§ 63A-16-1102 — Utah Cyber Center -- Creation -- Duties.

Utah § 63A-16-1102

• Jurisdiction: Utah
• Title 63A: Utah Government Operations Code
• Ch. 63A-16: Utah Technology Governance Act
• Part 63A-16-11: Utah Cyber Center

Text

(1) (1)(a) There is created within the division the Utah Cyber Center.
(1)(b) The chief information security officer appointed under Section 63A-16-210 shall serve as the director of the Cyber Center.
(2) The division shall operate the Cyber Center in partnership with the following entities within the Department of Public Safety created in Section 53-1-103:
(2)(a) the Statewide Information and Analysis Center;
(2)(b) the State Bureau of Investigation created in Section 53-10-301; and
(2)(c) the Division of Emergency Management created in Section 53-2a-103.
(3) In addition to the entities described in Subsection (3), the Cyber Center shall collaborate with:
(3)(a) the Cybersecurity Commission created in Section 63C-27-201;
(3)(b) the Office of the Attorney General;
(3)(c) the Utah Education and Telehealth Network created in Section 53H-4-213.4;
(3)(d) appropriate federal partners, including the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency;
(3)(e) appropriate information sharing and analysis centers;
(3)(f) information technology directors, cybersecurity professionals, or equivalent individuals representing political subdivisions in the state; and
(3)(g) any other person the division believes is necessary to carry out the duties described in Subsection (4).
(4) The Cyber Center shall, within legislative appropriations:
(4)(a) by June 30, 2024, develop a statewide strategic cybersecurity plan for governmental entities;
(4)(b) with respect to executive branch agencies:
(4)(b)(i) identify, analyze, and, when appropriate, mitigate cyber threats and vulnerabilities;
(4)(b)(ii) coordinate cybersecurity resilience planning;
(4)(b)(iii) provide cybersecurity incident response capabilities; and
(4)(b)(iv) recommend to the division standards, policies, or procedures to increase the cyber resilience of executive branch agencies individually or collectively;
(4)(c) at the request of a governmental entity, coordinate cybersecurity incident response for a data breach affecting the governmental entity in accordance with Section 63A-19-405;
(4)(d) promote cybersecurity best practices;
(4)(e) share cyber threat intelligence with governmental entities and, through the Statewide Information and Analysis Center, with other public and private sector organizations;
(4)(f) serve as the state cybersecurity incident response repository to receive reports of breaches of system security, including notification or disclosure under Section 13-44-202 and data breaches under Section 63A-16-1103;
(4)(g) develop incident response plans to coordinate federal, state, local, and private sector activities and manage the risks associated with an attack or malfunction of critical information technology systems within the state;
(4)(h) coordinate, develop, and share best practices for cybersecurity resilience in the state;
(4)(i) identify sources of funding to make cybersecurity improvements throughout the state;
(4)(j) develop a sharing platform to provide resources based on information, recommendations, and best practices; and
(4)(k) partner with institutions of higher education and other public and private sector organizations to increase the state's cyber resilience.

Legislative History

Amended by Chapter 9, 2025 Special Session 1