Law / United States / 
Washington
Major cybersecurity incidents: state agency reporting to the office of cybersecurity
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds state agencies; it does not bind a private business.
- In the event of a major cybersecurity incident, as defined in policy established by the office of cybersecurity, report the incident to the office of cybersecurity within 24 hours of discovery.
- Provide the office of cybersecurity with contact information for any external parties who may have material information related to the cybersecurity incident.
These lines are LexLint's reading of the law's text, as of .
What this law does
In the event of a major cybersecurity incident, as defined in policy established by the office of cybersecurity, state agencies must report that incident to the office of cybersecurity within 24 hours of discovery. State agencies must provide the office of cybersecurity with contact information for any external parties who may have material information related to the cybersecurity incident.
Once a cybersecurity incident is reported, the office of cybersecurity must investigate the incident to determine the degree of severity and facilitate any necessary incident response measures that need to be taken to protect the enterprise.