North Dakota § 54-59.1-02 Immediate disclosure to the department

North Dakota Statutes

§ 54-59.1-02 — Immediate disclosure to the department

North Dakota § 54-59.1-02

Title 54State Government

Ch. 54-59.1Cybersecurity Incident Reporting Requirements

This text of North Dakota § 54-59.1-02 (Immediate disclosure to the department) is published on Counsel Stack Legal Research, covering North Dakota primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

N.D. Cent. Code § 54-59.1-02 (2026).

Text

An entity shall disclose to the department an identified or suspected cybersecurity incident that affects the confidentiality, integrity, or availability of information systems, data, or services. Disclosure must be made in the most expedient time possible and without unreasonable delay. Cybersecurity incidents required to be reported to the department include:

1.Suspected breaches;

2.Malware incidents that cause significant damage;

3.Denial of service attacks that affect the availability of services;

4.Demands for ransom related to a cybersecurity incident or unauthorized disclosure of digital records;

5.Identity theft or identity fraud services hosted by entity information technology systems;

6.Incidents that require response and remediation efforts that will cost more than ten tho

Free access — add to your briefcase to read the full text and ask questions with AI

An entity shall disclose to the department an identified or suspected cybersecurity incident
that affects the confidentiality, integrity, or availability of information systems, data, or services.
Disclosure must be made in the most expedient time possible and without unreasonable delay.
Cybersecurity incidents required to be reported to the department include:
1. Suspected breaches;
2. Malware incidents that cause significant damage;
3. Denial of service attacks that affect the availability of services;
4. Demands for ransom related to a cybersecurity incident or unauthorized disclosure of
digital records;
5. Identity theft or identity fraud services hosted by entity information technology
systems;
6. Incidents that require response and remediation efforts that will cost more than
ten thousand dollars in equipment, software, and labor; and
7. Other incidents the entity deems worthy of communication to the department.