AN ACT TO PROVIDE THAT A COUNTY OR MUNICIPALITY AND ANY OTHER POLITICAL SUBDIVISION OF THE STATE OR A COMMERCIAL ENTITY SHALL NOT BE LIABLE IN CONNECTION WITH A CYBERSECURITY INCIDENT IF THE ENTITY ADOPTS CERTAIN CYBERSECURITY STANDARDS; TO DEFINE CERTAIN TERMS; TO REQUIRE CYBERSECURITY PROGRAMS TO ALIGN WITH NATIONALLY RECOGNIZED STANDARDS AND THE REQUIREMENTS OF SPECIFIED FEDERAL LAWS; TO PROVIDE A REBUTTABLE PRESUMPTION AGAINST LIABILITY FOR COMMERCIAL ENTITIES THAT ARE IN SUBSTANTIAL COMPLIANCE WITH THIS ACT BY ADOPTING A CYBERSECURITY PROGRAM THAT SUBSTANTIALLY ALIGNS WITH CERTAIN SPECIFIED CYBERSECURITY STANDARDS; AND FOR RELATED PURPOSES.
Impact
By introducing this legislation, Mississippi seeks to promote better cybersecurity practices among local government entities and commercial businesses. The proposed bill includes a rebuttable presumption against liability for those entities found to be in substantial compliance with designated cybersecurity measures. This could potentially encourage more organizations to invest in robust cybersecurity protocols as a way to safeguard against liabilities arising from data breaches or other cybersecurity incidents. The measure also asserts that noncompliance with the bill does not lead to 'negligence per se', which can change how liability is assessed in civil actions related to cybersecurity.
Summary
Senate Bill 2410 aims to provide a framework that limits the liability of counties, municipalities, and certain commercial entities in the event of a cybersecurity incident, provided these entities adopt specified cybersecurity standards. The bill explicitly defines terms such as 'covered entity' and 'third-party agent', setting the groundwork for understanding the applicability of the law. Notably, the act mandates that these entities implement cybersecurity programs aligned with nationally recognized standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, among others.
Contention
There are potential points of contention surrounding the bill, particularly regarding the balance of government liability and accountability. Critics may argue that limiting liability could discourage rigorous cybersecurity measures, as entities might rely on the protections offered by the bill as a shield against consequences of negligence. Additionally, concerns may be raised about the adequacy and sufficiency of the cybersecurity standards referred to in the bill, particularly whether they will effectively protect sensitive data. The bill's stipulations on compliance will need careful scrutiny to ensure they do not inadvertently create loopholes that could be exploited by less scrupulous entities.