eNews: Action Alert – January 28, 2022

Friday, January 28, 2022 - 06:02pm

Oppose HB1290 (Hayes) – Cyber Security Incident Reporting

Download a one-page of this alert here >.

HB1290 (Hayes) would require all public bodies to report any known incidents that compromise and threaten the security of the public body’s information technology systems to the State Chief Information Officer (CIO) within 24 hours from when the incident was discovered.

Concerns

VML has serious concerns with this legislation due to the time constraint, lack of definitions, lack of reporting guidance, and the inability to meet with an insurance provider or cyber expert of your choice before having to report to the State.

Time Constraint: 24 hours is not enough time to properly assess the extent of the situation, formulate the best strategy, and speak with staff and other individuals affected.
Definitions: VML has serious concerns about the lack of definition of “incident”. Without a definitive definition the term “incident” becomes extremely vague allowing for misinterpretation on what constitutes as an incident that must be reported. Secondly, there is no specific language on what needs to be reported. Once again allowing for misinterpretation of what must be reported.
Reporting: HB1290 requires the public body to report the incident to the State before having the opportunity to discuss the matter with your insurance company, provider, or agency of choice. This creates another reporting mandate for public bodies.

Action Requested

VML asks that you contact your legislators and members of the Communications, Technology, and Innovations Committee to oppose this bill and to suggest that a study be conducted first. VML asks that you use this language to request to study: “The Virginia Information Technologies Agency, working with state and local stakeholders, should develop and publish guidance concerning the scope and implementation of the required incident reporting.”