Law / United States / 
Idaho
State agency cybersecurity direction and multifactor identification
State Agency Cybersecurity and Multifactor Identification, Idaho Code ss. 67-827A and 67-2363
In force since .
A sector security regimes rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds Idaho state agencies, meaning all state agencies or departments, boards, commissions, councils, and institutions of higher education, other than the elected constitutional officers and their staffs, the legislature and its staffs, and the judiciary, which section 67-2363 reaches separately (Idaho Code 67-831(3), 67-827A).
- Implement and maintain cybersecurity best practices, which the office of information technology services must ensure all state agencies do (Idaho Code 67-827A(10)).
- Implement and use multifactor identification, meaning two or more different types of identification credentials, to access information technology devices or services, including local and remote network access to any email accounts, cloud storage accounts, web applications, networks, databases, or servers (Idaho Code 67-827A(11), 67-831(2)).
- Follow the direction of the office of information technology services on information security needs, penetration tests and vulnerability scans of state technology systems, and mandatory education and training of state employees (Idaho Code 67-827A(6) to (8)).
- The legislative branch and its staff, the judicial branch and its staff, and the elected constitutional officers and their staffs must implement multifactor identification and require it to access information technology devices or services (Idaho Code 67-2363).
These lines are LexLint's reading of the law's text, as of .
What this law does
The office of information technology services is directed to ensure that all state agencies implement and maintain cybersecurity best practices. The office must require all state agencies to implement and use multifactor identification to access information technology devices or services, including local and remote network access to any email accounts, cloud storage accounts, web applications, networks, databases, or servers.
The office is authorized and directed to direct state agencies and officials on penetration tests and vulnerability scans of state technology systems in order to identify steps to mitigate identified risks. State agencies means all state agencies or departments, boards, commissions, councils, and institutions of higher education, but not the elected constitutional officers and their staffs, the legislature and its staffs, or the judiciary.
Multifactor identification means using two or more different types of identification credentials to achieve authentication. The legislative branch and its staff, the judicial branch and its staff, and the elected constitutional officers and their staffs shall implement the use of multifactor identification. House Bill 35 of 2025 became Session Law Chapter 6 and took effect on .