Cybersecurity Policy Report, N.D. Governor Signs Bill to Address Government Data Breaches, (Mar 26, 2021)

BY R. Jason Howard, J.D.

North Dakota Gov. Doug Burgum (R.) on Tuesday signed into law legislation (HB 1314) that imposes a data breach notification requirement on specified state agencies.

The legislation defines "entity" as "an executive branch state agency or a political subdivision within the state" and requires that the disclosure of a cybersecurity incident "that affects the confidentiality, integrity, or availability of information systems, data, or services" be made as expediently as possible to the information technology department. The legislation also requires ongoing disclosure of details regarding the incident, including the following:

1. The number of potentially exposed records;

2. The type of records potentially exposed, including health insurance information, medical information, criminal justice information, regulated information, financial information, and personal information;

3. Efforts the entity is undertaking to mitigate and remediate the damage of the incident to the entity and other affected entities; and

4. The expected impact of the incident, including service disruptions, the effect on customers and employees, the effect on entities receiving wide area network services from the department, and other concerns that may affect the state.

The legislation provides that cybersecurity incidents may be disclosed to the information technology department by the legislative and judicial branches, and it requires that the information technology department establish methods for the secure disclosure of cybersecurity incidents.

In addition, the legislation requires that the information technology department provide, to the extent possible, "consultation services and other resources to assist entities and the legislative and judicial branches in responding to and remediating cybersecurity incidents."

News: StateLegislation DataBreach DataSecurity