{"id":1117,"date":"2019-01-03T21:00:00","date_gmt":"2019-01-03T21:00:00","guid":{"rendered":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/2019\/01\/03\/refresher-legislative-draft-business-safe-harbor-cybersecurity-state-legislation\/"},"modified":"2019-01-03T21:00:00","modified_gmt":"2019-01-03T21:00:00","slug":"refresher-legislative-draft-business-safe-harbor-cybersecurity-state-legislation","status":"publish","type":"post","link":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/refresher-legislative-draft-business-safe-harbor-cybersecurity-state-legislation\/","title":{"rendered":"Refresher: Legislative Draft. Business Safe Harbor. Cybersecurity state legislation."},"content":{"rendered":"<p>Ohio was the first state to create a safe harbor for business in its 2018 cybersecurity legislation. <a href=\"https:\/\/www.ohioattorneygeneral.gov\/business\/cyberohio\/data-protection-act\/sb-220-house-version\">SB220 (OH | 2018)<\/a><\/p>\n<p>How did Ohio craft its liability protection for businesses? A business has to do 1 of these:<\/p>\n<div title=\"Page 6\">\n<div>\n<div>\n<pre>\n(1) Create, maintain, and comply with a written\ncybersecurity program that contains administrative, technical,\nand physical safeguards for the protection of personal\ninformation and that reasonably conforms to an industry\nrecognized cybersecurity framework, as described in section\n1354.03 of the Revised Code; or\n<\/pre>\n<pre>\n      (2) Create, maintain, and comply with a written\ncybersecurity program that contains administrative, technical,\nand physical safeguards for the protection of both personal\ninformation and restricted information and that reasonably\nconforms to an industry recognized cybersecurity framework, as\ndescribed in section 1354.03 of the Revised Code.\n<\/pre>\n<pre>\n      (B) A covered entity's cybersecurity program shall be\ndesigned to do all of the following with respect to the\ninformation described in division (A)(1) or (2) of this section,\nas applicable:\n<\/pre>\n<pre>\n      (1) Protect the security and confidentiality of the\ninformation;\n<\/pre>\n<pre>\n      (2) Protect against any anticipated threats or hazards to\nthe security or integrity of the information;\n<\/pre>\n<pre>\n      (3) Protect against unauthorized access to and acquisition\nof the information that is likely to result in a material risk\nof identity theft or other fraud to the individual to whom the\ninformation relates.\n<\/pre>\n<pre>\n      (C) The scale and scope of a covered entity's\ncybersecurity program under division (A)(1) or (2) of this\nsection, as applicable, is appropriate if it is based on all of\nthe following factors:\n<\/pre>\n<pre>\n      (1) The size and complexity of the covered entity;\n<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<div title=\"Page 7\">\n<div>\n<div>\n<pre>\n (2) The nature and scope of the activities of the covered\nentity;\n<\/pre>\n<pre>\n      (3) The sensitivity of the information to be protected;\n<\/pre>\n<pre>\n      (4) The cost and availability of tools to improve\ninformation security and reduce vulnerabilities;\n<\/pre>\n<pre>\n      (5) The resources available to the covered entity.\n<\/pre>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Ohio was the first state to create a safe harbor for business in its 2018 cybersecurity legislation. <a href=\"https:\/\/www.ohioattorneygeneral.gov\/business\/cyberohio\/data-protection-act\/sb-220-house-version\">SB220 (OH | 2018)<\/a><\/p>\n<p>How did Ohio craft its liability protection for businesses? A business has to do 1 of these:<\/p>\n<div title=\"Page 6\">\n<div>\n<div>\n<pre>\n(1) Create, maintain, and comply with a written\ncybersecurity program that contains administrative, technical,\nand physical safeguards for the protection of personal\ninformation and that reasonably conforms to an industry\nrecognized cybersecurity framework, as described in\u2026<\/pre>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42,23,9,3],"tags":[],"class_list":["post-1117","post","type-post","status-publish","format-standard","hentry","category-2019-legislative-issue","category-business-trend","category-legal-trend","category-legislative-trend","entry"],"_links":{"self":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/1117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/comments?post=1117"}],"version-history":[{"count":0,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/1117\/revisions"}],"wp:attachment":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/media?parent=1117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/categories?post=1117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/tags?post=1117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}