Law / United States / 
Arkansas
Arkansas Self-Funded Cyber Response Program Act, mandatory participation and minimum cybersecurity criteria
In force.
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each county, each municipality (a city of the first class, a city of the second class or an incorporated town) and each school district or open-enrollment public charter school in Arkansas, each a participating governmental entity.
- Participate in the Arkansas Self-Funded Cyber Response Program administered by the Arkansas Cyber Response Board.
- Become compliant with the minimum cybersecurity criteria the board establishes within twelve months; failing to comply may reduce your program coverage.
- To sustain program coverage, procure an audit of your books and records for each fiscal year, including an information systems audit, review, or assessment performed by Arkansas Legislative Audit or, if it does not audit you, by an accountant in good standing under government auditing standards, completed within eighteen months of the close of your fiscal year.
These lines are LexLint's reading of the law's text, as of .
What this law does
All municipalities, counties, and school districts in Arkansas shall participate in the Arkansas Self-Funded Cyber Response Program. The Arkansas Cyber Response Board shall establish minimum cybersecurity criteria for participating governmental entities. A participating governmental entity shall have twelve months to become compliant with the minimum cybersecurity criteria established by the board.
Failure to comply with the minimum cybersecurity criteria may result in the board establishing lower program coverage amounts. To sustain program coverage, a participating governmental entity shall procure an audit of its books and records for each fiscal year, including an information systems audit, review, or assessment performed by Arkansas Legislative Audit.
Arkansas Legislative Audit reports that Act 846 of 2023 authorized formation of the Arkansas Cyber Response Board to oversee the Arkansas Self-Funded Cyber Response Program. The board shall promulgate rules and procedures for use of the program that generally align with a procedure under which a participating governmental entity notifies the cyber response contact designated by the board upon discovery of a cyberattack.