cybersecurity; data encryption; pilot program
HB 2736 establishes a five-year pilot program requiring Arizona state agencies to implement and upgrade data encryption systems meeting strict security criteria. It directly affects the Secretary of State, Department of Revenue, Department of Administration, and the Legislature, each implementing the system in sequential fiscal years starting in 2026. The bill mandates that encryption systems must be U.S.-owned, quantum-proof, use U.S. patents, allow key resets without third-party access, and include detailed audit trails. The Department of Administration must report annually on progress and security, with a final evaluation due in 2031, and the program expires June 30, 2032.
Bill status
passed
3 of 5 stages cleared
Introduction
Feb 2025
Committee Review
Feb 2025
House Passage
Mar 2025
Senate Passage
Governor
Introduced Feb 10, 2025
Last action Mar 24, 2025
Maddy AI version diff · 1 comparison
What changed between versions
Introduced Version
→
House Engrossed Version
·
6 edits
·
Mar 11, 2025
MODERATE
The bill was significantly rewritten to shift from a five-year pilot program run by the Department of Administration to a seven-year study run by the Department of Homeland Security. The new version replaces the mandate to immediately purchase and install encryption systems with a requirement to first conduct studies and prepare reports for legislative review. Additionally, the timeline for final reports and the repeal of the section was extended.
Scope change
The bill's scope changed from an immediate implementation of a data encryption system to a phased study and planning process. The responsible agency changed from the Department of Administration to the Department of Homeland Security.
TIMELINE
The program duration was extended from five years to seven years.
The repeal date was extended from June 30, 2032, to June 30, 2034.
The deadline for submitting the final effectiveness report was extended from fiscal year 2030-2031 to fiscal year 2031-2032.
ELIGIBILITY
The responsible agency changed from the Department of Administration to the Department of Homeland Security.
REQUIREMENT
The requirement to immediately implement and purchase a data encryption system was replaced with a requirement to conduct studies and prepare reports for legislative review.
TECHNICAL
The duration of the annual audit period was increased from five years to seven years.
Floor votes · House Mar 11, 2025
How they voted
35–22
Passed · 3 other
Total votes 60
Mar 11, 2025
D
Democratic27
81% Nay
R
Republican33
93% Yea
Vote distribution
All Yea
All Nay
Mixed
No data
Full legislative history
Actions timeline
Total actions
13
Key actions
6
Committee
1
Amendments
3
Mar 24, 2025
Upper · Passed
DPA
upper
Mar 11, 2025
Lower · Passed
PASSED
lower
Mar 10, 2025
Lower · Passed
DPA
lower
Mar 10, 2025
Lower · Passed
PASSED
lower
Mar 4, 2025
Lower · Passed
DPA
lower
Feb 19, 2025
Lower · Passed
DP
lower
1 primary · 15 co-sponsors
Sponsors
Role
Legislator
Party
State
District
P
John Gillette
RRepublican
Co
Brian Fernandez
DDemocratic
Co
David Gowan
RRepublican
Co
Hildy Angius
RRepublican
Co
John Kavanagh
RRepublican
Co
Justin Wilmeth
RRepublican
Co
Kevin Payne
RRepublican
Co
Kevin Volk
DDemocratic
Co
Laurin Hendrix
RRepublican
Co
Leo Biasiucci
RRepublican
Co
Michael Way
RRepublican
Ask Maddy
·
AI policy assistant
Ask Maddy about HB 2736
Scope: AZ
Hi! I can help you understand HB 2736. What would you like to know?
Try one of these
i
Maddy answers using official bill text and legislative records. Always verify before sharing.
Sources cited inline