Law / United States / 
Arkansas
Public entity cybersecurity policy and training duties (Act 504 of 2023, as amended by Act 848 of 2025)
Public entity cybersecurity policy, Ark. Code Ann. section 25-1-128(b), Act 848 of 2025
In force.
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each public entity, an instrumentality funded in whole or in part by taxpayer funds, which includes state departments, public school districts, open-enrollment public charter schools, institutions of higher education and political subdivisions of the state; the cybersecurity policy and discipline duties do not apply to a political subdivision of the state.
- Develop a cybersecurity policy for all of your technology resources based on the standards and guidelines set by the State Cybersecurity Office.
- Develop a training program for all employees concerning the technology resources policy and the cybersecurity policy; a political subdivision is not required to develop training for the cybersecurity policy.
- If you are a state entity, submit your cybersecurity policy for approval to the State Cybersecurity Office by October 1 of each even-numbered year.
- Create a disciplinary procedure for a violation of your cybersecurity policy, in consultation with the State Cybersecurity Office, that establishes the discipline and the reporting procedure for suspected violations.
These lines are LexLint's reading of the law's text, as of .
What this law does
A public entity means an instrumentality funded in whole or in part by taxpayer funds. A public entity shall develop a cybersecurity policy for all technology resources of the public entity based on the standards and guidelines set by the State Cybersecurity Office. The cybersecurity policy duty does not apply to political subdivisions of the state. A public entity shall develop a training program for all employees concerning the technology resources policy and the cybersecurity policy.
A political subdivision of the state is not required to develop a training program under the section for a cybersecurity policy. Each state entity shall submit a cybersecurity policy for approval to the State Cybersecurity Office by October 1 of each even-numbered year. A public entity, except for a political subdivision of the state, shall create a disciplinary procedure for a violation of its cybersecurity policy in consultation with the State Cybersecurity Office.
Arkansas Legislative Audit reports that Act 504 of 2023 requires public entities to develop policies pertaining to the authorized use of technology resources and addressing cybersecurity concerns.