Law / United States / 
Arkansas
Arkansas Cybersecurity Act of 2025, state agency compliance with State Cybersecurity Office governance standards
Arkansas Cybersecurity Act of 2025, Ark. Code Ann. section 25-4-130, Act 489 of 2025
In force.
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each state agency, meaning a department, agency, division, board, or commission within the executive branch of the state government.
- Comply with the cybersecurity governance standards, policies, and procedures the State Cybersecurity Office establishes, including those on cybersecurity and data breach notification; your own standards may be more stringent than the statewide minimum but never less, and stricter federal standards apply where they exist.
- Have your cybersecurity personnel and personnel with information security job functions functionally report to the State Cybersecurity Office, while their positions, funding and daily management stay with the agency.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state agency means a department, agency, division, board, or commission within the executive branch of the state government. The State Cybersecurity Office shall be responsible for directing and managing all functions related to state cybersecurity and information security for each state agency. The State Cybersecurity Office shall establish cybersecurity governance policies, procedures, and standards, including cybersecurity and data breach notification.
A state agency shall comply with the governance standards, policies, and procedures established by the State Cybersecurity Office. Cybersecurity personnel and personnel with information security job functions within each state agency shall functionally report to the State Cybersecurity Office. Arkansas Legislative Audit reports that Act 489 created the State Cybersecurity Office as part of the Department of Shared Administrative Services.