The United States has no single private-sector cybersecurity law, so the security duties an organisation actually owes depend on which states its customers, employees and regulators sit in. State law works in three layers: statutes and regulations that impose a duty to maintain reasonable security, safe harbour laws that reward organisations for following a recognised framework, and rules that make state agencies and local governments report incidents and restrict ransom payments. This map covers those three layers, state by state, with the statute, the trigger and what to evidence. Breach notification to individuals is deliberately excluded because it is covered in the Data Breach Notification Checklist. It is for security, privacy and legal teams. Status as of 25 October 2026.
Key takeaways
- A written program is the common currency. New York's SHIELD Act, Massachusetts 201 CMR 17.00 and every safe harbour law turn on a documented security program with administrative, technical and physical safeguards.
- Safe harbours are defences, not mandates. Ohio, Utah, Connecticut, Iowa and Texas reduce litigation exposure for organisations that conform to frameworks such as the NIST CSF, CIS Controls or ISO/IEC 27001, but none creates a compliance certificate.
- The defences differ in what they block. Ohio and Utah offer an affirmative defence to tort claims, Connecticut and Texas limit punitive or exemplary damages, and Tennessee raises the bar for data breach class actions to willful and wanton misconduct or gross negligence.
- Public bodies face their own clocks. Florida local governments report ransomware within 12 hours, New York municipalities report incidents within 72 hours and ransom payments within 24 hours, and Ohio political subdivisions report within 7 days.
- Machine identities are part of "reasonable security". None of these laws names service accounts or AI agents, but access control, authentication and monitoring duties apply to every credential that can reach protected data.
Regulations and frameworks at a glance
| State | Law | Layer | Who it covers | Core effect |
|---|---|---|---|---|
| New York | SHIELD Act, General Business Law 899-bb | Security duty | Any person or business owning or licensing computerised private information of NY residents | Reasonable administrative, technical and physical safeguards; scaled for small businesses |
| New York | 23 NYCRR Part 500 (NYDFS) | Security duty (sector) | Entities regulated by the Department of Financial Services | Prescriptive cybersecurity program, CISO, MFA, notification and annual certification. See the NYDFS Part 500 Guide. |
| Massachusetts | 201 CMR 17.00 (under MGL c. 93H) | Security duty | Persons that own or license personal information about Massachusetts residents | Minimum standards: written information security program (WISP) and computer system controls |
| Ohio | Revised Code chapter 1354 (Data Protection Act) | Safe harbour | Covered entities with a conforming written program | Affirmative defence to tort claims after a breach |
| Utah | Utah Code 78B-4-701 et seq. (Cybersecurity Affirmative Defense Act) | Safe harbour | Persons with a conforming written program | Affirmative defence to claims of failing to implement controls, notify or respond |
| Connecticut | Conn. Gen. Stat. 42-901 | Safe harbour | Covered entities with a conforming program | Bars punitive damages in breach tort actions |
| Iowa | Iowa Code 554G.1 to 554G.3 | Safe harbour | Covered entities with a conforming program | Affirmative defence; program investment tied to maximum probable loss |
| Oklahoma | 18 O.S. 2068 to 2070 (Hospital Cybersecurity Protection Act of 2023) | Safe harbour (hospitals) | Hospitals | Affirmative defence to tort claims |
| Tennessee | Public Chapter 991 of 2024 (HB 2434) | Litigation limit | Private entities | Class actions for a cybersecurity event need willful and wanton misconduct or gross negligence |
| Texas | SB 2610 (2025) | Safe harbour (small business) | Businesses with fewer than 250 employees | Shield from exemplary damages |
| Florida | Fla. Stat. 282.3185 and 282.3186 | Public sector | Counties, municipalities, state agencies | Standards, training, incident reporting, ransom payment ban |
| New York | General Municipal Law Article 19-c | Public sector | Municipal corporations and public authorities | Report incidents in 72 hours, ransom payments in 24 hours |
| Ohio | Revised Code 9.64 (HB 96, 2025) | Public sector | Political subdivisions, including school districts | Program, reporting in 7 and 30 days, ransom only by resolution |
| North Carolina | N.C. Gen. Stat. 143-800 | Public sector | State agencies and local government entities | Ransom payment and communication ban; notify NCDIT of ransom requests |
Scope: who and what is covered
State security laws attach to data about residents, not to where the organisation is based. A company in Texas that holds payroll records for New York staff owes SHIELD safeguards for those records; a company holding Massachusetts customers' data must meet 201 CMR 17.00. Safe harbour laws work the other way: they apply to claims brought under that state's law or in its courts, so their value depends on where an organisation is likely to be sued.
- Data in scope: the duty laws protect defined personal or "private" information (typically names combined with identifiers such as Social Security numbers, account numbers or biometric data). Ohio's defence can also cover "restricted information" if the program protects it.
- Regulated-entity routes: New York treats an entity that complies with GLBA, HIPAA and HITECH, or Part 500 as compliant with SHIELD; Ohio lets regulated entities qualify by conforming to the entirety of HIPAA security requirements, GLBA Title V, FISMA 2014 or HITECH.
- Public sector: state agency and local government rules apply to public bodies and, through contracts, to their IT providers. Federal agencies are covered separately by the FISMA Guide, and state cloud procurement by the StateRAMP / GovRAMP Guide. State agencies receiving federal tax information also follow IRS Publication 1075.
Key obligations
New York SHIELD Act (GBL 899-bb)
Any person or business that owns or licenses computerised private information of a New York resident must maintain reasonable safeguards. The statute lists what a compliant program contains:
- Administrative: designate one or more employees to coordinate the program, identify internal and external risks, assess existing safeguards, train staff, select service providers capable of appropriate safeguards and require them by contract, and adjust the program as the business changes.
- Technical: assess risks in network and software design and in information processing, transmission and storage; detect, prevent and respond to attacks or system failures; regularly test and monitor key controls.
- Physical: assess risks of storage and disposal, detect and respond to intrusions, protect against unauthorised access during collection, transport and disposal, and dispose of data so it cannot be read or reconstructed.
- Small businesses: fewer than 50 employees, under $3 million gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets. Their safeguards must be appropriate to size, complexity, activities and data sensitivity.
Massachusetts 201 CMR 17.00
Issued by the Office of Consumer Affairs and Business Regulation under MGL c. 93H, 201 CMR 17.00 sets minimum standards for paper and electronic personal information of Massachusetts residents. It requires a WISP (17.03) covering risk assessment, employee policies, discipline, terminated-employee access, oversight of service providers, physical access restrictions, monitoring and annual review. Section 17.04 adds computer system requirements, to the extent technically feasible: secure user authentication, access controls, encryption of personal information sent across public networks or wirelessly and stored on laptops and portable devices, monitoring for unauthorised use, firewall protection and patching, current malware protection, and staff training.
Sector rule: NYDFS Part 500
Part 500 is the most prescriptive state cybersecurity regulation and applies to banks, insurers and other entities licensed by the New York Department of Financial Services. It requires a risk-based program, a CISO, access privilege management, MFA, asset inventory, incident notification to DFS and an annual compliance filing. Detail is in the NYDFS Part 500 Guide.
Safe harbour laws
Safe harbour laws encourage, rather than require, framework-based programs. They share a model first set by Ohio in 2018: a written program with administrative, technical and physical safeguards that reasonably conforms to a recognised framework, scaled to the organisation's size, activities, data sensitivity, cost of tools and resources.
| State | Protection | Key conditions | Limits |
|---|---|---|---|
| Ohio (ORC 1354.02 to 1354.04) | Affirmative defence to tort claims alleging failure to implement reasonable controls led to a breach | Conform to the current version of NIST CSF, SP 800-171, SP 800-53/53A, FedRAMP, CIS Controls or ISO/IEC 27000 family (one year to adopt a revision); or the whole of HIPAA, GLBA, FISMA 2014 or HITECH; PCI DSS only together with another framework | No minimum standard imposed; does not create a private right of action |
| Utah (78B-4-701 et seq.) | Affirmative defence to claims of failing to implement reasonable controls, to respond appropriately or to notify properly | Written program reasonably complying with a recognised framework | Lost if the organisation had actual notice of a threat and did not act within a reasonable time; a risk assessment alone is not actual notice |
| Connecticut (42-901) | Bars punitive damages | Ohio-style program and framework conformance | Compensatory damages still available |
| Iowa (554G) | Affirmative defence to tort claims | Framework conformance; program spending no less than the calculated maximum probable loss | Requires an annual loss calculation |
| Oklahoma (18 O.S. 2068 to 2070) | Affirmative defence to tort claims | Hospitals with a program conforming to an industry-accepted framework, including HIPAA and HITECH security rules | Hospitals only |
| Tennessee (Public Chapter 991, effective 21 May 2024) | No class action liability for a cybersecurity event unless caused by willful and wanton misconduct or gross negligence | No framework condition | Class actions only; individual suits unaffected |
| Texas (SB 2610, signed 20 June 2025) | Shield from exemplary (punitive) damages in breach tort actions | Fewer than 250 employees; a cybersecurity program meeting the law's requirements at the time of the breach, scaled by size | Not immunity from liability |
Tennessee's separate Information Protection Act (in force from 1 July 2025) contains an affirmative defence for privacy programs conforming to the NIST Privacy Framework, but it applies only to claims under that Act, which the attorney general enforces. Oregon is sometimes counted as a safe harbour state because its safeguards statute (ORS 646A.622) deems HIPAA or GLBA compliance sufficient; check the statute text directly. Florida and West Virginia bills in 2024 had not become law in the sources we read. See the Cyber Insurance Guide for how insurers use similar evidence.
State and local government incident reporting
| State | Who reports | Deadline and recipient | Ransom rule |
|---|---|---|---|
| Florida (282.3185, 282.3186) | Counties and municipalities (282.3185); state agencies and local governments (ban) | Ransomware: within 12 hours of discovery; severity level 3 to 5 incidents: within 48 hours; to the Cybersecurity Operations Center, FDLE Cybercrime Office and local sheriff. After-action report within 1 week of remediation | Payment or compliance with a ransom demand prohibited (from 1 July 2022) |
| New York (GML Article 19-c, signed 26 June 2025) | Municipal corporations and public authorities | Incident or ransom demand: within 72 hours; ransom payment: within 24 hours, with written explanation within 30 days; via DHSES portal | Payment reporting, not a ban |
| Ohio (ORC 9.64, HB 96) | Political subdivisions, including counties, cities, townships and school districts | Executive director of the Division of Homeland Security (Department of Public Safety) within 7 days; Auditor of State within 30 days. Program deadlines: counties and cities 1 January 2026, others 1 July 2026 | Payment only after a legislative resolution or ordinance stating why it is in the subdivision's best interest |
| North Carolina (143-800) | State agencies and local government entities | Notify NC Department of Information Technology of a ransom request | Payment and communication with the threat actor prohibited |
Florida local governments also had to adopt standards consistent with the NIST CSF (larger counties and cities by 1 January 2024, smaller ones by 1 January 2025) and train staff within 30 days of starting and annually. Ohio requires a program consistent with frameworks such as the NIST CSF or CIS Controls, adopted by the legislative authority, plus annual training. For ransom decisions, see the Ransomware Payments and Sanctions Guide.
Timeline and current status
| Date | Event |
|---|---|
| 2010 | Massachusetts 201 CMR 17.00 in force |
| 2018 | Ohio Data Protection Act creates the first safe harbour |
| 2019 to 2020 | New York SHIELD Act data security requirements take effect |
| 2021 | Utah and Connecticut safe harbours enacted |
| 2022 | North Carolina ransom ban (April); Florida ransom ban and local reporting (1 July) |
| 2023 | Iowa safe harbour (signed 3 May); Oklahoma hospital safe harbour |
| 21 May 2024 | Tennessee class action limit effective |
| 2025 | Texas SB 2610 signed (20 June); New York GML Article 19-c signed (26 June); Ohio ORC 9.64 enacted in the state budget |
| 2026 | Ohio local program deadlines (1 January and 1 July) |
Status as of 25 October 2026: all laws in this map were in force on the dates shown in the sources we read. Legislatures amend these laws often, so confirm the current text before relying on any row.
Enforcement and penalties
- New York SHIELD: a failure is treated as a deceptive practice under GBL 349; the attorney general may seek injunctions and civil penalties under GBL 350-d. There is no private right of action.
- Massachusetts: enforced by the attorney general under the state consumer protection framework of MGL c. 93H.
- Safe harbours: carry no penalties; their value is reduced damages or a defence in litigation. The defence must be proved, so documentation of conformance at the time of the breach is what matters.
- Public sector rules: enforced through state oversight, audit and, in Ohio's case, the Auditor of State; late reporting is typically a finding rather than a fine.
What it means for AI agents and non-human identities
No state law in this map mentions service accounts, API keys or AI agents. They are still in scope because SHIELD's technical safeguards, 201 CMR 17.04's authentication and access controls and every framework a safe harbour relies on apply to any identity that can reach protected data.
- Access control: 201 CMR 17.04 requires secure authentication and access limited to those who need it. Apply that to service accounts and agents: unique credentials, no shared passwords, least privilege. See the Service Account Security Guide.
- Vendor oversight: SHIELD and 201 CMR 17.00 both require contracts with service providers. Integrations and SaaS tokens held by vendors are part of that oversight, as the Palo Alto Networks Salesforce data theft through stolen Drift OAuth tokens showed; see the Third-Party Risk Management Guide.
- Proving the defence: a safe harbour depends on reasonable conformance with a framework. NIST CSF 2.0 PR.AA-01 expects identities and credentials for services and hardware to be managed, so an unmanaged inventory of machine credentials weakens the defence.
- AI agents: treat an agent with data access as a non-human identity with its own credential, scope and audit trail, and include it in the written program. See the Agentic AI Compliance Guide.
Compliance steps
- Map residency and presence: list the states whose residents' data you hold, the states where you are licensed (for NYDFS) and, for public bodies, your own state's reporting law.
- Write one program to the strictest duty: build a WISP that meets 201 CMR 17.03 and 17.04 and SHIELD's listed safeguards; that baseline usually satisfies other states' "reasonable security" duties.
- Choose a framework deliberately: pick one Ohio lists (NIST CSF, CIS Controls, ISO/IEC 27001 or SP 800-171) so the same evidence supports safe harbour defences in Ohio, Utah, Connecticut and Iowa. See the Cybersecurity Frameworks Compared Guide.
- Record conformance over time: keep dated assessments, gap registers and remediation records, because the defence is judged at the time of the breach. Track framework revisions (Ohio allows one year to adopt them).
- Size-test the program: document why controls fit your size and data sensitivity, which SHIELD, Ohio and Texas all consider.
- Public bodies: build the clock: add 12-hour, 24-hour, 72-hour or 7-day reporting steps, recipients and portal access to the incident response plan, and the ransom decision route your state requires. Test it in a tabletop exercise.
- Bring NHIs into scope: inventory service accounts, keys and agents that reach personal information, assign owners and include them in access reviews.
- Coordinate with breach notice: keep breach notification timelines in the Data Breach Notification Checklist and link the two procedures.
Measuring it
- Percentage of states in your data footprint with a mapped legal requirement and owner.
- Framework conformance score from the latest assessment, with date.
- Service providers with security clauses in contract, as a percentage of those holding personal information.
- Machine credentials with a named owner and rotation date.
- Public bodies: time from discovery to state report.
Common failure patterns
- Assuming a safe harbour is automatic: the defence needs a written program that conformed at the time of the breach; undated or aspirational policies do not prove it.
- Partial framework adoption: Ohio's regulated-entity route requires conformance to the whole of the named regime, and PCI DSS alone does not qualify.
- Ignoring Utah's actual-notice exception: a known, unremediated threat removes the defence.
- Treating breach notice as the only state duty: SHIELD and 201 CMR 17.00 impose security duties whether or not a breach occurs.
- Public bodies missing the short clocks: Florida's 12-hour ransomware rule and New York's 24-hour payment rule are shorter than most incident response plans assume.
Practitioner checklist
- Map every state whose residents' data you hold to its security duty and any safe harbour.
- Maintain a WISP meeting 201 CMR 17.00 and GBL 899-bb safeguards.
- Adopt one framework recognised by Ohio's chapter 1354 and keep dated conformance evidence.
- Check Utah's actual-notice exception: track known threats to remediation.
- Put security clauses in contracts with every service provider handling personal information.
- Include service accounts, API keys and AI agents in the program's access controls and reviews.
- Public bodies: add state reporting deadlines, recipients and ransom approval steps to the incident response plan.
- Re-check statutes and pending bills each legislative session.
Standards and references
- New York State Senate: General Business Law 899-bb, Data security protections
- Mass.gov: 201 CMR 17.00, Standards for the protection of personal information of residents of the Commonwealth
- Ohio Laws: Revised Code Chapter 1354
- Florida Senate: Statute 282.3185, Local government cybersecurity
- New York DHSES: Cybersecurity Incident and Ransom Payment Reporting
- Dinsmore: Ohio Law Imposes New Cybersecurity Requirements for Local Government
- Wilson Elser: States Enact Safe Harbor Laws That Provide Affirmative Defenses in Data Breach Litigation
- Workplace Privacy Report: Texas Enacts Liability Shield From Punitive Damages for Certain Small Businesses
Related NHI Mgmt Group resources: Data Breach Notification Checklist · NYDFS Part 500 Guide · US State Privacy Laws Guide · StateRAMP / GovRAMP Guide · FedRAMP Guide. This guide summarises US state cybersecurity duties, safe harbour laws and public-sector reporting rules and is not legal advice.