HB 2736 Summary

• Creates section 26-108 authorizing the Department of Emergency and Military Affairs cybersecurity team to conduct assessments of technology products purchased by state agencies and the legislative branch upon request.

• Assessment activities include penetration testing, hardware nondestructive testing, and vendor-capability verification to evaluate cybersecurity defenses and compliance standards.

• Establishes a seven-year data encryption and cybersecurity pilot program administered by the Arizona Department of Homeland Security, with phased implementation across state agencies from fiscal year 2026-2027 through 2029-2030.

• Encryption system must be owned by Arizona, created and maintained by a U.S.-based company with no foreign owners, include accessible source code for audit, and meet DoD-level security standards with quantum encryption-resistant key-connected password systems.

• Requires annual audits by the Auditor General for seven years and annual reports to the legislature on implementation status and security assessments; repeals December 30, 2034.