Law / United States / 
New Mexico
Cybersecurity Act, cybersecurity office powers over state agencies
In force since .
A sector security regimes rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds the executive cabinet agencies and their administratively attached agencies, offices, boards and commissions, which the Cybersecurity Act calls agencies, and the cybersecurity office that oversees their cybersecurity and information security (NMSA 9-27A-2(A) and 9-27A-3(B)).
- Meet the minimum security standards and policies that the cybersecurity office may adopt by rule to protect agency information technology systems and infrastructure (NMSA 9-27A-3(B)(1)).
- Make agency system event logs available to the cybersecurity office, which may obtain them as reasonably necessary to monitor agency networks and detect security incidents (NMSA 9-27A-3(B)(3) and (4)).
- Comply with orders the security officer may issue regarding agency compliance with the guidelines or recommendations of the cybersecurity advisory committee; compliance by non-executive agencies and by county, municipal and tribal governments is strictly voluntary (NMSA 9-27A-5(E)).
- Use the centralized cybersecurity and data breach reporting process for agencies and political subdivisions of the state that the cybersecurity office may establish (NMSA 9-27A-3(B)(12)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Cybersecurity Act took effect on . The cybersecurity office is managed by the security officer. The security officer is the state chief information security officer. The Act defines an agency as the executive cabinet agencies and their administratively attached agencies, offices, boards and commissions. The cybersecurity office may adopt and implement rules establishing minimum security standards and policies to protect agency information technology systems and infrastructure.
The security officer may issue orders regarding the compliance of agencies with guidelines or recommendations of the cybersecurity advisory committee. Compliance with those guidelines or recommendations by non-executive agencies or county, municipal or tribal governments is strictly voluntary. The cybersecurity office may establish a centralized cybersecurity and data breach reporting process for agencies and political subdivisions of the state.