§ 24-A §2265 — Investigation of cybersecurity event

1.
Investigation.
If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation. During the investigation, the licensee or an outside vendor or service provider designated to act on behalf of the licensee, at a minimum, shall:
2.
System maintained by 3rd-party service provider.
If a licensee learns that a cybersecurity event has or may have occurred in an information system maintained by a 3rd-party service provider, the licensee shall either use its best efforts to complete the steps listed in subsection 1 or confirm that the 3rd-party service provider has completed those steps.
3.
Maintenance of records.
A licensee shall maintain records concerning a cybersecurity event for a period of at least 5 years from the date of the cybersecurity event and shall produce those records upon demand of the superintendent.

Legislative History

PL 2021, c. 24, §1 (NEW).