Relating to affirmative defenses for entities using cybersecurity programs

This bill creates affirmative defenses for entities using cybersecurity programs. The bill provides that a covered entity seeking an affirmative defense must use a cybersecurity program for the protection of personal information and restricted information and the cybersecurity program must reasonably conform to an industry-recognized cybersecurity framework. A cybersecurity program must continually evaluate and mitigate reasonably anticipated threats, periodically evaluate the maximum probable loss attainable from a data breach, and communicate to affected parties the risk posed and actions the affected parties could take to reduce damages if a data breach has occurred. The scale and scope of a cybersecurity program is appropriate if the cost to operate the program is no less than the covered entity’s maximum probable loss value. A covered entity that satisfies these requirements and that reasonably conforms to an industry-recognized cybersecurity framework is entitled to an affirmative defense to a tort claim that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information. The bill details industry-recognized cybersecurity frameworks that the covered entity may follow and reasonably comply with in order to qualify for the affirmative defense. The bill does not provide a private right of action, including a class action.