TO CREATE THE ARKANSAS CYBERSECURITY ACT OF 2025.

New cybersecurity oversight for Arkansas state agencies

The law creates a State Cybersecurity Office led by the State Information Security Officer. It manages cybersecurity across Arkansas executive-branch agencies and coordinates the use of staff and other resources. The office sets rules for protecting data, breach notices, threat monitoring, security checks, fixes, and staff training. It audits agency compliance, runs a state incident response plan and team, and coordinates with state and federal agencies. It also serves as a cybersecurity resource for governments, utilities, service providers, schools, and nongovernmental groups. Agencies must meet statewide minimum standards; they can adopt stronger rules, and stricter federal standards apply. Agency security staff report to the office for this work, but their agencies keep their positions, funding, and daily management. The State Information Security Officer can create a team to help develop and manage cybersecurity plans and rules. The office reports audit and enforcement findings to the Joint Committee on Advanced Communications and Information Technology in closed meetings. Reports cover security checks, fixes, agency failures to comply, and other relevant work at least twice each calendar year and when the chair requests. The law does not require access to data protected by state or federal law.