Co-chairs delay work session on HB 4055 after amendments narrowed to notification-only

The Joint Committee on Information Management and Technology was told on Feb. 13 that House Bill 4055 will not advance during the short session while co-chairs continue work on amendments. Chair Nathanson said the bills latest revisions shift the requirement "from a reporting system to just simply a notification," likening the notice to a "call 911" for local governments hit by serious cyber incidents.

Co-chair Pham and Chair Nathanson said two amendment packages were drafted to reduce burdens on local governments, special districts and school districts dealing with cyberattacks. The changes are intended to limit new compliance obligations while ensuring the State CIOs office can "reach out and say, do you need help?" Nathanson said the amendments also add the Oregon Department of Emergency Management to the notification chain.

Despite narrowing the bills scope, Nathanson said some stakeholders who earlier raised concerns remained unconvinced by the redraft and new issues continued to surface. "We determined that this bill just isn't ready this session," he said, adding the committee will use the interim to address drafting, stakeholder communication and intra-organization sign-offs that have produced confusion.

Nathanson cited a prior response to the Curry County incident as the type of state-level assistance the notification would enable. He emphasized the short sessions compressed calendar is not ideal for major new proposals and urged more coordinated stakeholder work during the interim.

The committee did not take a vote on HB 4055 during the meeting and took no formal action; sponsors said they will return with clarified language and improved stakeholder alignment in the months ahead.