State Cybersecurity Mandates: What's Changing and What to Do
Many compliance leads hear about a new state cybersecurity mandate secondhand. A colleague forwards an article, and suddenly there’s a statute with an effective date and a training requirement that someone in the organization now owns.
States are writing cybersecurity requirements into law on their own schedules. Berkeley’s Center for Long-Term Cybersecurity found that lawmakers in 37 states passed 99 cybersecurity-related bills in 2025.
Ohio now requires counties, townships, municipalities, and other local governments to adopt a cybersecurity program that can include employee training. New York requires annual awareness training for state and local government employees starting Jan. 1, 2026. Texas added annual AI training to its public-employee training mandate in September 2025.
This guide covers what state cybersecurity mandates usually require, which states have cybersecurity training requirements, and which records show who trained and when.
This article is general information, not legal advice. Laws change, so confirm current requirements with your counsel before you act.
States are filling the gaps federal law leaves
Federal training requirements follow sectors rather than applying to every employer.
- The HIPAA Security Rule requires a security awareness and training program for the workforce of covered entities and business associates (45 CFR 164.308(a)(5)).
- The FTC Safeguards Rule requires security awareness training for personnel of covered financial institutions (16 CFR 314.4(e)(1)).
- For federal agencies, FISMA requires agency security programs to include awareness training (44 U.S.C. 3554(b)(4)).
- OPM’s rule requires that all users of federal information systems, including contractors, see security awareness materials at least annually (5 CFR 930.301).
Outside those lines, states fill the gap. State laws reach two groups: Public-sector entities, where state and local government cybersecurity requirements apply, and any organization that holds residents’ personal information, no matter where the organization is based.
Local governments tend to feel these mandates first, and coverage varies by statute. Public universities show the range: Some states exclude them, and others treat them as state agencies. Check each law’s definition of who it covers in the table below.
What state cybersecurity laws usually require
The details differ. Many state cybersecurity mandates combine some version of the elements below, and a few add ransom payment rules.
A written program with an owner
Most laws start with governance. For example, Ohio requires each local government’s legislative authority to adopt a cybersecurity program (ORC § 9.64). Massachusetts requires a written information security program and at least one employee to maintain it (201 CMR 17.03).
Baseline controls, often by reference
Many statutes point to a recognized framework instead of listing controls. Ohio and Florida both name the NIST Cybersecurity Framework as a reference point. Massachusetts is more specific for electronic records, such as encrypting personal information sent across public networks.
Incident reporting on a clock
Reporting deadlines vary widely:
- Florida: Local governments report ransomware within 12 hours and severity level 3, 4, or 5 incidents within 48 hours of discovery, then file an after-action report within a week of remediation (Fla. Stat. § 282.3185).
- Texas: State agencies and local governments notify the Texas Cyber Command within 48 hours of discovery, then send details and a cause analysis within 10 business days after recovery (Gov’t Code § 2063.302).
- Ohio: Political subdivisions notify the Division of Homeland Security within 7 days and the Auditor of State within 30 days of discovery (ORC § 9.64(D)).
- New York: Municipalities and public authorities report to the state within 72 hours of reasonably believing an incident occurred (Gen. Mun. Law § 995-b).
Ransom payment rules
Some states now restrict whether and how a public entity can pay a ransom. Florida prohibits payment, Ohio requires formal approval first, and New York requires an explanation afterward.
- Florida: A state agency, county, or municipality experiencing a ransomware incident may not pay or otherwise comply with a ransom demand (Fla. Stat. § 282.3186).
- Ohio: A political subdivision can pay only if its legislative authority approves it in a resolution or ordinance stating why that is in the subdivision’s best interest (ORC § 9.64(B)). The vote must be possible during an active incident, so build the approval process into your incident response plan now.
- New York: A municipality or public authority that pays a ransom must notify the state within 24 hours, then file a written explanation within 30 days covering why payment was necessary and what alternatives it considered (Gen. Mun. Law § 995-c).
These rules apply to public entities. Check your own state’s rule before you plan.
Employee training
The training clause is often the shortest sentence in the statute. It usually answers who must train, how often, and which program qualifies.
Who. Coverage differs by statute. See the “Who it covers” column in the table below.
How often. Annual training is the norm in the public-sector mandates. Ohio scales frequency, duration, and detail to each employee’s duties. Massachusetts says “ongoing” and sets no frequency.
Which program. Several states name the provider. Illinois requires training from its Department of Innovation and Technology, Florida names the Florida Digital Service’s curriculum, and Texas requires state-certified programs.
Ohio treats state-provided and Ohio Persistent Cyber Initiative (O-PCI) training as satisfying its training element, and New York lets local employees use the state’s free training or other cybersecurity awareness training.
These laws put obligations on the organization: Adopt a program, train people, report incidents. Personal liability for individual employees is a different question, which we covered in Business Email Compromise and Employee Liability: What Ohio’s Auditor Actually Said.
What counts as training evidence
State laws rarely spell out documentation. Auditors and state offices ask the same question they pose under HIPAA, SOC 2, and ISO 27001: Can you show the training happened, for the right people, on time? In practice, that means keeping:
- A roster of covered people that matches the law’s definition, including contractors and temporary staff where the law names them.
- Completion records for each person, with dates.
- Proof of new-hire timing where the law sets a window, such as Florida’s 30 days.
- A record of what the training covered, mapped to any topics the law lists. See the “What it says about training” column in the table below for a few details.
- Any required completion report. Texas local governments, for example, use a state form that records the percentage of staff who completed training (§ 2063.103).
- The written program or policy that sets your requirements. For Ohio, keep the legislative authority’s record adopting the program.
Keep this evidence together and dated. When a new state cybersecurity mandate lands, the first question is whether what you already run counts, and a clean record answers it quickly.
Cybersecurity awareness training requirements by state
The table summarizes cybersecurity training requirements in six states, with each row linked to its primary text. It’s a starting point, not a complete list. Open the linked source before relying on any row.
| State | Law (primary text) | Who it covers | What it says about training | Effective/last amended | Last verified |
| Florida | Fla. Stat. § 282.3185(3) (local governments); § 282.318(4)(i) (state agencies) | Counties and municipalities. | Employees with network access complete the Florida Digital Service’s basic training within 30 days of starting and annually. IT professionals and staff with highly sensitive data also complete advanced training. | Enacted 2022 (ch. 2022-220). No later amendments in the 2025 edition. | Oct. 13, 2026 |
| Illinois | 20 ILCS 450/25 (Data Security on State Computers Act) | State employees as the State Officials and Employees Ethics Act defines them. Excludes the legislative and judicial branches, public universities, and constitutional officers other than the Governor. | Annual cybersecurity training from the Department of Innovation and Technology, covering at least phishing scams, spyware and identity theft, and data breach prevention and response. | P.A. 100-40, effective Jan. 1, 2018. | Oct. 13, 2026 |
| Massachusetts | 201 CMR 17.03(2)(b)1. and 17.04(8) | Any person that owns or licenses personal information about a Massachusetts resident. Excludes Commonwealth agencies and political subdivisions (17.02). | The written program must evaluate safeguards, including ongoing training of employees, temporary staff, and contractors. Programs handling electronic records must also train employees on the computer security system. No frequency, provider, or certification is set. | Full compliance required by March 1, 2010 (17.05). | Oct. 13, 2026 |
| New York (public sector) | State Tech. Law § 103-f (S7672A, Ch. 177 of 2025) | State employees, and employees of counties, cities, towns, villages, and General Municipal Law § 119-n districts, who use technology in their duties. | Annual awareness training on paid work time. State employees use the state’s training. Local employees can use the state’s free training or other cybersecurity awareness training. | Ch. 177 of 2025. Training duty began Jan. 1, 2026. | Oct. 13, 2026 |
| New York (private sector) | Gen. Bus. Law § 899-bb(2) (SHIELD Act) | Any business that owns or licenses computerized private information of a New York resident. Small businesses get a scaled standard. | A data security program meets the “reasonable safeguards” duty if it includes administrative safeguards such as training and managing employees in the program’s practices (§ 899-bb(2)(b)(ii)(A)(4)). No frequency, provider, or certification is set. | Data security requirements effective March 21, 2020. Current revision on the NY Senate site dated March 27, 2020. | Oct. 13, 2026 |
| New York (financial services) | 23 NYCRR § 500.14(a)(3) (NYDFS Cybersecurity Regulation) | Entities covered by the NYDFS Cybersecurity Regulation. | At least annual cybersecurity awareness training that includes social engineering, for all personnel, updated to reflect risks in the entity’s risk assessment. | Amended Nov. 1, 2023. Compliance date for this provision April 29, 2024. | Oct. 13, 2026 |
| Ohio | ORC § 9.64 (HB 96) | Political subdivisions: Counties, townships, municipal corporations, and other local bodies. Auditor of State guidance also treats school districts as covered. | The legislative authority must adopt a cybersecurity program. The program may include training requirements for all employees, scaled to their duties. Annual state-provided training and the O-PCI satisfy that element. | Effective Sept. 30, 2025. Bulletin 2025-007: Programs due Jan. 1, 2026 (counties, cities) and July 1, 2026 (others). | Oct. 13, 2026 |
| Texas | Gov’t Code § 2063.103 and § 2063.102 | State agencies, which include public universities, and local governments. Under § 2063.103, officials and employees with access to information resources. Under the HB 3512 text of § 2054.5191, those who use a computer for at least 25% of their duties. School districts: Only the cybersecurity coordinator (Educ. Code § 11.175(h-1)). | Annual state-certified cybersecurity training. Local governing bodies select the program, verify and report completion, and require periodic audits. The HB 3512 text adds annual AI training. | HB 150 and HB 3512, both effective Sept. 1, 2025. Earlier history: HB 3834 (2019), HB 1118 (2021). Both versions appear in the current code. | Oct. 13, 2026 |
State cybersecurity compliance checklist: Readiness for the next state law
More states will add mandates. A short, repeatable routine makes each new one easier to assess.
- Name an owner. Decide who tracks state legislation and who decides whether a new law applies to your organization. Often compliance teams track regulatory change, and IT or security carries it out. Write both names down.
- Map the laws that apply. Data security laws follow residents’ personal information, so an organization based elsewhere can still be covered.
- Compare your training evidence to the strictest rule. Line up current records against each applicable law: Who is covered, how often, how soon after hiring, and which topics. Missing records are often the quickest gap to close.
- Set a re-check date. Put a recurring review on the calendar after each legislative session in the states where you operate and re-verify any row in the table above that you rely on.
Turning training into evidence
NINJIO helps you produce the training evidence these laws ask for. NINJIO builds its short, story-driven episodes on real attacks, and reporting by learner and completion date gives your compliance team dated records it can hand to an auditor or a state office.
Where a state names its own provider or a certified list, use an approved program for that requirement. Plan the program and start with the CISO’s Guide to Cybersecurity Awareness Training.
Frequently Asked Questions
Many states do, but the source of the requirement differs. Many explicit mandates cover public employees, often annually and often through a state-provided or state-certified program.
Some states instead require public entities to adopt a cybersecurity program that may include training. Others expect it indirectly from private organizations. (See the next question.) Coverage, frequency, and which programs count vary by state, so check your state’s primary text.
Yes, but there’s no single standard, and for private organizations the requirement is usually indirect. Data security laws typically require a security program or “reasonable safeguards” that include employee training. Regulated sectors, such as financial services and insurance, add their own rules.
Because coverage depends on your industry and whose data you hold, check each state where you operate or hold residents’ personal information.
Expect to show who was required to train, who completed it and when, what the training covered, and any completion report the law requires. If the law covers temporary or contract staff, their records count, too.
Follow the readiness checklist above: Name an owner, map the laws that apply, compare your training evidence, and set a re-check date.
No. State requirements apply alongside federal rules and industry frameworks. One well-documented program can often support several at once, as long as your records show the coverage, timing, and content each one asks for. See our guides to HIPAA, SOC 2 Type II, and ISO 27001.
Ohio requires local governments to adopt a cybersecurity program (ORC § 9.64), and employee training is one of the elements it may include, scaled to each employee’s duties. Annual state-provided and O-PCI training satisfies that element. Auditor of State guidance also treats school districts as covered. The law doesn’t cover private employers.
Yes, for state agencies (which include public universities) and local governments. Under Tex. Gov’t Code ch. 2063, officials and employees with access to a governmental entity’s information resources must complete a state-certified cybersecurity training program each year. A 2025 amendment to § 2054.5191 uses a 25%-of-duties threshold and adds annual AI training. Both versions appear in the current code, so plan for both and confirm scope with counsel.
School districts differ: Under Education Code § 11.175(h-1), only the district’s cybersecurity coordinator must complete the annual training.
Yes, for counties, municipalities, and state agencies. Under Fla. Stat. § 282.3185(3), county and municipal employees with network access must complete the Florida Digital Service’s basic training within 30 days of starting and annually after that. Technology professionals and staff with highly sensitive data must also complete advanced training. State agency employees have a parallel requirement under § 282.318(4)(i). These sections don’t cover private employers.
Yes, for state employees. 20 ILCS 450/25 requires covered employees to complete cybersecurity training from the Department of Innovation and Technology every year, covering at least phishing scams, spyware and identity theft, and data breach prevention and response. It excludes the legislative and judicial branches, public university employees, and constitutional officers other than the Governor. It doesn’t cover private employers.
Yes, under three separate rules. For public employees, State Technology Law § 103-f requires annual cybersecurity awareness training from Jan. 1, 2026, for state employees and for employees of counties, cities, towns, villages, and districts who use technology in their duties. Local employees can use the state’s free training or other cybersecurity awareness training.
For private businesses, the SHIELD Act names training and managing employees among the administrative safeguards of a reasonable security program, with a scaled standard for small businesses.
For financial services firms, 23 NYCRR 500.14(a)(3) requires at least annual awareness training that includes social engineering for all personnel.
Yes, for private organizations that hold Massachusetts residents’ personal information, though through a risk-based program rather than a standalone mandate. Under 201 CMR 17.03(2)(b)1., the required written security program must evaluate safeguards, including ongoing training for employees, temporary staff, and contractors.
Under 17.04(8), programs that store or transmit personal information electronically must also include employee education and training on the computer security system. The regulation sets no frequency, provider, or certification. It excludes Commonwealth agencies and political subdivisions.
