Law / United States / 
California
Cyberattack reporting by local educational agencies to the California Cybersecurity Integration Center
Cal. Educ. Code secs. 35265 and 35266 (AB 2355)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a local educational agency, meaning a school district, county office of education, or charter school; it does not bind a private business.
- Report any cyberattack impacting more than 500 pupils or personnel to the California Cybersecurity Integration Center, which keeps a database of the reports and reports annually to the Governor and the Legislature.
- The duty ends on , when the article is repealed by its own terms; the section does not affect any disclosure or notification required by Civil Code sections 1798.29 and 1798.82.
These lines are LexLint's reading of the law's text, as of .
What this law does
A local educational agency shall report any cyberattack impacting more than 500 pupils or personnel to the California Cybersecurity Integration Center. A local educational agency, for the purposes of the article, means a school district, county office of education, or charter school.
A cyberattack, for the purposes of the article, is an alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by unauthorized access, or the unauthorized denial of access to legitimate users of a computer system, computer network, computer program, or data. The section does not affect any disclosure or notification requirements under sections 1798.29 and 1798.82 of the Civil Code.
Article 8.5 of the Education Code, which holds the section, remains in effect only until , and is repealed as of that date. The section was added by Assembly Bill 2355, chapter 498 of the Statutes of 2022, effective .