WeVote
Log In

Bill

Bill

S 49

Transfer on Death Deed

2025-2026 Regular Session Introduced by Tom Davis

Requires all state, county, and municipal employees to complete mandatory cybersecurity training (within 30 days of hire and annually) with agency recordkeeping.

Referred to Committee on Judiciary
0
WeVote Research Nonpartisan
Bill Summary · S 49

Summary — S.49 (text provided: “An Act relative to cybersecurity and artificial intelligence”)

Note on source material
- The metadata you provided (title about SUNY Impact Foundation, sponsors Rick Scott/Tom Cotton/Robert Jackson, committee references) conflicts with the bill text included (Massachusetts “An Act relative to cybersecurity and artificial intelligence” presented by Michael O. Moore and James B. Eldridge). This summary is based on the bill text included in the Version Content (Massachusetts draft, Senate Docket No. 873). Verify which bill/version you want if you intended the SUNY tax-credit measure instead.

Purpose
- Establish statewide cybersecurity standards for public employees and define foundational terms and concepts for regulation of cybersecurity and artificial intelligence (AI) in the Commonwealth. The bill is declared an emergency law for immediate effect.

Key provisions
1. Statewide public employee cybersecurity training (new Section 12, Ch. 7D)
- Mandatory training: Every state, county, and municipal employee must complete general cybersecurity awareness training within 30 days of hire and annually thereafter.
- Agency responsibility: Each governmental agency must adopt policies requiring the training and retain employee proof of completion for six years.
- Training development: The Executive Office of Technology Services and Security (EOTSS), in consultation with the Office of the Comptroller, will publish and periodically update online trainings on its official website, including:
- A general cybersecurity awareness program.
- Tailored/special programs for agencies, roles, professions, specific threats, etc.
- Standards and benchmarks: EOTSS will consult Center for Internet Security (CIS), NIST, and the Workforce Framework for Cybersecurity in developing content.
- Agency flexibility: Agencies may use their own general awareness training to satisfy the requirement and may impose additional or supplemental training.

  1. Definitions and scope (new Section 13)
    • Provides statutory definitions for terms used in this and subsequent sections, including:
      • “Artificial intelligence” — machine-based systems that perceive environments, analyze to produce models, and make predictions/recommendations/decisions affecting real or virtual environments.
      • “Breach of security” — as defined in existing law (Ch. 93H).
      • “Covered Entity” — governmental entities and entities operating within the Commonwealth (excludes “small business,” as further defined).
      • “Critical infrastructure” — assets/systems whose loss would debilitate public safety/economy; expressly includes election systems, transportation, water/gas/electric utilities, and sectors identified by federal directives/CISA or the state cybersecurity control board.
      • “Cybersecurity incident” and “cybersecurity threat” — defined to cover events or vulnerabilities that jeopardize integrity, confidentiality, or availability of systems/data.
      • “Government-issued device” and “governmental entity” — defined for clarity.
      • “Response team” — references the Massachusetts Cyber Incident Response Team (to be established in Section 15).
    • The full “small business” definition and parts of Sections 14–16 are truncated in the provided text.

Who is affected
- All state, county, and municipal employees and agencies in the Commonwealth (training and recordkeeping).
- Covered entities operating in the Commonwealth (subject to definitions and future provisions in Sections 14–16).
- Critical infrastructure operators and sectors named or identified by federal or state authorities.
- The Executive Office of Technology Services and Security and the Office of the Comptroller (responsible for program development).

Timelines and procedural notes
- The bill is declared an emergency law (intended to take effect immediately upon enactment).
- Training deadlines: within 30 days of hire and annually thereafter; proof retained for six years.
- Several subsequent sections (including the Cyber Incident Response Team in Section 15) are referenced but not fully provided in the excerpt.
- The legislative action list you provided contains conflicting referrals, sponsors, and companion bills across jurisdictions; confirm the correct docket and status with the legislative clerk or official bill tracker.

Potential impacts and considerations
- Would standardize baseline cybersecurity awareness across public employees, likely reducing human-factor incidents (phishing, credential compromise).
- Centralized training could improve consistency, but agencies retain flexibility to supplement or substitute trainings.
- Definitions of “covered entity,” “small business,” and critical infrastructure will determine regulatory reach; full impact depends on the omitted sections (14–16) and any enforcement or reporting requirements they contain.

If you want, I can:
- Produce a redlined summary of just the training requirements for agency policy adoption; or
- Look up the complete text/remaining sections (14–16) and reconcile the procedural metadata if you confirm which jurisdiction/version to use.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.