Sections 1(a)-(b)

Amends GS Chapter 64 enacting new Article 4, titled Prohibit Adversarial Foreign Control of Critical Infrastructure (which may be cited as the Infrastructure Protection Act). Enacts GS 64-61 to provide the following definitions for use in Article 4:

• Company. – A sole proprietorship, organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, or limited liability company, including a wholly owned subsidiary, majority-owned subsidiary, parent company, or affiliate of those entities or business associations, that exists to make a profit.
• Critical infrastructure. – A communication infrastructure system, cybersecurity system, electric grid, hazardous waste treatment system, or water treatment facility.
• Cybersecurity. – The measures taken to protect a computer, computer network, computer system, or other technology infrastructure against unauthorized use or access.
• Designated country. – A country designated by the Council of State as a threat to critical infrastructure under this Article.
• Governmental entity. – Any State agency, institution, board, commission, bureau, council, department, division, officer, or political subdivision, including counties, municipal corporations, county or city boards of education, and other local public bodies, as well as any other entity for which the State has oversight responsibility.

Enacts 64-62, titled Prohibited access to critical infrastructure. Prohibits a government entity from contracting or agreeing regarding critical infrastructure in North Carolina with a company if (i) the company would receive direct or remote access to or control of said infrastructure (except access specifically allowed by the company for product warranty and support purposes), and (ii) the government entity knows the company is either of the following:

1. The majority of stock or other ownership interest of the company is owned, held, or controlled by (i) individuals who are citizens of China, Iran, North Korea, Russia, or a designated country or (ii) a company or other entity, including a governmental entity, that is owned or controlled by citizens of or by the government of China, Iran, North Korea, Russia, or a designated country.
2. Headquartered in China, Iran, North Korea, Russia, or a designated country.

Applies the above prohibition regardless of whether the company or its parent company’s securities are publicly traded and/or the company or its parent company are listed on a public stock exchange as a Chinese, Iranian, North Korean, or Russian company, or as a company of a designated country. Declares as against public policy and void ab initio any contract or other agreement entered into by a North Carolina-organized business that meets the above descriptions. Permits the Council of State to designate a country as a threat to critical infrastructure under this Article.

This statute is effective when it becomes law and applies to contracts entered into, modified, or renewed on or after that date.

Sections 2(a)-(b)

Amends GS 7A-349 requiring the Judicial Department to require a criminal history record check for anyone given access to a communication infrastructure or cybersecurity system under the Judicial Department’s authority.

This statute is effective October 1, 2025.

Sections 3(a)-(b)

Amends GS 62-43 requiring that the North Carolina Utilities Commission adopt rules requiring a criminal history check for any individual given access to the electric power grid or to a communication infrastructure system under said Commission’s regulatory authority.

This statute is effective when it becomes law. Rules adopted pursuant to this statute must be adopted to take effect as soon as practicable but no later than October 1, 2026.

Sections 4(a)-(d)

Amends GS 90A-24 enacting new provision (b). Requires all applicants for initial certification as a water treatment facility operator to consent to a criminal history record check and allows the Board of Certification (Board) to deny certification to any applicant who refuses. Requires the Board to provide the State Bureau of Investigation (SBI) with an applicant’s signed consent, fingerprints, and other identifying information required by the State or National Repositories (Repositories) and the SBI. Requires the Board to keep all information obtained pursuant to this subsection confidential. Requires the applicant to pay the cost of a criminal history record check and fingerprinting under this subsection. Any fees required by the SBI must be collected by the Secretary of State and remitted to the SBI for expenses associated with conducting the record check.

Amends GS 143B, Article 13A, enacting new GS 143B-1209.59, titled Criminal record checks for the Water Treatment Facility Operators Board of Certification. Authorizes the SBI to provide a criminal history from the Repositories of any prospective operator to the Board. The Board must then provide to the SBI, along with the request, the prospective operator’s signed consent to the criminal record check and use of fingerprints and other identifying information required by the Repositories and the SBI. The prospective operator’s fingerprints must be used for a search of the State’s criminal history record file, and the SBI must forward a set of fingerprints to the Federal Bureau of Investigation for a national criminal history record check. All information obtained by the Board pursuant to this statute is confidential. The SBI may charge a fee to offset the cost incurred by it to conduct a criminal record check under this statute, up to the actual cost of locating, editing, researching, and retrieving information.

Amends GS 90A-27 to limit the fee established by the Board for issuing or renewing a certificate to $50.00. Requires the Board to also charge the applicant a fee for a criminal history record check pursuant to GS 90A-24.

This statute is effective October 1, 2025, and applies to applications for initial certification received on or after that date.

Sections 5(a)-(b)

Amends GS 116-11 enacting new subdivision (3d) requiring the Board of Governors of the University of North Carolina to adopt a policy that requires criminal history record checks for individuals granted access to a communication infrastructure or cybersecurity system of the University of North Carolina.

This statute is effective when it becomes law. The policy adopted pursuant to this statute shall be adopted to take effect as soon as practicable but no later than October 1, 2026.

Sections 6(a)-(b)

Amends GS 130A-295 including among the existing statutory requirements for an applicant seeking a permit for hazardous waste facility that, under new provision (3), the applicant requires a criminal history record check for any individual granted access to the hazardous waste treatment systems under its control.

This statute is effective October 1, 2025.

Sections 7(a)-(b)

Amends GS 143B-1336 applying the background check requirements of existing provision (g) to any contractor granted access to a communication infrastructure system or cybersecurity system under the authority of the State Chief Information Officer.

This statute is effective when it becomes law and applies to contracts entered into, modified, or renewed after that date.

Section 8

Recodifies GS 143B-1209.58 as GS 143B-1208.15.

Section 9.

Makes this act effective when it becomes law, except as otherwise provided.