Bill > A3949

Introduced Session

This bill requires municipalities, counties, and school districts to report cybersecurity incidents. Under the bill, the Attorney General, in consultation with the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), is required to develop an online cybersecurity incident reporting form and cybersecurity awareness training program on the NJCCIC's Internet website, specifically for use by a designated employee of a municipality, county, or school district to report a cybersecurity incident and to complete the training program required under the bill. The bill provides that the online form is to be used promptly after the designated employee of a municipality, county, or school district has been made aware of a cybersecurity incident that has compromised certain computer system functions as enumerated in the bill. Under the bill, no later than 30 days after receiving a cybersecurity incident that has been submitted through the online form, the NJCCIC is to contract with an independent cybersecurity company to audit the cybersecurity program of the municipality, county, or school district, and any actions the municipality, county, or school district took in response to the cybersecurity incident. The audit is to be paid for by the Department of Law and Public Safety (department) and is to be provided to the municipality, county, or school district by the cybersecurity company upon completion. The bill requires that within six months of an audit in response to a cybersecurity incident, but not more than once per calendar year, all municipal and county officers and employees, including all school district employees, are to complete a cybersecurity awareness training program developed by the Attorney General, in consultation with the NJCCIC, and verify completion as required by the bill. The bill requires that the governing body of each municipality, county, or school district, as appropriate, complete periodic audits to ensure compliance with this training requirement. The bill permits a municipality, county, or school district to apply to the department for reimbursement for any costs incurred pursuant to the requirements of the bill, and provides that the municipality, county, or school district is to submit the audit completed by the independent cybersecurity company and any corrective action plans derived from the audit to NJCCIC. Any information collected and shared pursuant to specific provisions of the bill are not to be subject to the provisions of the open public records act.

AI Summary

Committee Categories

Vicky Flynn (R)*, 

Introduced, Referred to Assembly Science, Innovation and Technology Committee (on 03/04/2024)

Official Document