SB 467 — Revises provisions relating to cybersecurity. (BDR 19-1149)

Assess, examine and review the operation and efficacy of telephone systems and related systems used to provide emergency 911 service.

Submit an annual briefing to the Governor assessing the preparedness of the State to counteract, prevent and respond to potential acts of terrorism and related emergencies, including, but not limited to, an assessment of response plans and vulnerability assessments of utilities, public entities and private business in this State.reasonably available to the Commission and must be compiled with the advice of the Division after all utilities, public entities and private businesses assessed have a reasonable opportunity to review and comment on the Commission’s findings.

The10. briefing must be based on information and documents reasonably available to the Commission and must be compiled with the advice of the Division after all utilities, public entities and private businesses assessed have a reasonable opportunity to review and comment on the Commission’s findings.

- *SB467* – 9 – 10.

- 83rd Session (2025) – 9 – 1.

2.information systems and the expanding and diverse applications of those technologies pose significant implications for the functioning of any infrastructure in this State that is critical to the health, safety and welfare of the people of this State, particularly in the areas of transportation, health care, energy, education, law enforcement and commercial enterprises.

The continued development of technologies relating to information systems and the expanding and diverse applications of those technologies pose significant implications for the functioning of any infrastructure in this State that is critical to the health, safety and welfare of the people of this State, particularly in the areas of transportation, health care, energy, education, law enforcement and commercial enterprises.

Protecting and securing the statewide cyberinfrastructure requires a strategic statewide plan for responding to incidents in which information systems are compromised, breached or damaged, including, without limitation, actions taken to:

and - *SB467* – 10 – (c) Ensure the uninterrupted and continuous delivery of essential services to the people of this State and the uninterrupted and continuous operations of the essential functions of government that ensure the protection of the health, safety and welfare of the people of this State.

Protecting and securing the statewide cyberinfrastructure depends on collaboration and cooperation, including the sharing of information and analysis regarding cybersecurity threats, - 83rd Session (2025) – 10 – among local, state and federal agencies and across a broad spectrum of the public and private sectors.

Institutions of higher education play a critical role in protecting and securing statewide cyberinfrastructure by developing programs that support a skilled workforce, promote innovation andproandms contributecontributert totoskialedmorekfosecureromostatewide a more secure statewide cyberinfrastructure.

Sec.Defense shall:e Office of Information Security and Cyber 1.

10.

The Office of Information Security and Cyber Defense shall:

1.

and - *SB467* – 11 – 3.

- 83rd Session (2025) – 11 – (b) The Nevada System of Higher Education;

and (c) Private entities, to the extent practicable,  to encourage the development of strategies to prepare for and mitigate risks to, and otherwise protect, the security of information systemsentity thatin arethis operatedState.ated or maintained by a public or private entity2. in this State.

2.

(c) The Office to notify state agencies, appropriate law enforcement and prosecuting authorities and any other appropriate public or private entity of any specific threat to the security of an information system of which the Office has been notified;

In consultation with appropriate state agencies, local governments and agencies of the Federal Government, the Deputy Director shall appoint a cybersecurity incident response team or - *SB467* – 12 – teams.

A cybersecurity incident response team appointed pursuant to subsection 2 shall convene at the call of the Deputy Director - 83rd Session (2025) – 12 – and, subject to the direction of the Deputy Director, shall assist the Office of Information Security and Cyber Defense and any appropriate state agencies, local governments or agencies of the Federal Government in responding to a threat to the security of an informationinf4.matA system.private entity may, in its discretion, use the services of a cybersecurity incident response team appointed pursuant to subsection 2.

4.

A private entity may, in its discretion, use the services of a cybersecurity incident response team appointed pursuant to subsection 2.

(c) Protecting the confidentiality of personal information that is stored on, transmitted to, from or through or generated by ananat information system in this State;

- *SB467* – 13 – 5.

Such an agency shall submit the - 83rd Session (2025) – 13 – results of the testing to the Office of Information Security and Cyber Defense annually for consideration in the update of the statewide strategic plan.

The Office of Information Security and Cyber Defense shall quarterly prepare and submit to the Governor a report assessing the preparedness of the State, as of the date of the report, to counteract, prevent and respond to potential cybersecurity threats.

(d) A summary of any issues presenting challenges to the Office;

andandmmary of any issues presenting challenges to the (e) Any other information that the Deputy Director determines is appropriate to include in the report.

and - *SB467*83rd –Session 14(2025) – (d)14 For– postincident activity that includes a discussion regarding information learned and any analytics associated with the cybersecurity incident.

Except as otherwise provided in NRS 239.0115, a cybersecurity incident response plan filed pursuant to the requirements of this section, including any revisions adopted thereto, is confidential and must be securely maintained by the employee or other person to whom the plan is entrusted by the Office ofshall Informationnot Securitydisclose andthe Cybercontents Defense.of such a plan except:

An officer, employee or other person to whom the plan is entrusted by the Office shall not disclose the contents of such a plan except:

Any record of a state agency, including, without limitation, a record of the Office of Information Security and Cyber Defense or local government or a record obtained from a private entity which identifies the detection or investigation of or a response to a suspected or confirmed threat to or attack on the security of an information system is not a public record and may be disclosed by the Deputy Director only to another state agency, local government, a cybersecurity incident response team convened pursuant to section 12 of this act and appropriate law enforcement or prosecuting authorities and only for the purposes of preparing for and mitigating risks to, and otherwise protecting, the security of an information system or as part of a criminal investigation.

The Office of Information Security and Cyber Defense shall not require any private entity to provide any information or data that, in the sole discretion of the private entity, would - 83rd Session (2025) – 15 – compromise any information system operated or maintained by the private entity if such information or data were made public.

- *SB467* – 15 – Sec.

The Office of the Chief Information Officer is herebyher2. created within the Office of the Governor.

2.The Office consists of the Chief and:ernor.

The Office consists of the Chief and:

(c) Employ, within the limits of the approved budget of the Office, such other staff as is necessary for the performance of the duties of the Office;

andandas is necessary for the performance of the (d) Carry out other duties and exercise other powers specified by law.

The policy for the information systems of the Executive Branch of Government, excluding the Nevada System of Higher Education and the Nevada Criminal Justice Information System, as that policy relates, but is not limited, to such items as standards for systems and programming and criteria for selection, location and - 83rd Session (2025) – 16 – use of information systems to meet the requirements of state agencies and officers at the least cost to the State;

The procedures of the Office in providing information services, which may include provision for the performance, by an agency which uses the services or equipment of the Office, of - *SB467* – 16 – preliminary procedures, such as data recording and verification, within the agency;

and (b) Noncompliance with the regulations, standards, practices, policies and conventions of the Office that is identified by the Office as security-related,  to the Office of Information Security and Cyber Defense of the Office within 24 hours after discovery of the suspected incident.

The [Chief] Deputy Director of the Office of Information Security and Cyber Defense shall investigate and resolve- any83rd breachSession of(2025) an– information17 system– of a state agency or elected officer that uses the equipment or services of the Office of the Chief Information Officer or an application of such an information system or unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of such an information system.

- *SB467* – 17 – 2.

Sec.

22.

NRS 205.4765 is hereby amended to read as follows:

or (l) Enters,  data, a program or any supporting documents which exist inside or outside a computer, system or network is guilty of aast inside misdemeanor.

(f)- Transfers;83rd Session (2025) – 18 – (g) Conceals;;

(g) Conceals;

- *SB467* – 18 – 3.

(h)(i) Copies;Uses;s;

(i) Uses;

Except as otherwise provided in subsection 6, a person who knowingly, willfully and without authorization introduces, causes to be introduced or attempts to introduce a computer contaminant into a computer, system or network is guilty of a misdemeanor.misdemeanor.nant into 6.

6.

or (c) Caused an interruption or impairment of a public service, including, without limitation, a governmental operation, a system of - 83rd Session (2025) – 19 – public communication or transportation or a supply of water, gas or electricity,  the person is guilty of a category C felony and shall be punished as provided in NRS 193.130, and may be further punished by a fine ofcourt notshall moreorder thanthe $100,000.person to pay restitution.her penalty, the 7.

InThe additionprovisions of this section do not apply to a person performing any othertesting, penalty,including, without limitation, penetration testing, of an information system of an agency that uses the courtequipment shallor orderservices of the personOffice toof paythe restitution.Chief Information Officer within the Office of the Governor that is authorized by the Chief of that Office or the [head] Deputy Director of the Office of Information Security and Cyber Defense of the Office of the Chief Information Officer.

7.

The provisions of this section do not apply to a person performing any testing, including, without limitation, penetration testing, of an information system of an agency that uses the equipment or services of the Office of the Chief Information Officer within the Office of the Governor that is authorized by the Chief of - *SB467* – 19 – that Office or the [head] Deputy Director of the Office of Information Security and Cyber Defense of the Office of the Chief Information Officer.

Any records of the Secretary of State or a county or city clerk that relate to the security of an information system used for elections are confidential and are not public records pursuant to chapter 239 of NRS.

Such records include, without limitation:limitation:suant to (a) Risk assessments;

(a) Risk assessments;

or (c) Appropriate law enforcement officers or prosecuting attorneys, - 83rd Session (2025) – 20 –  but only for the purpose of preparing for and mitigating risks to or otherwise protecting the security of elections or as part of a criminal investigation.

480.1301.0.1An TheInvestigation DepartmentDivision; consists of:

1.of:

An Investigation Division;

- *SB467* – 20 – Sec.

(a) Execute, administer and enforce the provisions of chapter 453 of NRS relating to controlled substances and chapter 454 of NRS relating to dangerous drugs;

(e) Upon(1) request,The assist:Department of Taxation in carrying out a criminal investigation relating to cannabis pursuant to NRS 372A.200 to 372A.380, inclusive, and chapter 678A of NRS;

(1) The Department of Taxation in carrying out a criminal investigation relating to cannabis pursuant to NRS 372A.200 to 372A.380, inclusive, and chapter 678A of NRS;

The Nevada Highway Patrol Division shall, in conjunction with the Department of Motor Vehicles, execute, administer and enforce the provisions of chapters 484A to 484E, inclusive, of NRS - 83rd Session (2025) – 21 – and perform such duties and exercise such powers as may be conferred upon it pursuant to NRS 480.360 and any other specific statute.

The State Fire Marshal Division shall execute, administer and enforce the provisions of chapter 477 of NRS and perform such duties and exercise such powers as may be conferred upon ititm such pursuant to chapter 477 of NRS and any other specific statute.

- *SB467* – 21 – (a) Serve as the strategic planning, facilitating and coordinating office for cybersecurity policy and planning in this State;

(a) Execute, administer and enforce the provisions of chapter 179A of NRS and perform such duties and exercise such powers as mayother bespecific conferredstatute;t upon it pursuant to chapter 179A of NRS and any (b) Provide dispatch services for the Department and other specificagencies statute;as determined by the Director;

(b) Provide dispatch services for the Department and other agencies as determined by the Director;

- 83rd Session (2025) – 22 – 2.

If a data collector is a governmental agency and maintains records which contain personal information of a resident of this State, the data collector shall, to the extent practicable, with respect to the collection, dissemination and maintenance of those records, comply with the current version of the CIS Controls as published by the Center for Internet Security, Inc.

If a state or federal law requires a data collector to provide greater protection to records that contain personal information of a resident of this State which are maintained by the data collector and - *SB467* – 22 – the data collector is in compliance with the provisions of that state or federal law, the data collector shall be deemed to be in compliance with the provisions of this section.

Sec.603A.215 NRS 1.

29.

NRS 603A.215 is hereby amended to read as follows:

603A.215 1.

or - 83rd Session (2025) – 23 – (b) Move any data storage device containing personal information beyond the logical or physical controls of the data collector, its data storage contractor or, if the data storage device is used by or is a component of a multifunctional device, a person who assumes the obligation of the data collector to protect personal information, unless the data collector uses encryption to ensure the security of the information.

and - *SB467* – 23 – (3) Digital subscriber line transmission, voice over Internet protocol and other digital transmission technology.

or (2) Issuance of reports regarding account closures due to fraud, substantial overdrafts, abuse of automatic teller machines or relatedrel5.ed informationAs regardingused ain customer.this section:customer.

5.

As used in this section:

- 83rd Session (2025) – 24 – (2) Appropriate management and safeguards of cryptographic keys to protect the integrity of the encryption using guidelines promulgated by an established standards setting body, including, but not limited to, the National Institute of Standards and Technology;Techno(3) Any other technology or method identified by the Office of Information Security and Cyber Defense of the Office of the Chief Information Officer within the Office of the Governor in regulations adopted pursuant to NRS 603A.217.

and (3) Any other technology or method identified by the Office of Information Security and Cyber Defense of the Office of the Chief Information Officer within the Office of the Governor in regulations adopted pursuant to NRS 603A.217.

- *SB467* – 24 – (e) “Payment card” has the meaning ascribed to it in NRS 205.602.

The Office of Information Security and Cyber Defense shall prepare and make available to the public the statewide strategic plan required by section 13 of this act not later thanthanwide January 1, 2026.

- 83rd Session (2025) – 25 – Sec.

Any administrative regulations adopted by an officer or an agency whose name has been changed or whose responsibilities have been transferred pursuant to the provisions of this act to another officer or agency remain in force until amended byof the officerregulations orhas agencybeen totransferred.sponsibility which the responsibility for the adoption of2. the regulations has been transferred.

2.

- *SB467* – 25 – 480.910, 480.912, 480.920, 480.924, 480.926, 480.928, 480.930, 480.932, 480.935, 480.940 and 480.950 are hereby repealed.

35.

NRS 480.900, 480.902, 480.904, 480.906, 480.908, 480.910, 480.912, 480.920, 480.924, 480.926, 480.928, 480.930, 480.932, 480.935, 480.940 and 480.950 are hereby repealed.

Sec.

LEADLINES~~~~~ OF25 REPEALED- SECTIONS83rd 480.900Session Legislative(2025) findings and declarations regarding security of information systems.

480.902 Definitions.

480.904 “Administrator” defined.

480.906 “Information system” defined.

480.908 “Office” defined.

480.910 “Security of an information system” defined.

480.912 “State agency” defined.

480.920 Nevada Office of Cyber Defense Coordination:

Creation;

composition.

480.924 Duties of Office.

480.926 Office to establish partnerships, consult and coordinate with various entities and agencies.

480.928 Office to establish policies and procedures;

Administrator to appoint cybersecurity incident response teams;

duties of cybersecurity incident response teams;

private ent480.930 Office to prepare and update statewide strategicam.

plan regarding security of information systems;

use of information by private entity;

state agencies with cybersecurity policy required to test adherence to policy by employees and submit results to Office.

480.932 Office to prepare and submit quarterly and annual reports.

480.935 Political subdivisions required to adopt and maintain cybersecurity incident response plan;

plan to be filed with Office;

requirements for plan;

confidentiality;

exceptions;

regulations.

480.940 Confidentiality of certain records.

480.950 Regulations.

H - *SB467*