evidence_text: Representative Steckloff moved to adopt the amendment to HB 4292. The motion prevailed 19- 0-10: FAVORABLE ROLL CALL Yeas: Reps. Witwer, O'Neal, Brixie, Hood, Brabec, Morse, Puri, Steckloff, Weiss, Martus, McKinney, Mentzer, Morgan, Price, Skaggs, Snyder, Wilson, Bollin, Steele. Nays: None. Pass: Reps. Lightner, Green, Slagh, Beson, Borton, Fink, Cavitt, DeBoer, Kuhn, Schuette. Representative Brabec offered the following amendments to HB 4292: 1. Amend page 2, line 17, after "revenues" by striking out "734,800" and inserting "749,800". 2. Amend page 2, line 18, after "revenues" by striking out "2,633,421,600" and inserting "2,633,406,600". 3. Amend page 10, line 16, after "commission" by striking out "100" and inserting "1,000,000".and adjusting the subtotals, totals, and section 201 accordingly. 4. Amend page 17, line 26, after "22-2" by striking out "5,000,000" and inserting "15,000,000".and adjusting the subtotals, totals, and section 201 accordingly. 5. Amend page 23, following line 13, by inserting: Security scorecard 100 and adjusting the subtotals, totals, and section 201 accordingly. 6. Amend page 33, line 5, after "is" by striking out "$3,806,570,400.00" and inserting "$3,806,555,400.00". 7. Amend page 52, line 23, after "year" by striking out the balance of the line through "following" on line 24. 8. Amend page 96, following line 2, by inserting: "ONE-TIME APPROPRIATIONS Sec. 890. (1) Funds appropriated in part 1 for security scorecard shall be used to improve the cybersecurity posture and expand the vulnerability monitoring of the executive departments and agencies and their vendor ecosystems to reduce the risk of cybersecurity breaches. Effective October 1, 2023, the MDTMB shall contract with a vendor to provide software that provides comprehensive cybersecurity vulnerability information about companies with which the executive departments and agencies do business. The selected vendor must be able to provide the MDTMB and the executive departments and agencies with all of the following: (a) Data, on both individual vendors and vendor ecosystems, that are updated daily and available to the public. (b) The ability to create cybersecurity questionnaires to send to this state's vendor ecosystems. (c) The ability to track cyber threat actors within this state’s vendor ecosystems and analyze how these actors may affect the executive departments and agencies. (d) The ability for this state and its executive agencies to make supply chain predictions, including identifying suppliers, vendors, and products that this state's vendor ecosystems will need in the future, to avoid supply chain disruptions. (e) Documentation outlining that the selected software vendor has demonstrated the ability to achieve the “Ready” stage of the FedRamp certification process. (f) Technology that is available for use by all state executive agencies. (2) The MDTMB must be able to gather all of the metrics described below from the software: (a) Number of vendors monitored in a vendor ecosystem. (b) Most common cybersecurity vulnerabilities in a vendor ecosystem. (c) Most critical vulnerabilities in a vendor ecosystem. (d) Top and bottom vendors in a vendor ecosystem. (e) Ransomware analytics surrounding a vendor ecosystem or specific vendors.".