Law / United States / 
North Dakota
Cybersecurity Incident Reporting Requirements, disclosure of a cybersecurity incident to the Information Technology Department
In force.
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds an executive branch state agency or a political subdivision within North Dakota; it does not bind a private business, and the legislative and judicial branches may disclose incidents but are not required to.
- Disclose to the information technology department an identified or suspected cybersecurity incident that affects the confidentiality, integrity, or availability of information systems, data, or services, in the most expedient time possible and without unreasonable delay.
- Report suspected breaches; malware incidents that cause significant damage; denial of service attacks that affect the availability of services; demands for ransom related to a cybersecurity incident or unauthorized disclosure of digital records; identity theft or identity fraud services hosted on your information technology systems; incidents that require response and remediation efforts that will cost more than ten thousand dollars in equipment, software, and labor; and other incidents you deem worthy of communication to the department.
- Until the incident is resolved, disclose clarifying details to the department: the number and type of potentially exposed records, the efforts you are undertaking to mitigate and remediate the damage, and the expected impact, including disruption of your services and the effect on customers and employees.
- Disclose through the methods the department establishes and makes known for securely disclosing cybersecurity incidents.
These lines are LexLint's reading of the law's text, as of .
What this law does
An entity must disclose to the information technology department an identified or suspected cybersecurity incident that affects the confidentiality, integrity, or availability of information systems, data, or services. The disclosure must be made in the most expedient time possible and without unreasonable delay. An entity is an executive branch state agency or a political subdivision within the state.
Until a cybersecurity incident is resolved, an entity must disclose clarifying details to the department, including the number of potentially exposed records, the type of records, its mitigation and remediation efforts, and the expected impact of the incident. The legislative and judicial branches may disclose cybersecurity incidents to the department but are not required to.
The department must establish and make known the methods an entity must use to securely disclose cybersecurity incidents to the department. The department must report all disclosed cybersecurity incidents to the legislative management, including the status of each incident and any response or remediation.