Provides for reimbursement to the state for cyber reinforcement support provided to noncompliant recipients. (8/1/26) (EG SEE FISC NOTE SG RV)

Senate Bill 75 amends Louisiana Revised Statutes 29:726(E) by adding a new subsection that grants the Governor's Office of Homeland Security and Emergency Preparedness authority to promulgate administrative rules establishing cybersecurity standards for local governmental subdivisions and political subdivisions seeking state assistance following a cybersecurity incident. The rules must comply with the Administrative Procedures Act and shall establish at minimum technical management practice standards aligned with national cybersecurity standards, as well as eligibility requirements for receiving state assistance. The statute explicitly permits GOHSEP to continue providing services to noncompliant jurisdictions despite their failure to meet the promulgated standards. The bill allows GOHSEP to employ emergency rulemaking procedures for adoption of the initial rules authorized under this provision.

Local governmental subdivisions and political subdivisions that have experienced cybersecurity incidents will be directly affected by this legislation. Jurisdictions that comply with the cybersecurity standards established by GOHSEP will remain eligible to receive state assistance without financial obligation beyond normal state aid mechanisms. However, local governments and political subdivisions that do not comply with the promulgated cybersecurity standards will face financial consequences if they seek and receive state cyber reinforcement support, as they will be required to reimburse the state for all costs associated with services provided to them. This cost-reimbursement requirement creates a financial incentive structure designed to encourage local compliance with statewide cybersecurity standards while preserving GOHSEP's ability to provide emergency assistance regardless of a jurisdiction's prior compliance status.

The statute operates within the existing framework of R.S. 29:726, which establishes the authority and responsibilities of the Governor's Office of Homeland Security and Emergency Preparedness within the state emergency management and homeland security system. The new provision integrates cybersecurity incident response into GOHSEP's existing portfolio of emergency preparedness functions and requires rulemaking adherence to the Administrative Procedures Act provisions governing state agency rulemaking. The authorization for emergency rulemaking under subsection (c) invokes the expedited procedures typically available for rules addressing urgent circumstances, allowing GOHSEP to implement initial cybersecurity standards more rapidly than traditional notice-and-comment rulemaking would permit. The measure becomes effective on August 1, 2026.