SENATE LAW AND PUBLIC SAFETY COMMITTEE

STATEMENT TO

SENATE COMMITTEE SUBSTITUTE FOR

SENATE, Nos. 3100 and 3101

STATE OF NEW JERSEY

DATED:  JUNE 13, 2024

      The Senate Law and Public Safety Committee reports favorably a Senate Committee Substitute for Senate Bill Nos. 3100 and 3101.

      As substituted and reported, the committee substitute requires a sensitive business, defined as a business engaged in the financial, essential infrastructure, or healthcare industries, to develop cybersecurity programs based on regulations to be adopted by the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) in the Office of Homeland Security and Preparedness. These requirements include updating cybersecurity programs to apply to all of the sensitive business’ industrial control systems if applicable, reasonably conforming these programs to the most recent version of certain industry-recognized cybersecurity frameworks, and annually certifying compliance with these requirements.

      The committee substitute also requires sensitive businesses to submit their cybersecurity plans and revisions to the NJCCIC. The NJCCIC is directed to audit any sensitive business that fails to submit a cybersecurity plan.

      In addition, the committee substitute require sensitive businesses to report certain cybersecurity incidents promptly to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). For the purposes of this committee substitute, a “cybersecurity incident” means an event occurring on or conducted through a computer network that jeopardizes the integrity, confidentiality, or availability of, or information residing on, computers, information systems, communications systems networks, physical or virtual infrastructure controlled by computers, or information systems. The committee substitute directs the NJCCIC to audit the relevant business no later than 30 days after being made aware of an incident. Cybersecurity audits would be conducted by a qualified and independent cybersecurity company at the sensitive business’ expense.