capitalization and phrasing), replacing archaic terms ("electronic mail" to "email") and updating language around social media. He described a new mandatory cybersecurity awareness training program to be delivered annually and a scheduled review of the policy every legislative biennium to be included with other Legislative Affairs Agency training. Wilson said mandatory training was one of four recommendations that came from the DTI cybersecurity assessment; the other recommendations include multifactor authentication for VPN connections, increased password complexity, and additional verification for privileged administration access. "I recommend that the legislative council adopt the computer acceptable use policy," Wilson said.

Senator Stevens moved the policy adoption but carved out the AI section from immediate approval. The council approved the policy (excluding the AI section) by roll call, 10 yeas and 0 nays. The action was recorded following the agency briefing and questions; members asked no substantive amendments during the recorded discussion.

The council directed staff to carry out mandatory training and to integrate the policy review into the agency's regular training cycle; no implementation deadlines beyond scheduled biennial review were specified during the meeting.