Law keeps sensitive government cybersecurity records confidential

Agencies keep specified cybersecurity and technology records confidential. The provisions cover records held by an agency, including information about existing or proposed technology systems and data. The text covers information about critical infrastructure, login credentials, agency insurance coverage, and security practices or reports. Security practices and reports are covered when disclosure could help someone access, change, disclose, or destroy systems or data. The records exemption applies to information held before, on, or after its effective date. It is scheduled for repeal on October 2, 2031, unless the Legislature renews it.

Agencies may close the part of a public meeting that would reveal protected cybersecurity information. This applies when a meeting discussion would reveal information made confidential under the agency cybersecurity records provisions. The closed portion must be recorded and transcribed; it cannot be held off the record. The recording and transcript are confidential.

Local government utilities keep specified security and customer information confidential. These provisions apply to information held by a utility owned or operated by a unit of local government. Technology security information is covered when disclosure could help someone access, alter, or destroy systems in a way that harms safe and reliable utility service. The text also covers customer meter data and billing information in increments shorter than one billing cycle. The security records exemption is scheduled for repeal on October 2, 2027, unless the Legislature renews it.