The civic record
Read. Follow. Verify.North Carolina appropriates $25 million annually for cybersecurity and $3.8 million for health data integration
Last action · June 26, 2025: Ref To Com On Rules and Operations of the Senate (Senate action)Sponsors: Jake Johnson and 14 others
Track this bill to get notified when it advances a stage. One tap to stop, anytime.
What This Bill Would Do
North Carolina appropriates up to $25 million each of the 2025-2027 biennium from the to the Department of Information Technology for state cybersecurity projects, standards compliance, and agency incident response reviews. The bill also appropriates $3.8 million annually for the system, restructures the North Carolina Longitudinal Data System under the Department of Public Instruction, and requires a comprehensive statewide assessment of IT spending by October 1, 2026.
State agencies face mandatory compliance reviews for cybersecurity standards and must submit data for IT spending duplication assessments, while the Department of Information Technology gains centralized oversight authority over state agency digital infrastructure and funding allocations.
Who It Would Affect
Groups the bill's text would affect if enacted, as described in the record. Being affected is not a position for or against it.
State agencies
State agencies must comply with enterprise-wide cybersecurity standards, undergo IT spending duplication assessments, provide requested data, and implement IT-specific fund codes within their existing budget codes.
Department of Information Technology
The Department receives appropriations for cybersecurity and NC HealthConnex, leads statewide cybersecurity efforts, selects a third-party vendor for an IT spending assessment, and submits reports to the General Assembly.
Students and educational institutions
Student and workforce data from public schools, community colleges, and universities are integrated into the North Carolina Longitudinal Data System under strict de-identification and privacy rules.
Key Facts
- The Department of Information Technology may use up to $25 million each fiscal year of the 2025-2027 biennium from the Information Technology Reserve for cybersecurity projects and agency compliance monitoring.
- The Department of Information Technology may use up to $3.8 million each fiscal year of the 2025-2027 biennium to support the further development and integration of the NC HealthConnex system.
- During the 2025-2026 fiscal year, the Department must select a third-party vendor to conduct a comprehensive assessment of enterprise IT spending across all state agencies to identify duplication.
- The Department must submit a detailed report on IT spending duplication, cost-saving recommendations, and consolidation strategies to legislative overseers and the State Auditor on or before October 1, 2026.
Show all 9 facts
- The Office of State Budget and Management and the Office of the State Controller must establish IT-specific fund codes within each state agency's budget codes no later than December 1, 2025.
- The State CIO must annually assess the ability of each state agency and its contracted vendors to comply with enterprise-wide cybersecurity standards.
- The North Carolina Longitudinal Data System is established administratively within the Department of Public Instruction to manage student and workforce data while restricting direct access and requiring de-identified data.
- Individual or personally identifiable data accessed through the Longitudinal Data System is explicitly declared not to be a public record under G.S. 132-1.
- The State CIO must submit an implementation plan for IT fund codes to legislative committees on or before September 1, 2026.
Frequently Asked Questions
How much funding is allocated for cybersecurity enhancements?
What is the purpose of the North Carolina Longitudinal Data System?
When is the report on IT spending duplication due?
What else do you want to know?
News Coverage
Follow the record
Votes, people, money & the original sourceWhere This Stands
Currently passed chamber. The next step in the legislative lifecycle is Law.
Procedural history
16 actions- Jun 26, 2025SenateRef To Com On Rules and Operations of the Senate
- Jun 26, 2025SenatePassed 1st Reading
- Jun 26, 2025SenateSpecial Message Received From House
- Jun 26, 2025HouseSpecial Message Sent To Senate
- Jun 25, 2025HouseOrdered Engrossed
- Jun 25, 2025HousePassed 3rd Reading
Show 10 earlier actions
- Jun 25, 2025HousePassed 2nd Reading
- Jun 25, 2025HouseAmend Adopted A1
- Jun 24, 2025HousePlaced On Cal For 06/25/2025
- Jun 24, 2025HouseCal Pursuant Rule 36(b)
- Jun 24, 2025HouseReptd Fav Com Substitute
- Jun 23, 2025HouseRe-ref Com On Rules, Calendar, and Operations of the House
- Jun 23, 2025HouseWithdrawn From Com
- Apr 9, 2025HouseRef to the Com on Appropriations, if favorable, Rules, Calendar, and Operations of the House
- Apr 9, 2025HousePassed 1st Reading
- Apr 7, 2025HouseIntroducedFiled
Version history
Only one version on file - nothing to compare yet. As later stages (committee substitute, engrossed, enrolled) are captured, the redline appears here.
View official text →Lobbying Activity
No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.
Full breakdown
Who this bill affects and the strongest case for and against it, written only from the bill’s own text.
Sponsors
Show 10 more sponsors
Discoveries
Patterns POLISCOPE noticed across the record. These are observations to investigate, not conclusions.
Centralized State Cybersecurity Oversight
The General Assembly explicitly shifts state cybersecurity management from fragmentary individual agency handling to comprehensive leadership by the Department of Information Technology.
Connected Entities
Sources
www.ncleg.gov
Analysis Score
0–100- Significance85How much this matters to a regular citizen
- Controversy15Intensity of disagreement among stakeholders
- Entertainment5Compellingness for a non-policy-wonk reader
- Buzz30Current news / social attention level
Publisher tools