Law / United States / 
Tennessee
State agency notice to the Comptroller of the Treasury of unauthorized data acquisition or a security system breach
In force.
A vulnerability and incident reporting rule binding government bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a state agency. The form the Comptroller provides is for state agency breaches only.
- Notify the Comptroller of the Treasury of any confirmed or suspected unauthorized acquisition of computerized data and any confirmed or suspected breach of a computer information system or related security system established to safeguard the data and the system.
- The Comptroller states that the report should be made within five working days after confirming or suspecting the acquisition or breach.
- Individual occurrences of malware or spyware need not be reported unless the occurrence led to the unauthorized acquisition of computerized data or compromises a security system established to safeguard data and computer information systems.
These lines are LexLint's reading of the law's text, as of .
What this law does
State agencies must notify the Comptroller of the Treasury of any confirmed or suspected unauthorized acquisition of computerized data and any confirmed or suspected breach of a computer information system or related security system. The Comptroller states that the report should be made within five working days after confirming or suspecting the unauthorized acquisition or breach.
A state agency is not required to notify the Comptroller of individual occurrences of malware or spyware unless the occurrence led to the unauthorized acquisition of computerized data or compromises a security system established to safeguard data and computer information systems.