4-115.

Critical infrastructure; contract with foreign principal; restrictions, when.

(1) For purposes of this section:

(a) Company means a for-profit sole proprietorship, organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, or limited liability company, including a wholly owned subsidiary, majority owned subsidiary, parent company, or affiliate of those entities or business associations that exists to make a profit;

(b) Critical infrastructure means the 911 system, a communication infrastructure system, a cybersecurity system, a high voltage electric grid, a hazardous waste treatment system, or a water treatment facility;

(c) Cybersecurity means the measures taken to protect a computer, computer network, computer system, or other technology infrastructure against unauthorized use or access;

(d) Foreign adversary means those countries listed in 15 C.F.R. 791.4, as such regulation existed on January 1, 2026;

(e) Foreign principal means:

(i) The government or any official of the government of a foreign adversary;

(ii) A political party of a foreign adversary or a member of such political party or any subdivision of such political party;

(iii)(A) A partnership, an association, a corporation, an organization, or any other combination of persons organized under the laws of or having its principal place of business in a foreign adversary;

(B) A subsidiary of an entity described in subdivision (1)(e)(iii)(A) of this section; or

(C) An entity owned or controlled wholly or in part by any person, entity, or collection of persons or entities described in subdivision (1)(e)(iii)(A) or (B) of this section;

(iv) Any person who is domiciled in a foreign adversary and is not a citizen or lawful permanent resident of the United States; and

(v) Any person, entity, or collection of persons or entities described in subdivisions (1)(e)(i) through (iv) of this section having a controlling interest in a partnership, association, corporation, organization, trust, or any other legal entity or subsidiary formed for the purpose of owning real property; and

(f) Governmental entity means any agency, department, board, commission, or political subdivision of the state that owns, operates, manages, or provides oversight for critical infrastructure.

(2)(a) A company or other entity constructing, repairing, operating, or otherwise having significant access to critical infrastructure shall not knowingly enter into a contract or other agreement relating to critical infrastructure in this state with a foreign principal if the contract or other agreement would allow the foreign principal to directly or remotely access or control critical infrastructure in this state.

(b) A governmental entity shall not knowingly enter into a contract or other agreement relating to critical infrastructure in this state with a company that is a foreign principal if the contract or other agreement would allow the foreign principal to directly or remotely access or control critical infrastructure in this state.

(c) Notwithstanding subdivisions (2)(a) and (b) of this section, a company or other entity may enter into a contract or agreement relating to critical infrastructure with a foreign principal if all of the following apply:

(i) There is no other reasonable option for addressing the need relevant to state critical infrastructure; and

(ii) Not entering into such contract or agreement would pose a greater threat to the state than the threat associated with entering into the contract.