Law / United States / 
Rhode Island
Municipal and state agencies, notification of a cybersecurity incident to the state police
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a municipal agency or a state agency in Rhode Island that detects a cybersecurity incident, meaning unauthorized access that could jeopardize the confidentiality, integrity, or availability of critical information systems and critical infrastructure systems such as first responder networks, water and energy.
- Notify the Rhode Island state police upon detection of the cybersecurity incident, within twenty-four hours.
- Include in the notification, to the extent known, a general and brief description of the incident, including how it occurred, and the date, estimated date or date range of the incident.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 11-49.3-5 sets two tiers per record (mapped here to a person's compromised record): up to $100 for a reckless violation of the chapter and up to $200 for a knowing and willful violation, the figure recorded here.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 200
Who enforces it
Enforcement body
The Attorney General may bring an action in the name of the state against the business or person in violation where proceedings would be in the public interest (section 11-49.3-5(c)).
What this law does
A municipal agency or state agency that detects a cybersecurity incident must notify the Rhode Island state police within twenty-four hours of detection. A cybersecurity incident is unauthorized access that could jeopardize the confidentiality, integrity, or availability of critical information systems and critical infrastructure systems, such as first responder networks, water and energy.
The notification must include, to the extent known, a general and brief description of the incident, including how it occurred, and its date, estimated date or date range. An agency required to make the notification that fails to do so may be liable for a violation as set forth in section 11-49.3-5. Each reckless violation of the chapter is a civil violation with a penalty of not more than $100 per record, and each knowing and willful violation carries a penalty of not more than $200 per record. Section 11-49.3-7 was added by Public Law 2023, chapter 375, effective .