Law / United States / 
North Carolina
Ransomware payments by State agencies and local government entities
N.C. Gen. Stat. section 143-800
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting, Prohibition
As of .
What it requires
- This duty binds a State agency (any agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branches of State government, including The University of North Carolina) and a local government entity (a local political subdivision of the State, including a city, a county, a local school administrative unit, or a community college); it does not bind a private business.
- Do not submit payment, or otherwise communicate, with an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then subsequently offering to decrypt that data in exchange for a ransom payment.
- When you experience a ransom request in connection with a cybersecurity incident, consult the Department of Information Technology in accordance with section 143B-1379.
These lines are LexLint's reading of the law's text, as of .
What this law does
A State agency or local government entity may not submit payment to, or otherwise communicate with, an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then subsequently offering to decrypt that data in exchange for a ransom payment. A State agency or local government entity experiencing a ransom request in connection with a cybersecurity incident must consult the Department of Information Technology.
A State agency is any agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branches of State government, and includes The University of North Carolina.