Bill > A3283

This bill requires businesses in the financial, essential infrastructure, and healthcare industries, referred to as "sensitive businesses," to develop and implement comprehensive cybersecurity programs. These programs must address industrial control systems, if applicable, and reasonably align with recognized cybersecurity frameworks like those from the National Institute of Standards and Technology (NIST), the Center for Internet Security (CIS), or the International Organization for Standardization (ISO). Sensitive businesses will need to identify a responsible individual for cyber risk management, conduct risk assessments, implement controls, and maintain awareness of cyber threats. They must submit their cybersecurity plans and any revisions to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), a state entity within the Office of Homeland Security and Preparedness responsible for cybersecurity. Furthermore, these businesses must annually certify their compliance with these requirements, and the NJCCIC is empowered to audit any business that fails to submit a plan or certification, with the audits conducted at the business's expense. The bill defines key terms such as "cybersecurity incident," "industrial control system," and "information system" to clarify the scope of these new regulations.

Business and Industry

https://www.njleg.state.nj.us/bill-search/2026/A3283