Law / United States / 
Minnesota
Minnesota cybersecurity incident reporting by public agencies and government contractors
Minn. Stat. section 16E.36 (Laws 2024, chapter 123, article 17, section 24)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a public agency (a state agency, local government, school district, charter school, intermediate district, cooperative unit or public postsecondary education institution) and a government contractor or vendor that provides goods or services to one; it does not bind a private business that has no public-agency customer.
- If you are a public agency, report a cybersecurity incident that impacts you to the commissioner within 72 hours of when you reasonably identify or believe that the incident has occurred, beginning .
- If you are a government contractor or vendor that provides goods or services to a public agency, report a cybersecurity incident to that public agency within 72 hours of when you reasonably identify or believe that it has occurred, if the incident impacts the agency.
These lines are LexLint's reading of the law's text, as of .
What this law does
Beginning , the head of or the decision-making body for a public agency must report a cybersecurity incident that impacts the public agency to the commissioner. A government contractor or vendor that provides goods or services to a public agency must report a cybersecurity incident to the public agency if the incident impacts the public agency.
The report must be made within 72 hours of when the public agency or government contractor reasonably identifies or believes that a cybersecurity incident has occurred. The section defines a public agency to include school districts, charter schools, intermediate districts, cooperative units under section 123A.24, subdivision 2, and public postsecondary education institutions.
The commissioner must coordinate with the superintendent of the Bureau of Criminal Apprehension to promptly share reported cybersecurity incidents. The cyber incident reporting system must securely accept a cybersecurity incident notification from any individual or private entity, whether or not the entity is a public agency or government contractor.