Law / United States / 
North Carolina
Cybersecurity incident reporting by State agencies and local government entities to the Department of Information Technology
N.C. Gen. Stat. section 143B-1379
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds the head of each principal department and Council of State agency, and each local government entity (a local political subdivision of the State, including a city, a county, a local school administrative unit, or a community college); it does not bind a private business, which is only encouraged to report.
- As the head of a principal department or Council of State agency, provide the Department of Information Technology the full details of all of the agency's significant cybersecurity incidents within 24 hours of confirmation.
- As a local government entity, report cybersecurity incidents to the Department of Information Technology.
- As the head of a principal department or Council of State agency, also provide the Department comprehensive information on the information technology security protecting the agency's data, including remedial or corrective action plans, a forecast of the agency's projected cybersecurity and privacy needs and capabilities, a designated information technology liaison, and completion of mandatory annual security awareness training for all personnel, including contractors.
These lines are LexLint's reading of the law's text, as of .
What this law does
The head of each principal department and Council of State agency must provide the Department of Information Technology the full details of all of the agency's significant cybersecurity incidents within 24 hours of confirmation. Local government entities, as defined in section 143-800(c)(1), must report cybersecurity incidents to the Department.
A local government entity is a local political subdivision of the State, including a city, a county, a local school administrative unit, or a community college. Private sector entities are encouraged to report cybersecurity incidents to the Department.
A significant cybersecurity incident is a cybersecurity incident that is likely to result in demonstrable harm to the State's security interests, economy, critical infrastructure, or to the public confidence, civil liberties, or public health and safety of the residents of North Carolina.