SENATE COMMUNITY AND URBAN AFFAIRS COMMITTEE

STATEMENT TO

SENATE COMMITTEE SUBSTITUTE FOR

SENATE, No. 3313

STATE OF NEW JERSEY

DATED:  JANUARY 30, 2025

      The Senate Community and Urban Affairs Committee reports favorably a Senate Committee Substitute for Senate Bill No. 3313.

      As substituted, the bill expands on certain cybersecurity requirements for municipalities, counties, and school districts, as defined in the bill. 

      In the event that a cybersecurity incident impacts a municipality, county, or school district, no later than 30 days after receiving a cybersecurity incident notification, the New Jersey Office of Homeland Security and Preparedness (office) is required to contract with an independent cybersecurity company to audit the cybersecurity program of the municipality, county, or school district, and to audit any actions the municipality, county, or school district took in response to the cybersecurity incident.  The audit is to be paid for by the office and is to be provided to the municipality, county, or school district by the cybersecurity company upon completion.

      The bill requires that, within six months of an audit in response to a cybersecurity incident but not more than once per calendar year, all municipal and county officers and employees, including all school district employees, are to complete a cybersecurity awareness training program developed by the office, in consultation with the Attorney General, and verify completion as required by the bill.  The bill requires that the governing body of each municipality, county, or school district, as appropriate, complete periodic audits to ensure compliance with this training requirement.

      The bill permits a municipality, county, or school district to apply to the office for reimbursement for any costs incurred pursuant to the requirements of the bill, and provides that the municipality, county, or school district is to submit the audit completed by the independent cybersecurity company and any corrective action plans derived from the audit to the office.  Any information collected and shared pursuant to specific provisions of the bill are not to be subject to the provisions of the open public records act.