HB 1380 — Cybersecurity; governmental and certain commercial entities substantially complying with standards not liable for incidents relating to.

1380 (As Passed the House) AN ACT TO PROVIDE THAT STATE AND LOCAL GOVERNMENTAL ENTITIES AND CERTAIN COVERED COMMERCIAL ENTITIES ARE NOT LIABLE IN CONNECTION WITH A CYBERSECURITY INCIDENT IF THE ENTITY INVOLVED HAS ADOPTED CERTAIN CYBERSECURITY STANDARDS;

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ G1/2 25/HR43/R179225/HR43/R1792PH PAGE 1 (RKM\KP) been contracted to maintain, store or process personal information on behalf of a covered entity.

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 2(RKM\KP) (a) Adopted a cybersecurity program that substantially aligns with the current version of any standards, guidelines or regulations that implement any of the following:

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 3(RKM\KP) (ii) Title V of the Gramm-Leach-Bliley Act of 1999, Public Law 57 No.

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 4(RKM\KP) (c) The sensitivity of the information to be protected.

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 5(RKM\KP) proving by clear and convincing evidence that the defendant failed to substantially comply with applicable industry-recognized cybersecurity frameworks or standards.

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 6(RKM\KP) (2) The Mississippi Department of Information Technology Services (MDITS), in conjunction with all state agencies, shall provide centralized management and coordination of state policies for the security of data and information technology resources, which such information shall be compiled by MDITS and distributed to each participating state agency.

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 7(RKM\KP) (d) Adhere to all policies, standards and guidelines in the management of technology infrastructure supporting the state data centers, telecommunications networks and backup facilities;

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 8(RKM\KP) (l) Charge respective user agencies on a reimbursement basis for their proportionate cost of the installation, maintenance and operation of the cybersecurity systems and services;

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 9(RKM\KP) (e) Participate in all Enterprise Security Program initiatives and services in lieu of deploying duplicate services specific to the agency;

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 10(RKM\KP) (k) Include a general description of the security program and future plans for ensuring security of data in the agency long-range information technology plan;

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 11(RKM\KP) (b) Whether opportunities exist to centralize and coordinate oversight of cybersecurity efforts across all state agencies;

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH PAGE 12(RKM\KP) (b) "Ransomware" shall mean a computer contaminant or lock placed or introduced without authorization into a computer, computer system or computer network that restricts access by an authorized person to the computer, computer system, computer network or any data therein under circumstances in which the person responsible for the placement or introduction of the ransomware demands payment of money or other consideration to remove the computer contaminant, restore access to the computer, computer system, computer network or data, or otherwise remediate the impact of the computer contaminant or lock.

SECTION 3.

This act shall take effect and be in force from and after January 1, 2026.

1380 *HR43/R1792**HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R179225/HR43/R1792PH ST:PAGE 13(RKM\KP) SECTION 3.

This act shall take effect and be in force from and after January 1, 2026, and shall stand repealed on December 31, 2025.

H.

B.

No.

1380 *HR43/R1792PH* ~ OFFICIAL ~ 25/HR43/R1792PH ST:

governmental and certain PAGE 13(RKM\KP)14 (RKM\KP) commercial entities substantially complying with standards not liable for incidents relating to.