Law / United States / 
Oregon
State agencies, notice to the Legislative Fiscal Office of an information security incident
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a state agency: an officer, board, commission, department, agency or institute of state government as defined in ORS 174.111, other than the public universities listed in ORS 352.002 and the Oregon State Lottery and its gaming contractors. It does not bind a private business.
- Promptly notify the Legislative Fiscal Office of an information security incident and describe the actions the agency has taken or must reasonably take to prevent, mitigate or recover from damage to, unauthorized access to, unauthorized modifications or deletions of or other impairments of the integrity of the agency's information system or information resources.
- Periodically conduct or contract for an information security assessment of the agency's information system and information resources, request results from a third party's assessment of an information service the agency subscribes to, and notify the Legislative Fiscal Office of the assessment after the agency receives the results.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state agency must promptly notify the Legislative Fiscal Office of an information security incident and describe the actions the agency has taken or must reasonably take to prevent, mitigate or recover from damage to, unauthorized access to, unauthorized modifications or deletions of or other impairments of the integrity of its information system or information resources.
An information security incident is an incident that creates a risk of harm to a state agency or its operations and in which sensitive, protected or confidential information is accessed or used without the agency's authorization, a failure of compliance with its security or acceptable use policies results in unauthorized access, or its information system or information resources, or a third party information service to which it subscribes, become unavailable in a reliable and timely manner to authorized individuals or organizations, or are modified or deleted in circumstances the agency does not intend, plan or initiate.
Each state agency must periodically conduct or contract for an information security assessment of its information system and information resources and must notify the Legislative Fiscal Office of the assessment after it receives the results.
A state agency is an officer, board, commission, department, agency or institute of state government as defined in ORS 174.111, other than the public universities listed in ORS 352.002 and the Oregon State Lottery and the entities with which the Lottery has a contract or agreement with respect to its gaming systems or networks.
The Legislative Fiscal Office may use the notifications it receives solely to support the Joint Legislative Committee on Information Management and Technology, the Joint Committee on Ways and Means and the Joint Legislative Audit Committee.