SB1363 104TH GENERAL ASSEMBLY

LRB104 06502 BDA 16538 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB1363

Introduced 1/28/2025, by Sen. Sally J. Turner

SYNOPSIS AS INTRODUCED:

5 ILCS 430/5-10.10 new

Amends the State Officials and Employees Ethics Act. Requires each officer, member, and employee to complete, at least annually, a cybersecurity training program, with certain requirements. Requires each ultimate jurisdictional authority to submit to the applicable Ethics Commission, at least annually, a report regarding that training, with certain requirements.

A BILL FOR

AN ACT concerning government.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 5. The State Officials and Employees Ethics Act is amended by adding Section 5-10.10 as follows:

(5 ILCS 430/5-10.10 new)

Sec. 5-10.10. Cybersecurity training.

(a) Each officer, member, and employee must complete, at least annually, a cybersecurity training program. A person who fills a vacancy in an elective or appointed position that requires training under this Section must complete the initial cybersecurity training program within 30 days after commencement of office or employment. The training shall include, at a minimum, information concerning: (i) the types of cybersecurity threats, including malware, phishing, social engineering, and ransomware; (ii) the creation of strong passwords and the proper use of passwords and multi-factor authentication; (iii) the applicability of data privacy regulations and best practices for proper data handling, and secure file sharing; (iv) the recognition and avoidance of suspicious links, attachments, and unsafe websites; and (v) the actions that should be taken to secure personal and government devices and report lost or stolen devices. Proof of completion of the training required under this Section must be submitted to the applicable ethics officer. Cybersecurity training programs shall be overseen by the appropriate Ethics Commission and Inspector General appointed under this Act.

(b) Each ultimate jurisdictional authority shall submit to the applicable Ethics Commission, at least annually, or more frequently as required by that Commission, a report that summarizes the cybersecurity training program that was completed during the previous year, and lays out the plan for the training program in the coming year. The report shall include the names of individuals that failed to complete the required training program. An Ethics Commission shall not make the reports available on its website.