In Connecticut, if you adopt and maintain and comply with written cybersecurity program that contains administrative, technical and physical safeguards for the protection of personal or restricted information and that conforms to an industry recognized cybersecurity framework then you will not be subject to punitive damages in court against any cause of action founded in tort that alleges that the failure to implement reasonable cybersecurity controls resulted in a data breach.
Industry recognized cybersecurity frameworks are:
(1) General:
- NIST CSF
- NIST special publication 800-171;
- NIST special publications 800-53 and 800-53a;
- FedRAMP
- CIS Critical Security Controls for Effective Cyber Defense (Top 20)
- “ISO/IEC 27000-series
(2) Controls mandated by law such as: HIPAA, GLBA, FISMA etc.
(3) PCI DSS
The program must be designed to:
(A) Protect the security and confidentiality of information;
(B) protect against any threats or hazards to the security or integrity of information; (C) protect against unauthorized access to and acquisition of information that would result in a material risk of identity theft or other fraud to the individual to whom the information relates.
The scale and scope of a covered entity’s cybersecurity program shall be based on:
(A) The size and complexity of the covered entity;
(B) the nature and scope of the activities of the covered entity;
(C) the sensitivity of the information to be protected; and
(D) the cost and availability of tools to improve information security and reduce vulnerabilities.