WeVote
Log In

Bill

Bill

SB 1363

CYBERSECURITY TRAINING

104th Regular Session Introduced by Sally Turner

Requires annual cybersecurity training for all state officers, employees, and officials handling government data to improve security and oversight.

Referred to Assignments
0
WeVote Research Nonpartisan
Bill Summary · SB 1363

SB 1363 — Cybersecurity Training (summary)

Note: The materials provided for “SB 1363” include text from more than one jurisdiction and several different bills that share the same number (Hawaii, Arizona, and Illinois). The cybersecurity training language described below corresponds to the Illinois draft of SB 1363 (introduced by Sen. Sally J. Turner). This summary focuses on that cybersecurity-training proposal; where relevant, procedural notes about mixed texts are flagged at the end.

Purpose

Require routine cybersecurity training for public officers, members, and employees and establish oversight and reporting to improve the cybersecurity posture of state government personnel who handle government systems and data.

Key provisions

  • Annual training requirement
    • Each officer, member, and employee must complete a cybersecurity training program at least once per year.
    • Individuals filling a vacancy in an elective or appointed position that requires training must complete the initial training within a short, specified period after assuming duties (text references an initial/commencement requirement).
  • Minimum training content (program must include at least the following topics):
    • Types of cybersecurity threats (e.g., malware), phishing, and social engineering;
    • Password best practices and multi-factor authentication (MFA);
    • Data handling rules, privacy protections, and secure file sharing practices;
    • Recognition and avoidance of suspicious links, attachments, and unsafe websites;
    • Proper care and reporting of lost or stolen government devices.
  • Oversight and administration
    • Cybersecurity training programs are to be overseen by the applicable Ethics Commission and the Inspector General (as appointed under the governing Act).
    • Proof of completion must be submitted to the applicable ethics officer.
  • Reporting by agencies / jurisdictional authorities
    • Each “ultimate jurisdictional authority” (e.g., agency head) must submit to the applicable Ethics Commission, at least annually (or more frequently if required), a report that:
    • Summarizes the cybersecurity training provided the prior year;
    • Lays out the plan for the coming year’s training; and
    • Includes the names of individuals who failed to complete the required training.
    • The draft also contains language that an Ethics Commission shall not post these reports on its website.

Who is affected

  • All state officers, appointed and elected members, and state employees covered by the State Officials and Employees Ethics Act.
  • Agency leadership (ultimate jurisdictional authorities) — responsible for implementing training and filing required reports.
  • Ethics Commissions and Inspectors General — responsible for oversight of training programs.

Potential impacts

  • Security benefits: expected to raise baseline cybersecurity awareness and reduce risk from phishing, credential compromise, and device loss.
  • Administrative costs: agencies will incur training costs (content/licensing/delivery), recordkeeping, and reporting burdens.
  • Oversight workload: Ethics Commissions and Inspectors General will have new supervisory responsibilities.
  • Personnel consequences: naming of non‑completers in reports could raise privacy or employment-policy issues; the bill does not specify discipline in the excerpt provided.

Status & procedural notes

  • The cybersecurity language corresponds to an Illinois bill (SB 1363) introduced in late January 2025 (Sen. Sally J. Turner). The legislative package in the materials contains mixed action dates across jurisdictions. Confirm the target jurisdiction and current committee or chamber status with the authoritative legislative website for that state (e.g., Illinois General Assembly) for up‑to‑date procedural status.

Additional note

Other, unrelated language (Hawaii emergency appropriations; Arizona parents’ rights private‑action statute) appears in the provided document. Those are separate measures and are not part of the cybersecurity training proposal summarized above. If you want a summary of those other texts, I can prepare them separately.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.