Utah HB 44: A Cybersecurity Readiness Guide for School Districts

HB 44 (2026 General Session, Chief Sponsor Rep. Ryan Wilcox; Senate Sponsor Sen. Ann Millner) is mostly a physical-security bill: armed school guardians, panic-alert devices, visitor management. The cybersecurity requirements are one part of it, and knowing exactly where they live matters when you are reading the law or briefing leadership.

The cybersecurity provisions are enacted at Utah Code Title 53G, Chapter 8, Part 9 (LEA Cybersecurity Standards), Sections 53G-8-901 through 53G-8-903, with the standards-setting duty at Section 63C-27-202(9). The bill was signed by Governor Cox and took effect May 6, 2026. In brief, Part 9 and the related Commission duty do four things:

• Minimum standards, set by rule. Each LEA must comply with minimum cybersecurity standards established by the state Cybersecurity Commission through administrative rulemaking (Section 53G-8-902), on a phased implementation timeline also established in rule.
• Framework-aligned rules. Section 63C-27-202(9) directs the Commission to align the standards with industry-recognized frameworks, specifically naming the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS), and to account for varying LEA resources, capacity, and needs.
• State support for districts. UETN, in consultation with the Utah Cyber Center and the state board, must develop implementation guidelines and technical resources, provide technical assistance, and coordinate cybersecurity services and resources for LEAs. The three entities must coordinate to avoid duplication and provide consistent guidance.
• Breach reporting, information sharing, and a named contact. Section 53G-8-903 adds data-breach reporting duties, requires each LEA to participate in Cyber Center information-sharing initiatives and cooperate with statewide assessments, and requires a designated primary cybersecurity point of contact (covered in detail below).

You can read the law yourself; the cybersecurity sections are short. The enrolled HB 44 (PDF) is hosted here for convenience, and the Utah Legislature's HB 44 page is the primary source.

This guide uses the enacted HB 44 provisions and their Utah Code citations. Earlier materials may refer to HB 42; check the bill version and enacted text before treating a reference as a current requirement.

Use HB 44 and Utah Code 53G-8-901 through 903 when checking requirements or briefing leadership. If a document refers to HB 42, confirm which provisions and version it means.

Just as important as what the law requires is what it leaves open. HB 44 does not contain a list of specific technical controls, and it does not set a single compliance deadline. Both are delegated to the Cybersecurity Commission, which writes the actual standards through administrative rulemaking, including a phased implementation timeline based on LEA size, existing cybersecurity infrastructure, and available resources.

The topic areas in the statute provide a useful structure for reviewing current controls and responsibilities. Use that review to plan the work, then check it against the actual rules and implementation guidance.

Section 63C-27-202(9)(d) lists the areas the minimum standards must address, as appropriate to each LEA's size, risk profile, and resources:

• Identity and access management
• Asset management and inventory of hardware, software, and data systems
• Data protection
• Security monitoring and logging capabilities
• Vulnerability management, including regular security assessments and patching procedures
• Incident response and recovery planning
• Security awareness training requirements for staff and administrators
• Third-party risk management for vendors with access to LEA systems or data
• Network security controls
• Backup and disaster recovery procedures
• Governance structures for cybersecurity oversight within an LEA

Security awareness training for staff and administrators is an explicit statutory topic. The standards and implementation guidance determine the specific requirements; the topic list alone does not prescribe a training product or frequency.

HB 44 directs UETN, the Utah Cyber Center, and the state board to coordinate guidance, technical assistance, services, and information sharing. Contact them before purchasing to confirm the resources available to your LEA, including scope, eligibility, and any cost.

Record what the available services cover, then identify any remaining needs. For awareness work, the following questions can help organize that review:

These are planning questions, not additional statutory requirements. Check available state support and the applicable standards before choosing a program or tool.

Use this checklist to review the statute's topic areas, assign owners, and prepare questions for state contacts. Check the results against current rules and guidance; completing the checklist does not establish compliance. Download the PDF if a printable copy helps your team.

Section 53G-8-903 is the part of HB 44 most likely to matter on a bad day, so it is worth knowing cold. Here is the workflow the statute describes:

Separately, every LEA must designate a primary point of contact for cybersecurity matters who interfaces with the Cyber Center, the state board, and UETN. Smaller districts and charters should note that a regional education service agency may serve as the designated contact for multiple LEAs in its service area. If it does, the agency coordinates with the Cyber Center, the state board, and UETN for the participating LEAs, ensures each one meets the minimum cybersecurity standards, and keeps records of the services provided to each LEA.

The immediate takeaway: a 24-hour notification clock is short. The time to wire breach reporting into your incident response plan (who calls whom, with what information, verified against current contacts) is before an incident, ideally rehearsed in a tabletop exercise.

Harborcoat helps districts clarify priorities, compare technology, arrange purchasing, and coordinate qualified specialists where implementation is needed. Bring your current controls, state guidance, and open questions so we can discuss a useful scope. Technical implementation and assessment responsibilities belong to the providers named in the engagement.

Harborcoat has commercial relationships with some vendors it recommends. Ask us to explain any relationship relevant to your evaluation. Purchasing options and specialist delivery depend on your requirements, eligibility, and agreed scope.