Relating to affirmative defenses for entities using cybersecurity programs

This bill relates to cybersecurity programs, affirmative defenses, and distributed ledger technology. The bill provides that a record or signature shall not be denied legal effect because it is created or stored by means of distributed ledger technology or smart contract, as those terms are defined in the bill.106A. The bill creates affirmative defenses for entities using cybersecurity programs and provides definitions. The bill provides that a covered entity seeking an affirmative defense must use a cybersecurity program for the protection of personal information and restricted information and the cybersecurity program must reasonably conform to an industry-recognized cybersecurity framework. A cybersecurity program must continually evaluate and mitigate reasonably anticipated threats, periodically evaluate the maximum probable loss attainable from a data breach, and communicate to affected parties the risk posed and actions the affected parties could take to reduce damages if a data breach has occurred. The scale and scope of a cybersecurity program is appropriate if the cost to operate the program is no less than the covered entity’s maximum probable loss value. A covered entity that satisfies these requirements and that reasonably conforms to an industry-recognized cybersecurity framework is entitled to an affirmative defense to a tort claim that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information. The bill details industry-recognized cybersecurity frameworks that the covered entity may follow and reasonably comply to in order to qualify for the affirmative defense. The bill does not provide a private right to action, including a class action.