AI-generated summary, not yet reviewed by Better Utah staff. Please consult the bill text.

Community water systems across Utah — the utilities that pipe drinking water to homes and businesses — would be required to complete emergency response plans addressing cybersecurity threats to their computerized control systems, with larger systems (serving 3,300 or more people) meeting an initial deadline of December 31, 2026, and smaller systems following by July 1, 2027, and both renewing these plans annually thereafter. These plans must include measures such as keeping control-system software updated, training employees on cybersecurity, conducting internal vulnerability assessments, promptly cutting off system access for terminated employees, and ensuring automated systems can be operated manually if needed. If a security breach occurs, the water system would have to report it to the Utah Cyber Center within two hours, and the Utah Cyber Center would then notify the state's Division of Drinking Water within one day; the Division would also be required to report annually to two legislative committees on security conditions across the state's water systems. Emergency response plans and related incident reports would be classified as protected records under Utah's public records law, meaning they would be shielded from public disclosure requests to prevent the information from being used to target water system vulnerabilities.