Novel State Law Will Protect Against Cyber Lawsuits

Documentation of cybersecurity efforts is often regarded as an afterthought, sometimes just a check-off for compliance purposes. This post from Tom Cornelius, from cybersecurity company ComplianceForge, looks at a recently passed Ohio law that puts it in another light. The Ohio law gives a company protection against liability in civil lawsuits following a data breach, if the company can document having implemented a cybersecurity program that was aligned with some established cybersecurity framework. (The law also specifies what constitutes an acceptable framework.) What’s remarkable here, the author writes, is that the law does not itself create minimum standards, and that its requirements are optional. He says there is a good chance this approach will be taken up by other states. Regarding that prospect he is generally upbeat although he acknowledges it would come with some drawbacks, and he touches on those, as well.