Requires businesses in financial, essential infrastructure, and health care industries to report cybersecurity incidents.
Impact
Under A1979, affected businesses will be required to notify the NJCCIC immediately after becoming aware of a cybersecurity incident. Additionally, the bill stipulates that these businesses must undergo an audit within 30 days of reporting an incident, conducted by an independent cybersecurity firm at their own expense. This introduces a new layer of regulatory scrutiny around cybersecurity practices in sectors deemed critical, contributing to a more secure business environment in New Jersey.
Summary
Assembly Bill A1979 mandates that certain businesses, specifically those operating within the financial, essential infrastructure, and healthcare sectors, must promptly report any cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). This legislation aims to enhance the state’s cybersecurity framework by ensuring that sensitive businesses are held accountable for any breaches that may jeopardize sensitive information. The bill defines a 'cybersecurity incident' broadly, capturing a variety of events that compromise the integrity and confidentiality of business operations.
Contention
Potential points of contention may arise regarding the financial responsibilities placed on businesses due to the requirement for audits, especially for smaller entities that might struggle to bear these additional costs. Moreover, some stakeholders could argue that the bill places an undue burden on businesses by further complicating compliance obligations and creating challenges in the case of reporting incidents without potential legal repercussions. Critics may call for more support for businesses in enhancing their cybersecurity measures rather than imposing fines or penalties for incidents that could stem from vulnerabilities beyond their control.
Requires businesses in financial essential infrastructure, and health care industries to develop cybersecurity plans and report cybersecurity incidents.
Requires all municipal corporations to report cybersecurity incidents and demands of ransom payments to the division of homeland security and emergency services; defines terms; requires cybersecurity incident reviews; requires cybersecurity awareness training, cybersecurity protection and data protection standards for state maintained information systems.
Requires all municipal corporations to report cybersecurity incidents and demands of ransom payments to the division of homeland security and emergency services; defines terms; requires cybersecurity incident reviews; requires cybersecurity awareness training, cybersecurity protection and data protection standards for state maintained information systems.
Requires businesses in financial essential infrastructure, and health care industries to develop cybersecurity plans and report cybersecurity incidents.
Relating to the establishment of the Texas Cyber Command and the transfer to it of certain powers and duties of the Department of Information Resources.