SB 764 (Barker) and HB 1290 (Hayes) as originally drafted would require every public body, including local governments, to report to the Chief Information Officer (CIO) of the Commonwealth all known incidents that threaten the security of the Commonwealth’s data or communications or result in exposure of data protected by federal or state laws and all other incidents compromising the security of the public body’s information technology systems with the potential to cause major disruption to normal activities of the public body or other public bodies. As previously reported, VACo had concerns with the legislation and testified against the House version when it was heard in the House Communications, Technology, and Innovations Committee on Monday, January 31. The Committee reported the bill on a vote of 19-2.
Since that time, VACo engaged the patrons of both bills, our risk insurance partners, and VITA to seek amendments to the bill language. VACo is thankful for substitute language introduced and adopted on both bills that would require such reporting be made to the Virginia Fusion Intelligence Center and for the inclusion of an enactment clause to convene a workgroup to review current cybersecurity reporting and information sharing practices and make recommendations on best practices for the reporting of cybersecurity incidents, as well as the scope and implementation of the required incident reporting. This workgroup will include representatives from the Virginia Data Advisory Commission, the Office of Data Governance and Analytics, the Virginia State Police, the Virginia Department of Emergency Management, the Virginia Information Technologies Agency, the Virginia Municipal League, the Virginia Association of Counties, and other relevant state or local entities. VACo is thankful to the patrons and to VITA for these changes to address our concerns.
HB 1290 passed the House on February 7 by a vote of 93-7. SB 764 reported from Senate General Laws and Technology on February 2 by a vote of 13-0, with one abstention.
VACo Contact: Jeremy R. Bennett