Ask Reggi Your Question Now
Can I avoid having a data breach response plan in Nevada? What are the requirements?
Requirements for a Data Breach Response Plan in Nevada
To answer your question, no, you cannot avoid having a data breach response plan in Nevada if you are a political subdivision, which includes a city or county of the state [4.1].
The requirements for a cybersecurity incident response plan in Nevada are outlined in NAC 480.200 and NRS 480.935. The plan must include, among other things, preparations for a cybersecurity threat, detection and analysis of a cybersecurity threat, containment, eradication, and recovery from a cybersecurity incident, and post-incident activity that includes a discussion regarding information learned and any analytics associated with the cybersecurity incident [4.1][1.2].
Additionally, the cybersecurity incident response plan must be reviewed at least once each year, and any revised plan resulting from the review must be filed with the Office of Cyber Defense Coordination within 10 days after adoption or revision [4.1].
Therefore, if you are a political subdivision in Nevada, you must adopt and maintain a cybersecurity incident response plan that meets the requirements outlined in NAC 480.200 and NRS 480.935.
If you are not a political subdivision, the requirements for a data breach response plan may vary depending on your industry. For example, utilities and providers of new electric resources are required to conduct a vulnerability assessment and prepare an emergency response plan in accordance with the requirements of federal and regional agencies that regulate them [3.1].
If you are unsure about the requirements for your industry, it is recommended that you consult with a legal professional to ensure compliance with Nevada state laws and regulations.
Source(s):
- [1.2] Cybersecurity incident response plan: Contents and requirements.
- [3.1] Vulnerability assessment and response plan of utility and provider of new electric resources; confidentiality; penalties.
- [4.1] Political subdivisions required to adopt and maintain cybersecurity incident response plan; plan to be filed with Office; requirements for plan; confidentiality; exceptions; regulations.
Jurisdiction
Nevada