New Jersey Assembly Bill A1979

New Jersey 2022-2023 Regular Session

• Introduced: 1/11/22
• Refer: 1/11/22

Caption

Requires businesses in financial, essential infrastructure, and health care industries to report cybersecurity incidents.

Impact

Under A1979, affected businesses will be required to notify the NJCCIC immediately after becoming aware of a cybersecurity incident. Additionally, the bill stipulates that these businesses must undergo an audit within 30 days of reporting an incident, conducted by an independent cybersecurity firm at their own expense. This introduces a new layer of regulatory scrutiny around cybersecurity practices in sectors deemed critical, contributing to a more secure business environment in New Jersey.

Summary

Assembly Bill A1979 mandates that certain businesses, specifically those operating within the financial, essential infrastructure, and healthcare sectors, must promptly report any cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). This legislation aims to enhance the state’s cybersecurity framework by ensuring that sensitive businesses are held accountable for any breaches that may jeopardize sensitive information. The bill defines a 'cybersecurity incident' broadly, capturing a variety of events that compromise the integrity and confidentiality of business operations.

Contention

Potential points of contention may arise regarding the financial responsibilities placed on businesses due to the requirement for audits, especially for smaller entities that might struggle to bear these additional costs. Moreover, some stakeholders could argue that the bill places an undue burden on businesses by further complicating compliance obligations and creating challenges in the case of reporting incidents without potential legal repercussions. Critics may call for more support for businesses in enhancing their cybersecurity measures rather than imposing fines or penalties for incidents that could stem from vulnerabilities beyond their control.