Law / United States / 
Iowa
Tort Liability for Cybersecurity Programs, affirmative defense for a reasonable security program
Area: Cybersecurity law, also in Product and AI liability law.
Iowa Code ch. 554G (554G.1 to 554G.4, added by 2023 Acts, ch. 63 (H.F. 553))
In force since .
A security baseline statutes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Security
What it requires
- This affirmative defense is available to a covered entity, a business, defined to include a financial institution and an entity organized under chapter 28E, that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa; a municipality is excluded from the definition of business, and the chapter creates no independent duty to adopt a cybersecurity program.
- To claim the defense against a tort claim alleging that a failure to implement reasonable information security controls resulted in a data breach of personal information or restricted information, create, maintain, and comply with a written cybersecurity program containing administrative, technical, operational, and physical safeguards, designed to continually evaluate and mitigate reasonably anticipated threats, evaluate the maximum probable loss from a data breach at least annually, and communicate to affected parties the extent of any risk and steps to reduce damages once a breach is known to have occurred.NIST CSF 2.0GV.PO-01NIST CSF 2.0ID.RA-04NIST CSF 2.0RS.CO-02
- Fund the program at a scale and scope that is appropriate if the cost to operate it is no less than the covered entity's most recently calculated maximum probable loss value.NIST CSF 2.0GV.RR-03
- Satisfy the framework requirement by reasonably conforming the program to a named industry-recognized cybersecurity framework (the National Institute of Standards and Technology (NIST) framework for improving critical infrastructure cybersecurity, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family), or, where already regulated under one, by conforming the program to the entirety of Health Insurance Portability and Accountability Act (HIPAA)'s Security Rule, Gramm-Leach-Bliley Title V, the federal Information Security Modernization Act of 2014, HITECH, Iowa's own Insurance Data Security Act (chapter 507F), or applicable federal critical-infrastructure-protection rules, or by combining PCI Data Security Standard compliance with one of the named frameworks; conform the program to a revised framework or amended regulation within one year of its publication or effective date.NIST CSF 2.0GV.OC-03
- This section creates no private right of action, including a class action, for a person's failure to comply with it: it is a defense available in litigation another statute or the common law already permits, never an independent basis to sue.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-03Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-04Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
- RS.CO-02Internal and external stakeholders are notified of incidents
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
A covered entity is a business that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa. Business is defined to include a financial institution and an entity organized under Iowa Code chapter 28E, but not a municipality.
A covered entity that satisfies this chapter's requirements gains an affirmative defense to a tort claim alleging that a failure to implement reasonable information security controls caused a data breach concerning personal information or restricted information. To satisfy those requirements, a covered entity must create, maintain, and comply with a written cybersecurity program that reasonably conforms to a named industry framework or an applicable regulatory regime.
The program's scale and scope is appropriate if it is funded at or above the covered entity's own most recently calculated maximum probable loss from a data breach. The chapter imposes no independent duty to adopt a program and creates no private right of action of its own for failing to comply with it.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .