AN ACT to prohibit contracts or other agreements that would grant certain FOREIGN‑owned companies access to critical infrastructure in this state and to require criminal history record checks for individuals granted access to critical infrastructure in this state.

The General Assembly of North Carolina enacts:

PROHIBIT ACCESS TO CRITICAL INFRASTRUCTURE IN THIS STATE BY CERTAIN FOREIGN‑OWNED COMPANIES

SECTION 1.(a)  Chapter 64 of the General Statutes is amended by adding a new Article to read:

Article 4.

Prohibit Adversarial Foreign Control of Critical Infrastructure.

§ 64‑60.  Title.

This Article may be cited as the Infrastructure Protection Act.

§ 64‑61.  Definitions.

The following definitions apply in this Article:

(1)        Company. – A sole proprietorship, organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, or limited liability company, including a wholly owned subsidiary, majority‑owned subsidiary, parent company, or affiliate of those entities or business associations, that exists to make a profit.

(2)        Critical infrastructure. – A communication infrastructure system, cybersecurity system, electric grid, hazardous waste treatment system, or water treatment facility.

(3)        Cybersecurity. – The measures taken to protect a computer, computer network, computer system, or other technology infrastructure against unauthorized use or access.

(4)        Designated country. – A country designated by the Council of State as a threat to critical infrastructure under this Article.

(5)        Governmental entity. – Any State agency, institution, board, commission, bureau, council, department, division, officer, or political subdivision. The term includes counties, municipal corporations, county or city boards of education, and other local public bodies. The term includes any other entity for which the State has oversight responsibility.

§ 64‑62.  Prohibited access to critical infrastructure.

(a)        A governmental entity shall not enter into a contract or other agreement relating to critical infrastructure in this State with a company if (i) under the agreement the company would be granted direct or remote access to or control of critical infrastructure in this State, excluding access specifically allowed by the business entity for product warranty and support purposes, and (ii) the governmental entity knows that the company is either of the following:

(1)        The majority of stock or other ownership interest of the company is owned, held, or controlled by (i) individuals who are citizens of China, Iran, North Korea, Russia, or a designated country or (ii) a company or other entity, including a governmental entity, that is owned or controlled by citizens of or by the government of China, Iran, North Korea, Russia, or a designated country.

(2)        Headquartered in China, Iran, North Korea, Russia, or a designated country.

(b)        The prohibition described by subsection (a) of this section applies regardless of whether the company's securities or its parent company's securities are publicly traded and regardless of whether the company or its parent company is listed on a public stock exchange as a Chinese, Iranian, North Korean, or Russian company, or as a company of a designated country.

(c)        A contract or other agreement entered into by a business entity organized under the laws of this State or by a business entity authorized to do business in this State is against public policy and void ab initio if it meets the criteria described in subsections (a) and (b) of this section as applied to a governmental entity.

(d)       The Council of State may designate a country as a threat to critical infrastructure for purposes of this Article.

SECTION 1.(b)  This section is effective when it becomes law and applies to contracts entered into, modified, or renewed on or after that date.

REQUIRE CRIMINAL HISTORY RECORD CHECKS FOR INDIVIDUALS GRANTED ACCESS TO CRITICAL INFRASTRUCTURE

SECTION 2.(a)  G.S. 7A‑349 reads as rewritten:

§ 7A‑349.  Criminal history record check; denial of employment, contract, or volunteer opportunity.

The Judicial Department may deny employment, a contract, or a volunteer opportunity to any person who refuses to consent to a criminal history check authorized under G.S. 143B‑1209.31 and may dismiss a current employee, terminate a contractor, or terminate a volunteer relationship if that employee, contractor, or volunteer refuses to consent to a criminal history record check authorized under G.S. 143B‑1209.31. The Judicial Department shall require a criminal history record check for any individual granted access to a communication infrastructure system or cybersecurity system under the Judicial Department's authority.

SECTION 2.(b)  This section becomes effective October 1, 2025.

SECTION 3.(a)  G.S. 62‑43 reads as rewritten:

§ 62‑43.  Fixing standards, classifications, etc.; testing service.

(a)        The Commission may, after notice and hearing, had upon its own motion or upon complaint, ascertain and fix just and reasonable standards, classifications, regulations, practices, or service to be furnished, imposed, observed or followed by any or all public utilities; ascertain and fix adequate and reasonable standards for the measurement of quantity, quality, pressure, initial voltage or other condition pertaining to the supply of the product, commodity or service furnished or rendered by any and all public utilities; prescribe reasonable regulations for the examination and testing of such product, commodity or service and for the measurement thereof; establish or approve reasonable rules, regulations, specifications and standards to secure the accuracy of all meters and appliances for measurement; and provide for the examination and testing of any and all appliances used for the measurement of any product, commodity or service of any public utility.

(b)        The Commission shall fix, establish and promulgate standards of quality and safety for gas furnished by a public utility and prescribe rules and regulations for the enforcement of and obedience to the same.

(c)        The Commission shall adopt rules to require a criminal history record check for any individual granted access to the electric power grid or to a communication infrastructure system under the Commission's regulatory authority.

SECTION 3.(b)  This section is effective when it becomes law. Rules adopted pursuant to this section shall be adopted to take effect as soon as practicable but no later than October 1, 2026.

SECTION 4.(a)  G.S. 90A‑24 reads as rewritten:

§ 90A‑24.  Operator qualifications and examination.

(a)        The Board of Certification, with the advice and assistance of the Secretary of Environmental Quality shall establish minimum requirements of education, experience and knowledge for each grade of certification for water treatment facility operators, and shall establish procedures for receiving applications for certification, conducting examinations and making investigations of applicants as may be necessary and appropriate to the end that prompt and fair consideration be given every application and the water treatment facilities of the State may be adequately supervised by certified operators.

(b)        All applicants for initial certification as a water treatment facility operator shall consent to a criminal history record check. Refusal to consent to a criminal history record check may constitute grounds for the Board of Certification to deny certification to an applicant. The Board shall provide to the State Bureau of Investigation the fingerprints of the applicant to be checked, a form signed by the applicant consenting to the criminal history record check and the use of fingerprints and other identifying information required by the State or National Repositories, and any additional information required by the State Bureau of Investigation. The Board shall keep all information obtained pursuant to this subsection confidential. The cost of the criminal history record check and the fingerprinting shall be paid by the applicant. The Secretary of State shall collect any fees required by the State Bureau of Investigation and shall remit the fees to the State Bureau of Investigation for expenses associated with conducting the criminal history record check.

SECTION 4.(b)  Article 13A of Chapter 143B of the General Statutes is amended by adding a new section to read:

§ 143B‑1209.59.  Criminal record checks for the Water Treatment Facility Operators Board of Certification.

(a)        The State Bureau of Investigation may provide to the Water Treatment Facility Operators Board of Certification from the State and National Repositories of Criminal Histories the criminal history of a prospective water treatment facility operator. The Board of Certification shall provide to the Bureau, along with the request, the fingerprints of the prospective water treatment facility operator, a form signed by the prospective water treatment facility operator consenting to the criminal record check and use of fingerprints and other identifying information required by the State and National Repositories, and any additional information required by the Bureau. The fingerprints of the prospective water treatment facility operator shall be used for a search of the State's criminal history record file, and the Bureau shall forward a set of fingerprints to the Federal Bureau of Investigation for a national criminal history record check. The Board of Certification shall keep all information obtained pursuant to this section confidential.

(b)        The Bureau may charge a fee to offset the cost incurred by it to conduct a criminal record check under this section. The fee shall not exceed the actual cost of locating, editing, researching, and retrieving the information.

SECTION 4.(c)  G.S. 90A‑27 reads as rewritten:

§ 90A‑27.  Application fee.

The Board may establish a schedule of fees for the issuance or renewal of a certificate to cover the costs of administering the certification programs. The fee for issuing or renewing a certificate may shall not exceed fifty dollars ($50.00). In addition to the fee for issuing a certificate, the Board shall charge an initial applicant the fee for a criminal history record check pursuant to G.S. 90A‑24. The Board may impose a penalty not to exceed thirty dollars ($30.00) for the late renewal of a certificate.

SECTION 4.(d)  This section becomes effective October 1, 2025, and applies to applications for initial certification received on or after that date.

SECTION 5.(a)  G.S. 116‑11 is amended by adding a new subdivision to read:

(3d)    The Board of Governors of The University of North Carolina shall adopt a policy to require a criminal history record check for any individual granted access to a communication infrastructure system or cybersecurity system of The University of North Carolina.

SECTION 5.(b)  This section is effective when it becomes law. The policy adopted pursuant to this section shall be adopted to take effect as soon as practicable but no later than October 1, 2026.

SECTION 6.(a)  G.S. 130A‑295 reads as rewritten:

§ 130A‑295.  Additional requirements for hazardous waste facilities.

(a)        An applicant for a permit for a hazardous waste facility shall satisfy the Department that:of all of the following:

(1)        Any hazardous waste facility constructed or operated by the applicant, or any parent or subsidiary corporation if the applicant is a corporation, has been operated in accordance, with sound waste management practices and in substantial compliance with federal and state laws, regulations and rules; andrules.

(2)        The applicant, or any parent or subsidiary corporation if the applicant is a corporation, is financially qualified to operate the proposed hazardous waste facility.

(3)        The applicant requires a criminal history record check for any individual granted access to the hazardous waste treatment systems under its control.

….

SECTION 6.(b)  This section becomes effective October 1, 2025.

SECTION 7.(a)  G.S. 143B‑1336 reads as rewritten:

§ 143B‑1336.  Information technology human resources.

…

(g)        Criminal Records Checks. – The State CIO shall require background investigations of any employee or prospective employee, including a criminal history record check, which may include a search of the State and National Repositories of Criminal Histories based on the person's fingerprints. A criminal history record check shall be conducted by the State Bureau of Investigation upon receiving fingerprints and other information provided by the employee or prospective employee. If the employee or prospective employee has been a resident of the State for less than five years, the background report shall include a review of criminal information from both the State and National Repositories of Criminal Histories. The criminal background report shall be provided to the State CIO and is not a public record under Chapter 132 of the General Statutes. The requirements of this subsection also apply to any contractor granted access to a communication infrastructure system or cybersecurity system under the authority of the State CIO.

SECTION 7.(b)  This section is effective when it becomes law and applies to contracts entered into, modified, or renewed on or after that date.

SECTION 8.  G.S. 143B‑1209.58 is recodified as G.S. 143B‑1208.15.

EFFECTIVE DATE

SECTION 9.  Except as otherwise provided, this act is effective when it becomes law.