Critical Infrastructure Amendments

Removed mandatory certification, background checks for employees, and data storage requirements for private companies accessing critical infrastructure.

Added a requirement for state agencies to request voluntary security assessments from the Utah Cyber Center before procuring technology from foreign adversaries.

Eliminated administrative fines, court injunctions, and prohibitions on receiving state or federal funds for non-compliance.

Redefined 'critical infrastructure' to apply only to systems operated or maintained by state agencies, excluding private sectors like gas, oil, and telecommunications.

Added a specific definition for the 'Cyber Center' as the entity responsible for issuing guidance and conducting assessments.

Removed specific compliance deadlines and transition periods for removing prohibited equipment.

Added a requirement for the Utah Cyber Center to publish and maintain a prohibited list of foreign adversary technologies.

Added a prohibition on governmental entities and critical infrastructure providers from contracting for or deploying technology found on the prohibited list.

Added a prohibition on entities with access to critical infrastructure entering agreements that allow foreign principals remote access or control.

Added a new definition for 'foreign principal' to define individuals, entities, or governments that could control or influence critical infrastructure.

Added authority for the Utah Cyber Center to approve exceptions to the new prohibitions under specified circumstances.

The definition of 'state agency' was changed to 'governmental entity', meaning local governments and other public bodies are now included in the bill's requirements instead of just state-level departments.

The definition of 'foreign adversary' was updated to reference the current list of countries in federal regulations as of January 1, 2026, instead of a future date, ensuring the list stays up to date automatically.

The definition of 'Critical infrastructure' was slightly broadened to apply to systems vital to a 'governmental entity's jurisdiction' rather than just the state, reflecting the expanded scope.

A new requirement was added mandating that critical infrastructure operators create a comprehensive manual operations contingency plan to handle situations where automated systems fail during a cyber attack.

The 'Highlighted Provisions' section was modified to add two new mandatory requirements: prohibiting state agencies from entering or renewing contracts with foreign adversary companies and prohibiting the use of federally banned equipment in critical infrastructure.

The original 'Highlighted Provisions' list contained only voluntary measures, such as directing the Cyber Center to develop guidance and authorizing voluntary security assessments, without any mandatory prohibitions on contracting.

The text was updated to reflect that the Senate Sponsor field is now blank, indicating a change in sponsorship status or a formatting adjustment in the substitute version.