Noncompliance with cybersecurity requirements by state agencies; penalty

(a) On July 1, 2028, and each year thereafter, the director of the budget, in consultation with the legislative, executive and judicial chief information technology officers as appropriate, shall determine if each state agency is in compliance with the provisions of this act* for the previous fiscal year. If the director of the budget determines that a state agency is not in compliance with the provisions of this act for such fiscal year, the director shall certify an amount equal to 5% of the amount: (1) Appropriated and reappropriated from the state general fund for such state agency for such fiscal year; and (2) credited to and available in each special revenue fund for such state agency in such fiscal year. If during any fiscal year, a special revenue fund has no expenditure limitation, then an expenditure limitation shall be established for such fiscal year on such special revenue fund by the director of the budget in an amount that is 5% less than the amount of moneys credited to and available in such special revenue fund for such fiscal year. (b) The director of the budget shall submit a detailed written report to the legislature on or before the first day of the regular session of the legislature concerning such compliance determinations, including factors considered by the director when making such determination, and the amounts certified for each state agency for such fiscal year. (c) During the regular session of the legislature, the senate committee on ways and means and the house of representatives committee on appropriations shall consider such compliance determinations and whether to lapse amounts appropriated and reappropriated and decrease the expenditure limitations of special revenue funds for such state agencies during the budget committee hearings for such noncomplying agency. (d) This section shall expire on July 1, 2026.