Connecticut Creates Legal Protections for Businesses With Good Cybersecurity Policies

The state of Connecticut is trying to encourage better cybersecurity practices with a new law that offers certain legal protections to businesses that meet a recognized cybersecurity standard. The aptly-named Cybersecurity Standards Act shields businesses from punitive damages in the event of a data breach, but only if a given business can demonstrate that it has a strong, written cybersecurity policy, and lives up to that policy in its day-to-day operations.

Connecticut is the third state to implement a data security safe harbor law, following in the footsteps of Utah and Ohio. However, companies in Connecticut may still be liable for damages if personal information is exposed through negligence or reckless conduct, or if the cybersecurity policy has not been implemented properly.

Assuming that that is not the case, and the business has listened to expert advice and followed a cybersecurity policy to the best of its ability, it will not face significant penalties if a breach occurs. The law applies to virtually any piece of personally identifiable information, covering everything from someone’s name, address, and Social Security numbers all the way through to medical and financial records. It also adds biometric data to the list, which means that businesses could still be protected if face or fingerprint information gets exposed.

Businesses will need to choose a policy from a pre-approved list of established cybersecurity standards in order to benefit from the new law. That list includes the NIST framework and the FedRAMP standard, as well the Payment Card Industry Data Security Standards and the set of 18 controls from the Center for Internet Security.

The Cybersecurity Standards Act has already been signed by Connecticut Governor Ned Lamont, and will go into effect on October 1. It applies to any businesses that store, process, or use personal and restricted information in the course of doing business.

Source: State Scoop

–

July 8, 2021 – by Eric Weiss