Sponsored by:
Senator KRISTIN M. CORRADO
District 40 (Bergen, Essex and Passaic)
SYNOPSIS
Requires certain procedures, reports, and training for municipalities, counties, and school districts in response to cybersecurity incidents.
CURRENT VERSION OF TEXT
As introduced.
An Act concerning cybersecurity incidents, including reporting procedures and training, for municipalities, counties, and school districts, and supplementing chapter 17B of Title 52 of the Revised Statutes.
Be It Enacted by the Senate and General Assembly of the State of New Jersey:
1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill):
"County" means any county of any class of this State, and any authority, commission, agency, or instrumentality of a county.
"Cybersecurity incident" means an event occurring on or conducted through a computer network that jeopardizes the integrity, confidentiality, or availability of, or information residing on, computers, information systems, communication system networks, physical or virtual infrastructure controlled by computers, or information systems.
"Department" means the Department of Law and Public Safety.
"Governing body" means the body exercising general legislative powers in a county or municipality according to the terms and procedural requirements set forth in the form of government adopted by the county or municipality.
"Information resource" means information and related resources, such as personnel, equipment, funds, and information technology.
"Information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.
"Municipality" means any city of any class, any town, township, village, or borough of this State, other than a county or a school district, and any authority, commission, agency, or instrumentality of a municipality.
"New Jersey Cybersecurity and Communications Integration Cell" means the New Jersey Cybersecurity and Communications Integration Cell established pursuant to Executive Order No. 178 of 2015 in the New Jersey Office of Homeland Security and Preparedness, or any successor entity.
"School district" means a local or regional school district established pursuant to chapter 8 or chapter 13 of Title 18A of the New Jersey Statutes, a county special services school district established pursuant to article 8 of chapter 46 of Title 18A of the New Jersey Statutes, a county vocational school district established pursuant to article 3 of chapter 54 of Title 18A of the New Jersey Statutes, and a district under full State intervention pursuant to P.L.1987, c.399 (C.18A:7A-34 et al.).
2. a. The Attorney General, in consultation with the New Jersey Cybersecurity and Communications Integration Cell, shall develop an online cybersecurity incident reporting form and cybersecurity awareness training program on the New Jersey Cybersecurity and Communications Integration Cells Internet website, specifically for use by a designated employee of:
(1) a governing body of a municipality;
(2) a governing body of a county; or
(3) a school district.
b. A designated employee of a municipality, county, or school district that has been made aware of a cybersecurity incident shall promptly complete and submit a cybersecurity incident online form developed pursuant to subsection a. of this section if the cybersecurity incident has:
(1) compromised the confidentiality, integrity, availability, or privacy of the billing, communications, data management or information systems, or the information resources thereon, of a municipality, county, or school district where the employee works; or
(2) compromised a municipalitys, countys, or school districts industrial control system, if applicable, including monitoring operations and centralized control systems that adversely impacted, disabled, or manipulated infrastructure, resulting in loss of service or damage to infrastructure.
c. No later than 30 days after receiving a cybersecurity incident reporting form that has been submitted through the online form developed pursuant to subsection a. of this section, the New Jersey Cybersecurity and Communications Integration Cell shall contract with an independent cybersecurity company to audit the cybersecurity program of the municipality, county, or school district that submitted the form, and to audit any actions the municipality, county, or school district took in response to the cybersecurity incident.
d. The audit of a municipality, county, or school district required pursuant to subsection c. of this section shall be provided by the independent cybersecurity company to the municipality, county, or school district, and shall identify:
(1) cyber threats and vulnerabilities to a municipality, county, or school district;
(2) weaknesses in the municipalitys, countys, or school districts cybersecurity program; and
(3) strategies to address those weaknesses to protect the municipality, county, or school district from the threat of future cybersecurity incidents.
e. The audit required pursuant to subsection c. of this section shall be conducted by a qualified and independent cybersecurity company and shall be paid for by the department.
f. Following an audit required pursuant to subsection c. of this section, the governing body of a municipality, county, or school district shall submit the audit and any corrective action plans derived from the audit to the New Jersey Cybersecurity and Communications Integration Cell.
g. (1) Not less than six months following an audit required pursuant to subsection c. of this section, but not more than once in each calendar year, all county and municipal officers and employees, including all school district employees, shall complete the cybersecurity awareness training program, developed pursuant to subsection a. of this section. An officer or employee shall verify completion of the program to the governing body of each county or municipality, or school district, as appropriate. The governing body of each municipality, county, or school district, as appropriate, shall report completion of the program to the New Jersey Cybersecurity and Communications Integration Cell, or an authorized designee.
(2) The governing body of each municipality, county, or school district, as appropriate, shall require periodic audits by appropriate persons to ensure compliance with the requirements set forth in this subsection.
h. A municipality, county, or school district may apply to the department, in a form and manner to be determined by the department, for reimbursement for costs incurred pursuant to the requirements of P.L. , c. (C. ) (pending before the Legislature as this bill). The department shall reimburse municipalities, counties, and school districts for all valid costs subject to an application submitted pursuant to this subsection.
i. Information collected and shared by a municipality, county, or school district concerning the cybersecurity incident reported pursuant to subsection b. of this section, the audit required pursuant to subsection c. of this section, the training program required pursuant to subsection g. of this section, and any corrective action plan derived therefrom, shall be exempt from disclosure pursuant to the provisions of P.L.1963, c.73 (C.47:1A-1 et seq.), commonly known as the open public records act.
3. This act shall take effect immediately.