Law / United States / 
Arkansas
Public entity security incident report to the Legislative Auditor
Public entity security incident report, Ark. Code Ann. section 10-4-429, Act 260 of 2021
In force.
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds each public entity: an entity of the state, a political subdivision of the state, or a school.
- When you experience a security incident (any compromise of the security, confidentiality, or integrity of an information system you or a contractual provider maintain, or of your other computer-related services, caused by unauthorized access, destruction, or acquisition of data), give the Legislative Auditor a written initial report of the known facts within five business days after learning of it.
- Give the Legislative Auditor regular updates on the incident until the investigation is closed.
These lines are LexLint's reading of the law's text, as of .
What this law does
A public entity means an entity of the state, a political subdivision of the state, or a school. A security incident means any compromise of the security, confidentiality, or integrity of an information system maintained by a public entity, a contractual provider of an information system that contracts with a public entity, or other computer-related services of a public entity, caused by unauthorized access, destruction, or acquisition of data.
A public entity that experiences a security incident shall disclose, in writing, an initial report of the known facts of the incident to the Legislative Auditor within five business days after learning of the incident. A public entity shall provide regular updates of the security incident to the Legislative Auditor until the investigation of the incident is closed. The Legislative Auditor shall maintain a list of all security incidents reported by a public entity.
If the Legislative Auditor believes an incident significantly compromises citizens' data, creates a significant security concern, or involves significant theft, the Legislative Auditor shall notify a list of state officials beginning with the Governor. A report, update, notification, or list created or maintained under the section is exempt from disclosure under the Freedom of Information Act of 1967. The section was amended by Act 175 of 2023, effective .
Arkansas Legislative Audit reports that 217 cybersecurity incidents were reported to it by 124 public entities from through .