Law / United States / 
Connecticut
Adoption of cybersecurity controls by businesses, exemption from punitive damages
Area: Cybersecurity law, also in Product and AI liability law.
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This is a safe harbor from punitive damages, not a duty: it is available to a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, sued in tort for a failure to implement reasonable cybersecurity controls that resulted in a data breach.
- To claim it, have created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards for personal and restricted information, at the time of the breach, designed to protect the information's security, confidentiality and integrity and scaled to the entity's size, complexity, activities, the sensitivity of the information, and the cost and availability of security tools.NIST CSF 2.0GV.PO-01
- The program must conform to the current version of a named framework (the National Institute of Standards and Technology (NIST) Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000-series), or, for an entity already regulated under Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Title V, FISMA or HITECH, conform to that regime, or comply with the PCI Data Security Standard together with another listed framework; conform to a revised version within six months of its publication.NIST CSF 2.0GV.OC-03
- The safe harbor is unavailable where the failure to implement reasonable cybersecurity controls was the result of gross negligence or wilful or wanton conduct. It creates no duty to adopt a program of its own, does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief, and leaves undisturbed the class-action certification process and the state's breach-notification statute.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Public Act 21-119 (2021) shields a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, from punitive damages in a tort action alleging that a failure to implement reasonable cybersecurity controls caused a data breach, where the entity created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards that conforms to a named industry framework.
The shield does not apply where the failure was the result of gross negligence or wilful or wanton conduct. The section creates no duty to adopt a program of its own and does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief. It leaves undisturbed the process for certifying a class action founded in tort. It also leaves undisturbed the requirements of the state's breach-notification statute at Section 36a-701b.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .