Relating to the continuation and functions of the Department of Information Resources, including the composition of the governing body of the department and, in collaboration with the comptroller, the administration of state assistance opportunities.

Contracts

• Grant & Loan Agreements: If your organization receives state assistance (grants, loans, cooperative agreements), expect new standardized terms and reporting requirements to align with the Comptroller's new centralized database.
• Penetration Testing: Security vendors should prepare for new solicitation vehicles. The law mandates state agencies undergo penetration testing every two years by a "vendor selected by the department," likely signaling a move toward a statewide Master Service Agreement (MSA) or IDIQ contract for these services.

Hiring/Training

• Local Government Access: The law explicitly authorizes local governments to deny system access to contractors who have not completed certified cybersecurity training. You must integrate this training into onboarding for any staff assigned to municipal or county accounts to prevent service stoppages.
• Sales Team Training: Business development teams must be retrained to utilize the upcoming "State Assistance Opportunity" portal, which will aggregate opportunities previously scattered across various agency websites.

Reporting & Record-Keeping

• Professional License Profiles: If you or your employees hold state licenses (e.g., CPA, Medical, Engineering, Trades), you must update your public profile with the licensing entity. You are required to disclose:
• 1. Availability of language translation services for the deaf or hard of hearing.
• 2. Whether your physical location is accessible to persons with disabilities (as defined by federal law).
• Accessibility Documentation (VPATs): State agencies face heightened scrutiny on IT accessibility. Vendors must maintain current Voluntary Product Accessibility Templates (VPATs) to prove compliance with Section 508/ADA standards, as agencies will require this documentation to avoid their own liability.

Fees & Costs

• No Direct Fee Increases: The bill does not impose new statutory fees on business.
• Operational Costs: Expect minor administrative costs associated with cybersecurity training compliance and legal review of accessibility claims.