Amendment S-5086 to SF 2391

Filed March 11, 2020 in the Senate by ERIC GIDDENS

What it changes

1. By striking everything after the enacting clause and inserting: “Section
2. NEW SECTION . 8H.1 Requirement to report a ransomware attack. If the state or a political subdivision of the state is subject to a ransomware attack, the state or the political subdivision shall provide notice of the ransomware attack to the office of the chief information officer following discovery of the ransomware attack. The notice shall be provided in the most expeditious manner possible and without unreasonable delay. The office of the chief information officer shall adopt rules establishing notification procedures pursuant to this section. For purposes of this chapter, “ransomware attack” means carrying out until payment is made, or threatening to carry out until payment is made, any of the following actions: an act declared unlawful pursuant to section 715.4; a “breach of security” as defined in section 715C.1; or the use of any form of software that results in the unauthorized encryption of data, the denial of access to data, the denial of access to a computer, or the denial of access to a computer system. Sec.
3. RANSOMWARE TASK FORCE.
4. The office of the chief information officer and the department of homeland security and emergency management shall convene a task force to meet during the 2020 legislative interim to study the threat of ransomware.
5. The voting members of the task force shall consist of representatives of the office of the chief information officer, the department of homeland security and emergency management, the department of administrative services, political subdivisions, school boards, municipal utilities, county associations, city associations, the Iowa association of school boards, the university of Iowa hospitals and clinics, and Broadlawns medical center.
6. Four legislative members shall be appointed as ex officio, nonvoting members with one member to be appointed by each of the following: the majority leader of the senate, the minority leader of the senate, the speaker of the house of representatives, and the minority leader of the house of representatives. A representative from the office of the governor shall serve as a fifth ex officio, nonvoting member.
7. The task force shall study issues related to ransomware and how to best mitigate the risks associated with ransomware. The task force shall submit a report, including findings and recommendations for policy changes, to the general assembly by December 31,
8. ”
9. Title page, by striking lines 1 through 3 and inserting “An Act relating to ransomware attacks in connection with the state and political subdivisions of the state.”
10. By renumbering as necessary.

Official amendment (PDF) · In the Bill Book