Law / United States / 
Kansas
Kansas Cybersecurity Act, notification of a significant cybersecurity incident by a public entity or government contractor
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a public entity (any public agency of the state or of a political subdivision) and a government contractor (an individual or private entity performing work for or on behalf of the state under contract that has access to or hosts state networks, systems, applications or information).
- A public entity that has a significant cybersecurity incident must notify the Kansas information security office within 12 hours after discovery.
- A government contractor with a significant cybersecurity incident that involves the confidentiality, integrity or availability of personal information or confidential information provided by the state, or of networks or information systems operated by or on behalf of the state, must notify the Kansas information security office within 72 hours after it reasonably believes the incident occurred, or within 12 hours after a determination during the investigation that such information, networks or systems were directly impacted.
- If the incident involves election data, also notify the secretary of state within the same time period.
- An entity connected to the Kansas criminal justice information system reports a cybersecurity incident under the rules of the Kansas criminal justice information system committee instead, and is not required to make the report above if it is connected to no other state of Kansas information system.
These lines are LexLint's reading of the law's text, as of .
What this law does
A public entity that has a significant cybersecurity incident must notify the Kansas information security office within 12 hours after discovery of the incident. A government contractor with a significant cybersecurity incident involving state personal information, confidential information, networks or information systems must notify the office within 72 hours after it reasonably believes the incident occurred.
A government contractor must notify the office within 12 hours after a determination during the investigation that the state's information, networks or systems were directly impacted. An incident involving election data must also be reported to the secretary of state within the same time period. A significant cybersecurity incident is one that results in or is likely to result in financial loss or demonstrable harm to public confidence or public health and safety in the state of Kansas.
The act that added the section was approved , and takes effect from and after its publication in the statute book.