Law / United States / 
Illinois
Illinois Information Security Improvement Act, State agency suspension directives and local government cybersecurity duties
Information Security Improvement Act, 20 ILCS 1375/5-15, 5-30, 5-35
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each State agency (an agency, department, board or commission under the jurisdiction of the Governor to which the Department of Innovation and Technology provides services), each county and each municipality.
- As a State agency, comply with a directive of the Office of the Statewide Chief Information Security Officer to temporarily discontinue or suspend operations of an information system or information technology infrastructure.
- As a county or municipality, have every employee annually complete a cybersecurity training program that includes detecting phishing scams, preventing spyware infections and identity theft, and preventing and responding to data breaches.
- As a county, or a municipality with a population of 35,000 or greater, designate a local official or employee as the primary point of contact for local cybersecurity issues, and give that person's name and contact information to the Statewide Chief Information Security Officer, updating it as necessary.
These lines are LexLint's reading of the law's text, as of .
What this law does
The Act defines a State agency as any State agency, department, board, and commission under the jurisdiction of the Governor to which the Department provides services.
The Office of the Statewide Chief Information Security Officer may temporarily suspend operation of an information system or information technology infrastructure that is owned, leased, outsourced, or shared by one or more State agencies to isolate the source of, or stop the spread of, an information security breach or other similar information security incident.
State agencies must comply with directives to temporarily discontinue or suspend operations of information systems or information technology infrastructure. Every employee of a county or municipality must annually complete a cybersecurity training program. The training must include detecting phishing scams, preventing spyware infections and identity theft, and preventing and responding to data breaches. Section 5-30 carries the source note Public Act 102-753, effective .
The principal executive officer, or a designee, of each municipality with a population of 35,000 or greater and of each county must designate a local official or employee as the primary point of contact for local cybersecurity issues. Each such jurisdiction must provide the name and contact information of the cybersecurity designee to the Statewide Chief Information Security Officer and update the information as necessary. Section 5-35 appears in its current form under Public Act 104-195, effective .