You're previewing an early version of the Bill Tracker. We're still ironing out some bugs — thanks for your patience as we build this out.
Logo
Better Utah Bill Tracker
2026 Interim Session

H.B. 165

Signed into Law

Critical Infrastructure Amendments

HB0165S04 (Substitute)

Sen. Keven J. Stratton
Rep. Walt Brooks
Rep. Walt BrooksBill Sponsor
View on le.utah.gov
H.B. 165Signed into Law

Critical Infrastructure Amendments

House
›
Senate
›
Governor

What This Bill Does

This bill enacts provisions regarding foreign adversary threats to critical infrastructure.

Key Provisions

This bill:

  • defines terms;
  • directs the Utah Cyber Center to develop guidance on foreign adversary threats to critical infrastructure;
  • prohibits use of federally banned equipment in critical infrastructure;
  • authorizes voluntary security assessments for critical infrastructure involving foreign adversary technology;
  • provides for coordination between the Utah Cyber Center and governmental entities on critical infrastructure security;
  • prohibits governmental entities and critical infrastructure providers from contracting for or deploying technology included on a prohibited list maintained by the Utah Cyber Center;
  • requires the Utah Cyber Center to publish and maintain a prohibited list of foreign adversary technologies that pose a risk to critical infrastructure;
  • prohibits entities with access to critical infrastructure from entering into agreements with foreign principals that would allow remote access to or control of critical infrastructure; and
  • authorizes the Utah Cyber Center to approve exceptions to the prohibitions under specified circumstances.

Plain-Language Summary

AI-generated summary. We recommend consulting the bill text for important decisions.

New rules for protecting Utah's critical systems — power grids, water systems, emergency communications, and government data networks — from foreign adversary threats take effect under this bill. It directs the Utah Cyber Center to develop and annually update security guidance for government agencies, publish a prohibited list of foreign adversary technologies (drawing from existing federal ban lists), and bar government entities and critical infrastructure providers from purchasing or deploying anything on that list starting July 1, 2026. The bill also prohibits any company or government entity with significant access to critical infrastructure from entering into agreements that would give a foreign adversary government, party, or business remote access to or control over those systems, with a narrow exception when no reasonable alternative exists.