FISCAL NOTE
[First Reprint]
ASSEMBLY, No. 3897
STATE OF NEW JERSEY
221st LEGISLATURE
DATED: DECEMBER 11, 2024
SUMMARY
|
Synopsis: |
Requires municipalities, counties, and school districts to report cybersecurity incidents. |
|
Type of Impact: |
Annual State expenditure increase. Annual local expenditure and revenue increases. |
|
Agencies Affected: |
Department of Law and Public Safety; County and Municipal Governments; School Districts. |
|
Fiscal Impact |
|
|
|
|
|
Annual State Expenditure Increase |
$6,250,000 |
|
||
|
|
|
|||
|
Office of Legislative Services Estimate |
||||
|
Fiscal Impact |
|
|
|
|
|
Annual State Expenditure Increase |
$4,250,000 to $9,250,000 |
|
||
|
Annual Local Expenditure Increase |
Indeterminate |
|
||
|
Annual Local Revenue Increase |
Indeterminate |
|
||
|
|
|
|||
· The Office of Legislative Services (OLS) agrees that the informal Executive estimate of $6.25 million in additional annual State expenditures as a result of this bill falls within the range of plausible outcomes. The Executive estimate has two components: $6.0 million for the cost of State-paid cybersecurity audits for municipalities, counties, and school districts reporting cybersecurity incidents and $250,000 for two additional full-time staff positions.
· Allowing for randomness and fluctuation in the estimate, the OLS pegs the likely annual cost of the bill at a range from $4.25 million to $9.25 million.
· The Executive estimate does not address the fiscal impacts of the bill on counties, municipalities, and school districts. To the extent these entities would incur a cost in collaborating with the State-paid cybersecurity auditor, they would be able to seek cost reimbursements from the State, which would be a revenue gain to the local entities.
BILL DESCRIPTION
The bill adds to the existing requirement under P.L.2023, c.19 that municipalities, counties, and school districts report cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell in the Department of Law and Public Safety. Specifically, within 30 days of receipt of a report of a cybersecurity incident, the cybersecurity cell is to contract with an independent cybersecurity firm, at the State’s expense, for a cybersecurity audit of the political subdivision of the State that reported the incident. The audit is to be provided to the concerned entity, which subsequently is to submit any corrective action plan to the New Jersey Cybersecurity and Communications Integration Cell.
A municipality, county, or school district may apply to the Department of Law and Public Safety for reimbursement for any costs incurred pursuant to the bill.
FISCAL ANALYSIS
EXECUTIVE BRANCH
The OLS has not received a formal fiscal note on this bill. However, the Office of Homeland Security and Preparedness in, but not of, the Department of Law and Public Safety informally indicated to the OLS that the bill’s requirements would result in cost increases related to coordinating, completing, and tracking the audits.
Staffing - The Office of Homeland Security and Preparedness estimates the New Jersey Cybersecurity and Communications Integration Cell would require two additional full-time employees to coordinate and track the audits mandated by the bill. The office estimates the annual cost of those two full-time employees would approximate $250,000.
Audit Requirement - The Office of Homeland Security and Preparedness stated that, in the past year, the cybersecurity cell received 120 incident reports from public agencies. Using the 120 incident reports as a basis, the office indicated that at an estimated cost of $50,000 per cybersecurity audit, the bill would increase annual State costs for the audits by roughly $6 million.
Further, following an audit, this bill requires victim entities to submit any remediation plan to the New Jersey Cybersecurity and Communications Integration Cell, which the office stated could involve additional costs based on the audit findings.
OFFICE OF LEGISLATIVE SERVICES
The OLS agrees that the Executive estimate of $6.25 million in additional annual State expenditures as a result of this bill falls within the range of plausible outcomes.
The Office of Homeland Security and Preparedness bases its estimate on the assumptions that 120 cybersecurity incidents will occur per year and that the average cost of the ensuing cybersecurity audits will be $50,000.
To allow for randomness and fluctuation in the estimate, the OLS assumes that the number of reported cybersecurity incidents might vary from 100 to 150 in a given year and that the average cybersecurity audit cost might range from $40,000 to $60,000. These assumptions would lead to an estimated annual cost for cybersecurity audits of $4.0 million to $9.0 million.
The OLS generally concurs with the Executive’s estimate that the New Jersey Cybersecurity and Communications Integration Cell would require two additional full-time staff positions at an annual cost of approximately $250,000 to coordinate and track the audits.
The Executive estimate does not address the fiscal impacts of the bill on counties, municipalities, and school districts. To the extent these entities experience a cybersecurity incident, they may incur indeterminate expenditure increases related to collaborating with the State-paid cybersecurity audit contractor. These local government units and school districts will also experience revenue increases in the form of reimbursement payments from the State for any costs they incur related to their required actions under the bill.
|
Section: |
Law and Public Safety |
|
Analyst: |
Kristin Brunner Santos Lead Fiscal Analyst |
|
Approved: |
Thomas Koenig Legislative Budget and Finance Officer |
This fiscal note has been prepared pursuant to P.L.1980, c.67 (C.52:13B-6 et seq.).