eNews: Action Alert – January 31, 2022
Monday, January 31, 2022 - 02:49pm
Oppose HB1290 / SB764 – Cyber Security 
Incident Reporting
A one-page of the below information is available here >.
HB1290 (Hayes) was heard in the House Communications, Technology, and Innovations Committee this morning. Despite multiple speakers in opposition, HB1290 passed 18-2 with amendments. The amendments create a work group with various stakeholders, including VML, to further discuss this issue. However, reporting must still occur while the work group convenes.
Action Requested
VML asks our members to contact the members of the House of Delegates and urge them to oppose HB1290. VML also asks that you contact members of the Senate Committee on General Laws (see below) urging them to oppose the Senate version – SB764 (Barker) – as well. SB764 may be on the docket as early as Wednesday, February 5th.
Concerns
HB1290 and SB764 would require all public bodies to report any known incidents that compromise and threaten the security of the public body’s information technology systems to the State Chief Information Officer (CIO) within 24 hours from when the incident was discovered.
VML has serious concerns with this legislation due to the time constraint, lack of definitions, lack of reporting guidance, and the inability to meet with an insurance provider or cyber expert of your choice before having to report to the State.
- Time Constraint: 24 hours is not enough time to properly assess the extent of the situation, formulate the best strategy, and speak with staff and other individuals affected.
- Definitions: VML has serious concerns about the lack of definition of “incident”. Without a definitive definition the term “incident” becomes extremely vague allowing for misinterpretation on what constitutes as an incident that must be reported. Secondly, there is no specific language on what needs to be reported. Once again allowing for misinterpretation of what must be reported.
- Reporting: HB1290 / SB764 requires the public body to report the incident to the State before having the opportunity to discuss the matter with your insurance company, provider, or agency of choice. This creates another reporting mandate for public bodies.
Current GA Committees:
HB1290 – Full House of Delegates
SB764 – Senate Committee on General Laws:
| Barker | district39@senate.virginia.gov | (804) 698-7539 |
| Ruff | district15@senate.virginia.gov | (804) 698-7515 |
| Locke | district02@senate.virginia.gov | (804) 698-7502 |
| Vogel | district27@senate.virginia.gov | (804) 698-7527 |
| Ebbin | district30@senate.virginia.gov | (804) 698-7530 |
| Reeves | district17@senate.virginia.gov | (804) 698-7517 |
| McPike | district29@senate.virginia.gov | (804) 698-7529 |
| Dunnavant | district12@senate.virginia.gov | (804) 698-7512 |
| Mason | district01@senate.virginia.gov | (804) 698-7501 |
| Boysko | district33@senate.virginia.gov | (804) 698-7533 |
| Stuart | district28@senate.virginia.gov | (804) 698-7528 |
| Pillion | district40@senate.virginia.gov | (804) 698-7540 |
| Bell | district13@senate.virginia.gov | (804) 698-7513 |
| Hashmi | district10@senate.virginia.gov | (804) 698-7510 |
| Kiggans | district07@senate.virginia.gov | (804) 698-7507 |
VML Staff Contact: Josette Bulova, jbulova@vml.org
