2021 Developments In State Cybersecurity Safe Harbor Laws

Only four months in and 2021 has already been a big year for state cybersecurity safe harbor legislation.  Two states, Utah and Connecticut, have recently enacted or introduced a breach litigation safe harbor to incentivize businesses to protect personal information by adopting industry-recognized cybersecurity frameworks such as the National Institute of Standards and Technology's (NIST) Cybersecurity Framework and the Center for Internet Security's (CIS) Critical Security Controls.

Utah

In March 2021, Utah became the second state, after Ohio, to adopt a cybersecurity safe harbor statute for businesses impacted by a data breach. Specifically, an entity that "creates, maintains, and reasonably complies" with a written cybersecurity program modeled after one of several named cybersecurity frameworks may have an affirmative defense to certain claims if the program is in place at the time it experiences a breach of its system security. "Breach of system security" is