Law / United States / 
Wyoming
State agencies, data policies covering security safeguards and response to data security incidents
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an agency: any office, department, board, commission, council, institution, separate operating agency or other operating unit of the executive branch of state government, other than the state legislature, the judiciary, the University of Wyoming and any community college in the state.
- Adopt, enforce and maintain a policy regarding the collection, access, security and use of data that complies with applicable federal and state law and adheres to standards set by the state chief information officer.
- Include in the policy an inventory and description of all data the agency collects or stores, authorization and authentication mechanisms for accessing the data, administrative, physical and logical security safeguards including employee training, privacy and security compliance standards, and processes, in accordance with existing law, for the destruction and communication of data.
- Include in the policy processes for identification of and response to data security incidents, including breach notification and mitigation procedures.
These lines are LexLint's reading of the law's text, as of .
What this law does
Every agency must adopt, enforce and maintain a policy regarding the collection, access, security and use of data. The policy must, at a minimum, comply with applicable federal and state law, adhere to standards set by the state chief information officer, and include an inventory and description of all data the agency collects or stores, authorization and authentication mechanisms for accessing the data, and administrative, physical and logical security safeguards, including employee training.
The policy must also include privacy and security compliance standards, processes for identification of and response to data security incidents, including breach notification and mitigation procedures, and, in accordance with existing law, processes for the destruction and communication of data.
An agency is any office, department, board, commission, council, institution, separate operating agency or other operating unit of the executive branch of state government, and does not include the state legislature, the judiciary, the University of Wyoming or any community college in the state. The governor, after consultation with the chief information officer, may set a date for specific agencies to comply and may revise that date as necessary. The act that created the section is effective .