ORS 276A.342
State agencies prohibited from using covered products

  • risk mitigation
  • exceptions

(1)

A covered product may not be:

(a)

Installed or downloaded onto a state information technology asset; or

(b)

Used or accessed by a state information technology asset.

(2)

A state agency shall:

(a)

Remove any covered product that is installed or downloaded onto a state information technology asset that is under the management or control of the state agency; and

(b)

Implement all measures necessary to prevent the:

(A)

Installation or download of a covered product onto a state information technology asset that is under the management or control of the state agency; or

(B)

Use or access of a covered product by a state information technology asset that is under the management or control of the state agency.

(3)

Intentionally left blank —Ed.

(a)

Notwithstanding subsections (1) and (2) of this section, a state agency may, for investigatory, regulatory or law enforcement purposes, permit the:

(A)

Installation or download of a covered product onto a state information technology asset; or

(B)

Use or access of a covered product by a state information technology asset.

(b)

A state agency that permits the installation, download, use or access of a covered product under this subsection shall adopt risk mitigation standards and procedures related to the installation, download, use or access of the covered product.

(4)

The State Chief Information Officer shall coordinate with and oversee state agencies to implement the provisions of this section in accordance with the policies and standards adopted under ORS 276A.344 (Policies and standards) (3). [2023 c.256 §2]

Source: Section 276A.342 — State agencies prohibited from using covered products; risk mitigation; exceptions, https://www.­oregonlegislature.­gov/bills_laws/ors/ors276A.­html (accessed May 26, 2025).

276A.200
Legislative findings on information resources 276A.203
State Chief Information Officer 276A.206
Oversight of state information and telecommunications technology by State Chief Information Officer 276A.209
State Information Technology Operating Fund 276A.223
Requirement that state agency or public corporation obtain quality management services when implementing information technology initiative 276A.230
Definitions 276A.233
Information technology portfolio-based management 276A.236
Enterprise information resources management 276A.239
Portfolio-based management of information technology resources for Secretary of State 276A.242
Portfolio-based management of information technology resources for State Treasurer 276A.250
Definitions 276A.253
Oregon transparency website 276A.256
Reports of tax expenditures connected to economic development 276A.259
Transparency Oregon Advisory Commission 276A.262
Transparency Oregon Advisory Commission Fund 276A.270
Definitions 276A.273
Electronic Government Portal Advisory Board 276A.276
Ability to offer government services through portal 276A.300
Information systems security in executive department 276A.303
Information systems security for Secretary of State, State Treasurer and Attorney General 276A.306
Information security incidents and assessments 276A.323
State agency coordination 276A.332
Authority of State Chief Information Officer to enter into agreements 276A.335
Moneys from federal government and other sources 276A.340
Definitions 276A.342
State agencies prohibited from using covered products 276A.344
Policies and standards 276A.346
Secretary of State prohibited from using covered products 276A.348
State Treasurer prohibited from using covered products 276A.350
Definitions 276A.353
Chief Data Officer 276A.356
Open data standard 276A.359
Technical standards manual 276A.362
Release of publishable data on web portal 276A.365
Information management by state agencies 276A.368
Purpose of data 276A.371
Obligations of state agency under public records law 276A.374
Application to Secretary of State and State Treasurer 276A.400
Policy 276A.403
Coordination of telecommunications systems 276A.406
Acquisition of broadband and communications services 276A.409
Use of agency travel and transportation funds for telecommunications services 276A.412
Contracts for telecommunications equipment and services not to exceed 10 years 276A.415
Agreements to fund or acquire telecommunications equipment and services 276A.418
Public contracts for broadband Internet access service 276A.421
Provision of broadband services that compete with services of private telecommunications provider 276A.424
Connecting Oregon Schools Fund 276A.500
Definitions 276A.503
Oregon Geographic Information Council 276A.506
Powers of council 276A.509
Public body duty to share geospatial framework data with council 276A.512
Oregon Geographic Information Council Fund 276A.515
State geographic information officer 276A.550
Definitions 276A.555
Oregon Cybersecurity Center of Excellence 276A.560
Oregon Cybersecurity Advisory Council 276A.565
Oregon Cybersecurity Center of Excellence Operating Fund 276A.570
Oregon Cybersecurity Workforce Development Fund 276A.575
Oregon Cybersecurity Grant Program Fund

Current through early 2026

§ 276A.342. State agencies prohibited from using covered products's source at oregon​.gov