Prohibiting the state or a political subdivision of the state from expending revenue received from taxpayers for payment to persons responsible for ransomware attacks, and including effective date provisions

The bill defines “political subdivision” as a city, county, township, or school district.1, or the use of any form of software that results in the unauthorized encryption of data, the denial of access to data, the denial of access to a computer, or the denial of access to a computer system. The bill requires that when the state or a political subdivision of the state is subject to a ransomware attack and discovers the attack, the state or political subdivision shall expeditiously provide notice to the office of the chief information officer. The office of the chief information officer shall adopt rules establishing notification procedures. The bill provides that the state or a political subdivision of the state shall not expend revenue received from taxpayers for payment to a person responsible for, or reasonably believed to be responsible for, a ransomware attack. The bill allows the office of the chief information officer to authorize such expenditures in the event of a critical or emergency situation as determined by the department of homeland security and emergency management and requires the office of the chief information officer to notify the departments of the expenditures. The bill provides that information related to a political subdivision’s insurance coverage for cybersecurity or ransomware attack shall be considered confidential records. The bill provides that the state or a political subdivision of the state may use taxpayer revenue to pay for cybersecurity insurance or related ransomware insurance at any time if the state or political subdivision first exhausts all other reasonable means of mitigating a potential ransomware attack. The bill includes a legislative intent section, which provides that it is the intent of the general assembly that the state and political subdivisions of the state have tested cybersecurity mitigation plans and policies. The bill takes effect July 1, 2024, except for the section of the bill requiring the office of the chief information officer to prepare a notice of intended action (NOIA) for the adoption of rules, which takes effect upon enactment. The NOIA must be submitted to the administrative rules coordinator and administrative code editor as soon as possible and no later than October 1, 2023.5(2)(b).