FISCAL NOTE
SENATE COMMITTEE SUBTITUTE FOR
SENATE, No. 3313
STATE OF NEW JERSEY
221st LEGISLATURE
DATED: MARCH 4, 2025
SUMMARY
|
Synopsis: |
Requires certain procedures and training for municipalities, counties, and school districts in response to cybersecurity incidents. |
|
Type of Impact: |
Annual State expenditure increase. Annual local expenditure and revenue increases. |
|
Agencies Affected: |
Department of Law and Public Safety; County and Municipal Governments; School Districts. |
|
Fiscal Impact |
|
|
|
|
|
Annual State Expenditure Increase |
$6,250,000 |
|
||
|
|
|
|||
|
Office of Legislative Services Estimate |
||||
|
Fiscal Impact |
|
|
|
|
|
Annual State Expenditure Increase |
$4,250,000 to $9,250,000 |
|
||
|
Annual Local Expenditure Increase |
Indeterminate |
|
||
|
Annual Local Revenue Increase |
Indeterminate |
|
||
|
|
|
|||
· The Office of Legislative Services (OLS) agrees that the informal Executive estimate of $6.25 million in additional annual State expenditures as a result of this bill falls within the range of plausible outcomes. The Executive estimate has two components: $6.0 million for the cost of State-paid cybersecurity audits for municipalities, counties, and school districts reporting cybersecurity incidents and $250,000 for two additional full-time staff positions.
· Allowing for randomness and fluctuation in the estimate, the OLS pegs the likely annual cost of the bill at a range from $4.25 million to $9.25 million.
· The Executive estimate does not address the fiscal impacts of the bill on counties, municipalities, and school districts. To the extent these entities would incur a cost in collaborating with the State-paid cybersecurity auditor, they would be able to seek cost reimbursements from the State, which would be a revenue gain to the local entities.
BILL DESCRIPTION
The bill expands on certain cybersecurity requirements for municipalities, counties, and school districts, as defined in the bill.
In the event that a cybersecurity incident impacts a municipality, county, or school district, no later than 30 days after receiving a cybersecurity incident notification, the New Jersey Office of Homeland Security and Preparedness is required to contract with an independent cybersecurity company to audit the cybersecurity program of the municipality, county, or school district, and to audit any actions the municipality, county, or school district took in response to the cybersecurity incident. The audit is to be paid for by the New Jersey Office of Homeland Security and Preparedness and is to be provided to the municipality, county, or school district by the cybersecurity company upon completion.
The bill requires that, within six months of an audit in response to a cybersecurity incident but not more than once per calendar year, all municipal and county officers and employees, including all school district employees, are to complete a cybersecurity awareness training program developed by the office, in consultation with the Attorney General, and verify completion as required by the bill. The bill requires that the governing body of each municipality, county, or school district, as appropriate, complete periodic audits to ensure compliance with this training requirement.
The bill permits a municipality, county, or school district to apply to the office for reimbursement for any costs incurred pursuant to the requirements of the bill and provides that the municipality, county, or school district is to submit the audit completed by the independent cybersecurity company and any corrective action plans derived from the audit to the office. Any information collected and shared pursuant to specific provisions of the bill is not to be subject to the provisions of the open public records act.
FISCAL ANALYSIS
EXECUTIVE BRANCH
The OLS has not received a formal fiscal note on this bill. However, the Office of Homeland Security and Preparedness in, but not of, the Department of Law and Public Safety informally indicated to the OLS that the bill’s requirements would result in cost increases related to coordinating, completing, and tracking the audits.
Staffing - The Office of Homeland Security and Preparedness estimates the office would require two additional full-time employees to coordinate and track the audits mandated by the bill. The office estimates the annual cost of those two full-time employees would approximate $250,000.
Audit Requirement - The Office of Homeland Security and Preparedness stated that, in 2024, the New Jersey Cybersecurity and Communications Integration Cell received 120 incident reports from public agencies. Using the 120 incident reports as a basis, the office indicated that at an estimated cost of $50,000 per cybersecurity audit, the bill would increase annual State costs for the audits by roughly $6 million.
Cybersecurity Awareness Training - Information provided by the Office of Homeland Security and Preparedness indicated that the current cost for cybersecurity awareness training content is about $4 per employee per year.
OFFICE OF LEGISLATIVE SERVICES
The OLS agrees that the Executive estimate of $6.25 million in additional annual State expenditures as a result of this bill falls within the range of plausible outcomes.
Pursuant to P.L.2023, c.19, the Office of Homeland Security and Preparedness presently has in place an incident reporting system and bases its estimate on the assumptions that at least 120 cybersecurity incidents will occur per year and that the average cost of each ensuing cybersecurity third-party audit will be $50,000.
To allow for randomness and fluctuation in the estimate, the OLS assumes that the number of reported cybersecurity incidents might vary from 100 to 150 in a given year and that the average cybersecurity audit cost might range from $40,000 to $60,000. These assumptions would lead to an estimated annual cost for cybersecurity audits of $4.0 million to $9.0 million.
The OLS generally concurs with the Executive’s estimate that the Office of Homeland Security and Preparedness would require two additional full-time staff positions at an annual cost of approximately $250,000 to coordinate and track the audits as well as the reimbursements.
The Executive estimate does not address the fiscal impacts of the bill on counties, municipalities, and school districts. To the extent these entities experience a cybersecurity incident, they may incur indeterminate expenditure increases related to collaborating with the State-paid cybersecurity audit contractor. These local government units and school districts will also experience revenue increases in the form of reimbursement payments from the State for any costs they incur related to their required actions under the bill.
Finally, regarding the bill’s cybersecurity awareness training requirement, the OLS cannot predict how many county, municipal, and school district employees will complete the training program in a given year. As noted above, the Office of Homeland Security and Preparedness indicated that the current cost for cybersecurity awareness training content is about $4 per employee per year.
|
Section: |
Law and Public Safety |
|
Analyst: |
Kristin Brunner Santos Lead Fiscal Analyst |
|
Approved: |
Thomas Koenig Legislative Budget and Finance Officer |
This fiscal estimate has been prepared pursuant to P.L.1980, c.67 (C.52:13B-6 et seq.).