SF 2200 (LSB 6720XS (2) 91)

SENATE FILE 2200

BY  GREEN

A BILL FOR

An Act relating to school email security by requiring school districts, charter schools, and area education agencies to implement certain email security standards.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 256E.7, subsection 2, Code 2026, is amended by adding the following new paragraph:
   NEW PARAGRAPH.  0n.  Be subject to and comply with the requirements of section 279.89 relating to student email security standards in the same manner as a school district.
    Sec. 2.  Section 256F.4, subsection 2, Code 2026, is amended by adding the following new paragraph:
   NEW PARAGRAPH.  v.  Be subject to and comply with the requirements of section 279.89 relating to student email security standards in the same manner as a school district.
    Sec. 3.  Section 273.3, Code 2026, is amended by adding the following new subsection:
   NEW SUBSECTION.  27.  Be subject to and comply with the requirements of section 279.89 relating to student email security standards.
    Sec. 4.  NEW SECTION.  279.89  Student email security standards.
   1.  As used in this section, unless the context requires otherwise:
   a.  “Advanced threat detection” means the use of machine learning, behavioral analysis, and sandboxing to prevent delivery of malicious attachments, embedded links, and zero-day threats.
   b.  “Data loss prevention” means the automatic inspection of email content and attachments to prevent unauthorized transmission of personally identifiable information, protected health information, student education records, or confidential internal communications.
   c.  “Email security solution” means any cloud-based, on-premises, or hybrid system that provides protective filtering, threat detection, policy enforcement, logging, and user-level controls for inbound and outbound email traffic.
   d.  “Encryption enforcement” means the capability to automatically apply encryption policies to outbound messages containing sensitive data.
   e.  “Impersonation protection” means the ability to detect and block spoofed senders, lookalike domains, and unauthorized attempts to pose as internal users or third-party vendors.
   2.  By January 1, 2027, the board of directors of each school district shall implement an email security solution that meets all of the following requirements:
   a.  Inbound and outbound filtering of email traffic for spam, malware, phishing, ransomware, and advanced persistent threats.
   b.  Artificial intelligence-driven threat detection, including behavioral analysis, sandbox execution, and real-time analysis of embedded uniform resource locators and attachments.
   c.  Full-spectrum impersonation protection, including domain and display name spoofing defense, user impersonation alerts, and forged sender blocking.
   d.  Data loss prevention policies capable of scanning subject lines, body content, and attachments for personally identifiable information, protected health information, and student records, and triggering block, quarantine, or encryption workflows as appropriate.
   e.  Policy-based encryption of outbound email traffic containing protected or confidential content.
   f.  Quarantine and end-user self-service portals, enabling safe engagement and reducing administrative burden.
   g.  Directory service integration to enable role-based policy application and user-level visibility.
   h.  Comprehensive logging, alerting, and forensic analysis, including the ability to correlate threats across users and time, and generate detailed reporting for compliance purposes.
   i.  Support for integration with productivity platforms without dependence on their native filtering features.
   3.  A school district shall be considered noncompliant if the email security platform or vendor used by the district or agency does not meet the requirements of this section in full.
    Sec. 5.  STATE MANDATE FUNDING SPECIFIED.  In accordance with section 25B.2, subsection 3, the state cost of requiring compliance with any state mandate included in this Act shall be paid by a school district from state school foundation aid received by the school district under section 257.16 and by an area education agency from state school foundation aid received by the area education agency under section 257.35. This specification of the payment of the state cost shall be deemed to meet all of the state funding-related requirements of section 25B.2, subsection 3, and no additional state funding shall be necessary for the full implementation of this Act by and enforcement of this Act against all affected school districts and area education agencies.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to student email security, including requiring school districts, charter schools, and area education agencies to implement certain email security standards.
   The bill requires school districts, charter schools, and area education agencies to implement student email security solutions by January 1, 2027. The solutions must include inbound and outbound email filtering for spam, malware, phishing, ransomware, and advanced threats; artificial intelligence-driven threat detection; full-spectrum impersonation protection; data loss prevention scanning for personally identifiable information, protected health information, and student records; policy-based encryption of sensitive outbound emails; quarantine and end-user self-service portals; directory service integration; comprehensive logging and reporting; and support for integration with productivity platforms. A school district, charter school, or area education agency is noncompliant if its email security solution does not meet the requirements of the bill.
   The bill may include a state mandate as defined in Code section 25B.3. The bill requires that the state cost of any state mandate included in the bill be paid by a school district from state school foundation aid received by the school district under Code section 257.16 and by an area education agency from state school foundation aid received by the area education agency under Code section 257.35. The specification is deemed to constitute state compliance with any state mandate funding-related requirements of Code section 25B.2. The inclusion of this specification is intended to reinstate the requirement of school districts and area education agencies to comply with any state mandates included in the bill.