Law / United States / 
Tennessee
State entities and ransomware: no ransom payment and immediate notice to the Tennessee Bureau of Investigation
Public Chapter 534 (2024), Tenn. Code Ann. title 4, chapter 1, part 4 (new section)
In force.
A vulnerability and incident reporting rule binding government bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a state entity: an agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branch of state government, including a public institution of higher education. A vendor, contractor, insurance company, law firm, or other third party doing business with a state entity is not a state entity.
- Do not submit payment to an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then offering to decrypt it in exchange for a ransom payment.
- When a state entity experiences a ransom request in connection with a cybersecurity incident, immediately notify and consult with the technology and innovation division of the Tennessee Bureau of Investigation.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state entity must not submit payment to an entity that has engaged in a cybersecurity incident by encrypting data and then offering to decrypt it in exchange for a ransom payment. A state entity experiencing a ransom request in connection with a cybersecurity incident must immediately notify and consult with the technology and innovation division of the Tennessee Bureau of Investigation.
A state entity does not include a vendor, contractor, insurance company, law firm, or other third party that has a contract, or does other business, with a state entity. The act takes effect upon becoming a law.