Law / United States / 
Georgia
Georgia Cyber Attack Reporting by Agencies
Cyber Attack Reporting by Agencies, O.C.G.A. s. 38-3-22.2(b)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every agency in Georgia: the executive, judicial and legislative branches and their bodies, every county, municipal corporation, school district and other political subdivision and their bodies, and every city, county, regional or other authority established under state law, except a county, municipal corporation, public corporation or authority acting as a provider of wholesale or retail electric or gas service (O.C.G.A. 38-3-22.2(a)(1)).
- Report to the director of emergency management and homeland security, or the director's designee, any cyber attack incident, data breach or identified use of malware on an agency computer or network that the director determines is of a type to create a life-safety event, substantially impact the security of data and information systems, or affect critical systems, equipment or service delivery (O.C.G.A. 38-3-22.2(b)(1)).
- If the incident is one you must report, or choose to report, to the United States government or any of its agencies, you satisfy the reporting duty by giving the director substantially the same information within two hours of making that federal report (O.C.G.A. 38-3-22.2(b)(2)).
- Make the report by the mechanism, with the information and within the time frame that the director specifies in rules approved by the Governor (O.C.G.A. 38-3-22.2(b)(3)).
- Notify any person impacted by the incident wherever other law, including Article 34 of Chapter 1 of Title 10, requires it, because this Code section does not relieve you of that duty (O.C.G.A. 38-3-22.2(e)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 38-3-22.2(b)(1) requires every agency to report to the director of emergency management and homeland security, or the director's designee, any cyber attack incident, data breach, or identified use of malware on an agency computer or network that the director determines is of a type to create a life-safety event, substantially impact the security of data and information systems, or affect critical systems, equipment, or service delivery.
The agency reporting duty is satisfied if the incident is one the agency must or elects to report to the United States government and, within two hours of that report, the agency gives the director substantially the same information. The term agency includes every county, municipal corporation, school district, or other political subdivision of the state.
The term agency does not include a county, municipal corporation, or public corporation, or an authority of one of them, when it is acting as a provider of wholesale or retail electric or gas service. The director of emergency management and homeland security must, subject to approval by the Governor, promulgate rules and regulations specifying the reporting mechanism, the required information and the time frame for a report under paragraph (1).
Reports or records produced under section 38-3-22.2 are not subject to public inspection or disclosure under Article 4 of Chapter 18 of Title 50. Nothing in section 38-3-22.2 relieves an agency or utility of any duty that may exist under law to notify any person impacted by a cyber attack incident, data breach, or identified use of malware. The Act that added section 38-3-22.2 became effective upon its approval by the Governor or upon its becoming law without such approval. Governor Brian Kemp signed House Bill 156 into law on .