Law / United States / 
New Mexico
Executive Order 2024-011, state agency cybersecurity and privacy policies at NIST moderate-impact baselines
Executive Order 2024-011, Strengthening State Agency Cybersecurity, paragraphs 1 to 3
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
What it requires
- This binds the state agencies of the executive branch, meaning the departments, offices, boards, commissions and other agencies within the Executive Branch under gubernatorial control, and the Department of Information Technology; all other public bodies are strongly encouraged, not required, to comply voluntarily (Order paragraphs 1 to 4 and the Order's definition of state agencies).
- State agencies: adopt and implement cybersecurity, information security and privacy policies, standards and procedures based upon no less than moderate-impact security control baselines, frameworks and standards issued by the National Institute of Standards and Technology (Order paragraph 2).
- State agencies: certify compliance with the applicable standard, in the form and manner the Department of Information Technology and the Office of the Governor specify, by , and on an annual basis thereafter (Order paragraph 2).
- A state agency unable to certify compliance: submit to the Department of Information Technology a request for an exemption together with a plan and the approximate timeline for each plan item, and promptly submit an updated plan and timeline if the Office of the Governor denies the request (Order paragraph 3).
- Department of Information Technology: conduct information technology and security assessments on state agencies to detect security vulnerability incidents and support mitigation efforts as necessary and within capabilities, and compile the state agency certifications and submit them to the Office of the Governor (Order paragraphs 1 and 2).
These lines are LexLint's reading of the law's text.
What this law does
The Department of Information Technology must conduct information technology and security assessments on state agencies to detect security vulnerability incidents and support mitigation efforts as necessary and within capabilities.
State agencies must adopt and implement cybersecurity, information security and privacy policies, standards and procedures based upon no less than moderate-impact security control baselines, frameworks and standards issued by the National Institute of Standards and Technology.
State agencies must certify compliance with the applicable standard, in the form and manner specified by the Department of Information Technology and the Office of the Governor, by , and on an annual basis thereafter. The Department of Information Technology must compile the state agency certifications and submit them to the Office of the Governor.
A state agency that is unable to certify compliance must submit to the Department of Information Technology a request for an exemption together with a plan outlining the steps the agency is taking to come into compliance and the approximate timeline it anticipates each plan item will be completed.
The Department of Information Technology must review each request for exemption and forward it to the Office of the Governor together with a recommendation to approve or deny the request and the reasons. If the Office of the Governor denies the request for exemption, the agency must promptly submit an updated plan and timeline for consideration.
All public bodies not subject to the Order are strongly encouraged to voluntarily comply with the rules, standards, and other requirements of the Cybersecurity Act or the Order. The Order defines state agencies as departments, offices, boards, commissions, and other agencies within the Executive Branch under gubernatorial control. The Order took effect immediately. The Order remains in effect until renewed, modified or rescinded. The Governor signed the Order on .
Back to the example · Lint your app
Page updated .