Law / United States / 
New Jersey
Cybersecurity incident reporting by public agencies and government contractors
N.J. Stat. Ann. 52:17B-193.2 to 52:17B-193.4 (P.L. 2023, c.19)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds every public agency of the State or of a political subdivision and every government contractor, meaning an individual or entity that performs work for or on behalf of a public agency on a contract basis with access to or hosting of the agency's network, systems, applications, or information; a private business with no such contract is not bound and may report through the same system.
- Report each cybersecurity incident to the New Jersey Office of Homeland Security and Preparedness within 72 hours of when you reasonably believe that a cybersecurity incident has occurred.
These lines are LexLint's reading of the law's text, as of .
What this law does
Every public agency and government contractor must report cybersecurity incidents to the New Jersey Office of Homeland Security and Preparedness. The report is due within 72 hours of when the public agency or government contractor reasonably believes that a cybersecurity incident has occurred.
A government contractor is an individual or entity that performs work for or on behalf of a public agency on a contract basis with access to or hosting of the public agency's network, systems, applications, or information. A cybersecurity incident is a malicious or suspicious event occurring on or conducted through a computer network that jeopardizes the integrity, confidentiality, or availability of an information system or the information the system processes, stores, or transmits.
The reporting system must accept a cybersecurity incident notification from any individual or private entity, whether or not the entity is a public agency or government contractor. A cybersecurity incident notification submitted under the act is deemed confidential and non-public and is not subject to the Open Public Records Act. The act took effect immediately and was approved on .