ASSEMBLY SCIENCE, INNOVATION AND TECHNOLOGY COMMITTEE

STATEMENT TO

ASSEMBLY, No. 3897

with committee amendments

STATE OF NEW JERSEY

DATED:  JUNE 6, 2024

      The Assembly Science, Innovation and Technology Committee reports favorably and with committee amendments Assembly Bill No. 3897.

      As amended and reported, this bill requires municipalities, counties, and school districts to report cybersecurity incidents.

      Under the bill, the Attorney General, in consultation with the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), is to develop an online cybersecurity incident reporting form on the NJCCIC’s Internet website, specifically for use by a designated employee of a municipality, county, or school district to report a cybersecurity incident.

      The bill provides that the online form is to be used promptly after the designated employee of a municipality, county, or school district has been made aware of a cybersecurity incident that has compromised certain computer system functions as enumerated in the bill.

      Under the bill, no later than 30 days after receiving a cybersecurity incident reporting form, the NJCCIC is to contract with an independent cybersecurity company to audit the cybersecurity program of the municipality, county, or school district, and any actions the municipality, county, or school district took in response to the cybersecurity incident.  The audit is to be paid for by the Department of Law and Public Safety (department) and is to be provided to the municipality, county, or school district by the cybersecurity company upon completion.  A municipality, county, or school district may apply to the department for reimbursement for any costs incurred pursuant to the requirements of the bill.

      The bill provides that the municipality, county, or school district is to submit the audit and any corrective action plans derived from the audit to the NJCCIC.  Any information collected and shared pursuant to the bill is not to be subject to the provisions of the open public records act.

COMMITTEE AMENDMENTS:

      The committee amendments make technical changes to the bill.