What a Idaho business has to have in writing

Investigate promptly and in good faith once a breach is suspected, then, if personal information has been or is likely to be misused, write and send notice to affected Idaho residents as soon as possible without unreasonable delay. Businesses may tell the Attorney General but are not required to; public agencies must notify the Attorney General within 24 hours. A regulated business that follows its own regulator's breach procedures is treated as compliant.

A procurement condition, not a statute. Idaho's standard cloud contract terms, which take precedence over the general state contract terms, require that state data be stored in a FedRAMP accredited cloud service, and require the contractor to pay for an independent audit of its data centers at least once a year and hand the state an unredacted copy within thirty days of publication. A SOC 2 report is the required audit type unless the state agrees to another. Services and data at rest must sit in United States data centres inside a physical security perimeter, and the state keeps a right to inspect them on ten days' notice. Separately, the Idaho Administrative Office of the Courts participates in GovRAMP and runs its own vendor security review for judicial branch contracts.

Display the Department of Labor's free poster set, which covers minimum wage, unemployment insurance, the Idaho Human Rights Act, workers' compensation and the federal notices, where employees can read them.

File formation or foreign registration papers through the SOSBiz portal, appoint an Idaho registered agent, file an assumed business name certificate if the trade name differs from the legal name, and file the free annual report in the anniversary month.

Complete the Idaho Business Registration to get a seller's permit, withholding account and unemployment insurance account in one filing, display the permit at the place of business, and file sales tax and withholding returns on the schedule the Tax Commission assigns.

Register with the Idaho Contractors Board before contracting or advertising, show proof of general liability insurance and workers' compensation coverage, renew each year, and put the registration number in advertising, bids and contracts. This is registration rather than a competency license.

Hold a Public Works Contractors License in the correct class and category before submitting a bid, prove financial capacity and experience for the license limit sought, renew annually, and put the license number on the bid.

Get a food establishment license from the local public health district before opening and renew it yearly, submit plans for new or remodeled facilities, keep a person in charge on site who can demonstrate food safety knowledge to the inspector, and follow the written procedures the Food Code requires for things like variances and specialized processes.

Apply to the Idaho State Police Alcohol Beverage Control bureau for the state license, hold the matching city or county license, renew annually, and keep the license posted at the licensed premises along with the required age and server notices.

Publish a written substance abuse policy that states which employees are covered, when testing happens, what substances are screened, the collection and confirmation methods used, employee rights to explain a positive result, confidentiality handling and the consequences of a violation; give notice to employees before the program starts. A qualifying program supports a workers' compensation premium credit and a defense to certain claims.

Buy an Idaho workers' compensation policy or qualify as a self-insurer before the first employee starts, post the notice naming the carrier and explaining how to report an injury, file the first report of injury with the Industrial Commission within ten days of notice, and keep injury records.

Report each new or rehired employee to the Department of Labor within 20 days of the hire date, giving the employer and employee identifying details, and keep the reporting process consistent enough to survive an audit.

Post clear no-smoking signs or the international no-smoking symbol at the entrances of areas where smoking is prohibited, and keep ashtrays out of those areas.