Law / United States / 
Nevada
Governor's Technology Office, reporting of suspected cybersecurity incidents by a using agency
In force.
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a using agency: a state agency or elected state officer required to use the Governor's Technology Office's services and equipment, and any other state agency or local governmental agency that has negotiated for those services; it does not bind a private business.
- Report any suspected data breach, distributed denial of service incident, ransomware incident, incident that disrupts the delivery of essential services for more than 1 business day or directly affects life or property, or security-related noncompliance with the Office's regulations, standards, practices, policies and conventions, to the Office of Information Security and Cyber Defense and the Security Operations Center within 24 hours after discovery of the suspected incident.
- Include in the report the date and time of the incident, the type of incident, the type of information system or data affected, the known and projected impact, whether law enforcement, a regulator or any other affected entity has been notified, and any additional resources needed to respond.
These lines are LexLint's reading of the law's text, as of .
What this law does
Each using agency must report any suspected data breach, distributed denial of service incident or ransomware incident. The report is due to the Office of Information Security and Cyber Defense and the Security Operations Center within 24 hours after discovery of the suspected incident. A using agency is a state agency or elected state officer required to use the Office's services, or another state agency or local governmental agency that has negotiated for them. A report must state the date and time of the incident and the type of incident.