Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Committee amends cybersecurity bill to require entities to adopt and adhere to NIST standards for a rebuttable presumption
Summary
The committee advanced a reworked House Bill 1220 that establishes a rebuttable presumption for businesses (and certain government entities) that adopt and adhere to specified cybersecurity standards, debated whether that functions like immunity, clarified retroactivity and coverage of state entities, and adopted an amendment replacing 'adopts' with 'adopts and adheres.'
Chair presented House Bill 1220, a reworked cybersecurity measure (double referred to AET) that would create a rebuttable presumption in civil litigation for entities that follow specified cybersecurity standards. Chair emphasized the bill does not create blanket immunity: "I would disagree. It's not immunity...You can still be sued," the Chair said, and described the presumption as shifting burdens in court rather than preventing lawsuits.
Committee members pressed for detail on which technical standards apply (the bill references the National Institute of Standards and Technology framework and framework 2.0), whether government entities such as county hospitals and UMMC would be covered, whether the bill would be retroactive, and whether adoption alone is sufficient or implementation is required. Senator Turner Ford offered an amendment changing the language to require entities to "adopt and adhere" to the standards; the committee carried that amendment and approved conforming changes before sending the bill to AET. Members also asked the Chair to provide technical clarifications (NIST framework differences) before floor debate. Several senators voiced concern about accountability and potential effects on victims' remedies if the presumption shifts burdens in litigation.
