Law / United States / 
New Mexico
Cybersecurity incident reporting order for agencies and political subdivisions
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an agency or political subdivision of the state; non-executive agencies and tribal governments are strongly encouraged, not required, to comply voluntarily (Order paragraph 2 and closing paragraph).
- Within 24 hours of discovering a cybersecurity incident involving the public entity or one of its vendors, notify and consult with the Office of Cybersecurity (Order paragraph 2).
- Notify and consult with the Office of Cybersecurity before notifying or communicating with any other entity, unless law or contract requires you to notify another outside entity directly, in which case report the incident to the Office of Cybersecurity and to that entity simultaneously (Order paragraph 3).
- Make the notification by calling (833) 42-CYBER (833-422-9237), give the Office of Cybersecurity as much requested information as is available, and update the notification as requested information becomes available (Order paragraph 4).
- Keep support personnel available as the Office of Cybersecurity directs and ensure their full cooperation in the analysis, response and resolution of the incident (Order paragraph 6).
- Within 10 days of receiving the Order, designate a point of contact in the form and manner the Office of Cybersecurity specifies, and report any change of that contact within 10 days (Order paragraph 7).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Order directs an agency or political subdivision of the state to notify and consult with the Office of Cybersecurity within 24 hours of discovering a cybersecurity incident involving the public entity or one of its vendors. The affected public entity must notify and consult with the Office of Cybersecurity before notifying any other entity, unless law or contract requires it to notify another outside entity directly, in which case it reports to both at the same time.
A notification to the Office of Cybersecurity is made by calling (833) 42-CYBER (833-422-9237). Each agency and political subdivision must designate a point of contact within 10 days of receiving the Order. The Order adopts the definition of a cybersecurity incident developed by FISMA. Non-executive agencies and tribal governments are strongly encouraged to comply voluntarily with the Order. The Order is effective as of the date the security officer signed it. The security officer signed the Order on .