SB 2471 — Cyber breach; limit liability for certain entities.

2471 (As Passed the Senate) AN ACT TO PROVIDE THAT A COUNTY OR MUNICIPALITY AND ANY OTHER POLITICAL SUBDIVISION OF THE STATE SHALL NOT BE LIABLE IN CONNECTION WITH A CYBERSECURITY INCIDENT IF THE ENTITY ADOPTS CERTAIN CYBERSECURITY STANDARDS;

TO REQUIRE CYBERSECURITY PROGRAMS TO ALIGN WITH NATIONALLY-RECOGNIZEDNATIONALLY RECOGNIZED STANDARDS AND THE REQUIREMENTS OF SPECIFIED FEDERAL LAWS;

2471 *SS36/R855**SS26/R855PS* ~ OFFICIAL ~ G1/2 25/SS36/R85525/SS26/R855PS PAGE 1 (ens\tb) (2) (a) A county, municipality, county hospital, the state or any of its political subdivisions shall not be liable in connection with a cybersecurity incident if the entity adopts cybersecurity standards that:

2471 *SS36/R855**SS26/R855PS* ~ OFFICIAL ~ 25/SS36/R85525/SS26/R855PS PAGE 2(ens\tb)2 (i) The National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity andFramework; the implementing regulations or publications.

(ii) NIST special publication 800-171 or its most current update, revision, or replacement.replacement;

(iii) NIST special publications 800-53 and 800-53A or their most current update, revision, or replacement.replacement;

(iv) The Federal Risk and Authorization Management Program security assessment framework.framework;

(v) The Center for Internet Security (CIS) Critical Security Controls.Controls;

(vi) The International Organization for Standardization/International Electrotechnical Commission 27000-27000 series (ISO/IEC 27000) family of standards;

(i) The Health Insurance Portability and Accountability Act of 1996 security requirements in 45 C.F.R.CFR part 160 and part 164 subparts A and C;

part 160 and part 164 subparts A and C;

2471 *SS36/R855**SS26/R855PS* ~ OFFICIAL ~ 25/SS36/R85525/SS26/R855PS PAGE 3(ens\tb)3 (iii) The Federal Information Security Modernization Act of 2014, Public Law No.

113-283.113-283;

or (iv) The Health Information Technology for Economic and Clinical Health Act requirements in 45 CFR parts 160 and 164.

(4) A covered entity's or third-party agent's alignment with a framework or standard under paragraphsubsection (3)(a) or paragraph(b) (3)(b),of this section, may be demonstrated by providing documentation or other evidence of an assessment, conducted internally or by a third-party, reflecting that the covered entity's or third-party agent's cybersecurity program is substantially aligned with the relevant framework or standard or with the applicable state or federal law or regulation.

(5) The scale and scope of substantial alignment with a standard, law or regulation under paragraphsubsection (3)(a) or paragraph(b) (3)(b)of this section by a covered entity or third-party agent, as applicable, is appropriate if it is based on all of the following factors:

(6) Any commercial entity or third-party agent covered by subsection (3) of this section which substantially complies with a combination of industry-recognized cybersecurity frameworks or standards to gain S.

2471 *SS36/R855**SS26/R855PS* ~ OFFICIAL ~ 25/SS36/R85525/SS26/R855PS PAGE 4(ens\tb)4 standards to gain the presumption against liability pursuant to subsection (3) of this section must, upon the revision of two (2) or more of the frameworks or standards with which the entity complies, adopt the revised frameworks or standards within one (1) year after the latest publication date or latest compliance or effective date stated in the revisions and, if applicable, comply with the Payment Card Industry Data Security Standard (PCI DSS).

(7) In an action in connection with a cybersecurity incident, if the defendant is an entity covered by subsection (2),(2) of this section, the plaintiff shall have the initial burden of demonstrating by clear and convincing evidence that the entity was not in substantial compliance with this section.

(8) In an action in connection with a cybersecurity incident, if the defendant is an entity under subsection (3),(3) of this section, the defendant has the burden of proof to establish a prima facie case of compliance with industry-recognized cybersecurity frameworks or standards to gain the presumption against liability pursuant to this Act.act.

2471 *SS36/R855**SS26/R855PS* ~ OFFICIAL ~ 25/SS36/R85525/SS26/R855PS PAGE 5(ens\tb)5 (9) This act does not establish a private cause of action, including a class action, if a covered entity or third-party agent fails to comply with a provision of this act.

2471 *SS36/R855**SS26/R855PS* ~ OFFICIAL ~ 25/SS36/R85525/SS26/R855PS ST:

limit liability for certain PAGE 6(ens\tb)6 entities.