The Uptime report

Uptime Report Research · Statute tracker · Updated November 2026

Safe Harbor Cybersecurity Laws by State: 10 States Limit Breach Liability, but Only 5 Reward a Named Framework

As of November 5, 2026, safe harbor cybersecurity laws by state exist in 10 states, which hold 22.0% of US residents. Only 5 (Ohio, Utah, Connecticut, Iowa and Texas) reward a program built on named frameworks for businesses generally, and they hold 15.8%. Florida and West Virginia are not among them: both bills were vetoed in 2024. Not legal advice.

10states with a statute limiting breach liability (11 laws)
5name security frameworks for businesses generally
22.0%of US residents live in those 10 states (15.8% in the 5)
4 of 5name NIST CSF. Utah’s list omits it, while CIS Controls and ISO 27000 reach all 5

The latest change came on January 1, 2026, when Oklahoma’s S.B. 626 took effect. It lifts civil penalties for an organization that uses “reasonable safeguards” and gives notice, but it names no framework. Since then, Florida’s CS/SB 692 and CS/HB 635 died on March 13, 2026, and Oklahoma’s class action bill, S.B. 1716, passed the Senate 45 to 1 but has no enrolled version on the Legislature’s site, where its last action is dated April 6, 2026. Most guides that rank for this query are vendor blogs. We read the enacted text on each legislature’s site and checked 215 verbatim quotes against the saved copies each time this page was built.

Which framework earns protection in the most states?

Five frameworks any organization can adopt tie at 5 states: NIST SP 800-171, NIST SP 800-53, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls and the ISO/IEC 27000 family. HIPAA and HITECH reach 7, GLBA 6 and FISMA 5, but only for organizations already subject to those laws. The NIST Cybersecurity Framework reaches 4, because Utah Code 78B-4-703 lists 800-171 and 800-53 and leaves it out. A CSF-only client in Utah would need the separate “reasonable security program” path. SOC 2, HITRUST and the Secure Controls Framework are named in Texas alone.

General-business laws that name frameworksNarrow lawsClass barOHUTCTIATXOKOK hosp.NVORTNNEStatesNIST Cybersecurity Framework (CSF)NIST Cybersecurity Framework (CSF)Ohio, NIST Cybersecurity Framework (CSF): named for any organizationYesConnecticut, NIST Cybersecurity Framework (CSF): named for any organizationYesIowa, NIST Cybersecurity Framework (CSF): named for any organizationYesTexas, NIST Cybersecurity Framework (CSF): named for any organizationYes4NIST SP 800-171NIST SP 800-171Ohio, NIST SP 800-171: named for any organizationYesUtah, NIST SP 800-171: named for any organizationYesConnecticut, NIST SP 800-171: named for any organizationYesIowa, NIST SP 800-171: named for any organizationYesTexas, NIST SP 800-171: named for any organizationYes5NIST SP 800-53 and 800-53ANIST SP 800-53 and 800-53AOhio, NIST SP 800-53 and 800-53A: named for any organizationYesUtah, NIST SP 800-53 and 800-53A: named for any organizationYesConnecticut, NIST SP 800-53 and 800-53A: named for any organizationYesIowa, NIST SP 800-53 and 800-53A: named for any organizationYesTexas, NIST SP 800-53 and 800-53A: named for any organizationYes5FedRAMP assessment frameworkFedRAMP assessment frameworkOhio, FedRAMP assessment framework: named for any organizationYesUtah, FedRAMP assessment framework: named for any organizationYesConnecticut, FedRAMP assessment framework: named for any organizationYesIowa, FedRAMP assessment framework: named for any organizationYesTexas, FedRAMP assessment framework: named for any organizationYes5CIS Critical Security ControlsCIS Critical Security ControlsOhio, CIS Critical Security Controls: named for any organizationYesUtah, CIS Critical Security Controls: named for any organizationYesConnecticut, CIS Critical Security Controls: named for any organizationYesIowa, CIS Critical Security Controls: named for any organizationYesTexas, CIS Critical Security Controls: named for any organizationYes5ISO/IEC 27000 familyISO/IEC 27000 familyOhio, ISO/IEC 27000 family: named for any organizationYesUtah, ISO/IEC 27000 family: named for any organizationYesConnecticut, ISO/IEC 27000 family: named for any organizationYesIowa, ISO/IEC 27000 family: named for any organizationYesTexas, ISO/IEC 27000 family: named for any organizationYes5HIPAA Security RuleHIPAA Security RuleOhio, HIPAA Security Rule: named, only if the organization is subject to that lawIf subjectUtah, HIPAA Security Rule: named, only if the organization is subject to that lawIf subjectConnecticut, HIPAA Security Rule: named, only if the organization is subject to that lawIf subjectIowa, HIPAA Security Rule: named, only if the organization is subject to that lawIf subjectTexas, HIPAA Security Rule: named, only if the organization is subject to that lawIf subjectOklahoma (hospitals), HIPAA Security Rule: named, only if the organization is subject to that lawIf subjectOregon, HIPAA Security Rule: named, only if the organization is subject to that lawIf subject7GLBA Title VGLBA Title VOhio, GLBA Title V: named, only if the organization is subject to that lawIf subjectUtah, GLBA Title V: named, only if the organization is subject to that lawIf subjectConnecticut, GLBA Title V: named, only if the organization is subject to that lawIf subjectIowa, GLBA Title V: named, only if the organization is subject to that lawIf subjectTexas, GLBA Title V: named, only if the organization is subject to that lawIf subjectOregon, GLBA Title V: named, only if the organization is subject to that lawIf subject6FISMA 2014FISMA 2014Ohio, FISMA 2014: named, only if the organization is subject to that lawIf subjectUtah, FISMA 2014: named, only if the organization is subject to that lawIf subjectConnecticut, FISMA 2014: named, only if the organization is subject to that lawIf subjectIowa, FISMA 2014: named, only if the organization is subject to that lawIf subjectTexas, FISMA 2014: named, only if the organization is subject to that lawIf subject5HITECH ActHITECH ActOhio, HITECH Act: named, only if the organization is subject to that lawIf subjectUtah, HITECH Act: named, only if the organization is subject to that lawIf subjectConnecticut, HITECH Act: named, only if the organization is subject to that lawIf subjectIowa, HITECH Act: named, only if the organization is subject to that lawIf subjectTexas, HITECH Act: named, only if the organization is subject to that lawIf subjectOklahoma (hospitals), HITECH Act: named, only if the organization is subject to that lawIf subjectOregon, HITECH Act: named, only if the organization is subject to that lawIf subject7PCI DSSPCI DSSOhio, PCI DSS: counts only together with another listed frameworkPlus 1Utah, PCI DSS: counts by itself, for card dataAloneConnecticut, PCI DSS: counts only together with another listed frameworkPlus 1Iowa, PCI DSS: counts only together with another listed frameworkPlus 1Texas, PCI DSS: counts only together with another listed frameworkPlus 1Nevada, PCI DSS: compliance is the statutory test for card acceptorsThe test6HITRUST CSFHITRUST CSFTexas, HITRUST CSF: named for any organizationYes1Secure Controls FrameworkSecure Controls FrameworkTexas, Secure Controls Framework: named for any organizationYes1SOC 2SOC 2Texas, SOC 2: named for any organizationYes1Own program, no named frameworkOwn program, no named frameworkUtah, Own program, no named framework: own program path, no named frameworkPathOklahoma, Own program, no named framework: own program path, no named frameworkPathOregon, Own program, no named framework: own program path, no named frameworkPath3No program required at allNo program required at allTennessee: no security program required for the class action barAnyNebraska: no security program required for the class action barAny2
Yes: named for any organizationIf subject: named, only if the organization is subject to that lawPlus 1: counts only together with another listed frameworkAlone: counts by itself, for card dataThe test: compliance is the statutory test for card acceptorsPath: own program path, no named frameworkAny: no program needed

The count is unique states, so Oklahoma counts once. Every filled cell ties to a verbatim quote in the saved statute, and for every blank cell the build confirms that the framework’s name does not appear in that law’s operative text (61 negative checks). Oklahoma’s S.B. 626 also mentions HIPAA and GLBA, but only for breach notice compliance, so those are not shown as cells. Scroll sideways on a phone.

If one framework has to cover a multistate client, the text points to CIS Controls. It is listed in all 5 general laws, and Texas singles it out: for 20 to 99 employees, the moderate tier includes “the requirements of the Center for Internet Security Controls Implementation Group 1.” Note two limits. PCI DSS alone is not enough in Ohio, Connecticut or Iowa, which require another listed framework alongside it, while Utah accepts it alone for card data and Nevada makes it the test for anyone accepting cards. And conforming is not the whole test: Ohio, Connecticut and Iowa also require a written program that the organization actually complies with.

Client-location checker: which laws might apply?

Not legal advice. This is a screen of statutory text. It does not decide which state’s law a court would apply. Ohio, Utah, Connecticut and Iowa reach claims under that state’s law or in its courts, so the client’s home state is only a starting point. “Might apply” means the statute’s named conditions look met on these inputs, not that a court would accept the defense. Ask counsel.

Comparison matrix: 11 laws in 10 states

Ordered by strength of protection and then by date. Headcount matters only in Texas, where Chapter 542 covers a business entity with fewer than 250 employees. No other law here has a size limit, although Ohio, Utah, Connecticut and Oklahoma scale the required program to the organization, and Oregon has a separate path for small businesses.

State and citation Effective Protection Who is covered Frameworks that qualify Claims covered Exceptions and limits Time to adopt revisions
Ohio
Ohio R.C. 1354.01 to 1354.05
Sub. S.B. 220, 132nd General Assembly		 Nov 2, 2018 Affirmative defense Any business, for-profit or not-for-profit, including financial institutions, that handles personal or restricted information. No size limit. NIST CSF, 800-171, 800-53, FedRAMP, CIS, ISO 27000; HIPAA, GLBA, FISMA, HITECH if subject; PCI DSS with another Tort claims under Ohio law or in Ohio courts alleging that a failure to implement reasonable security controls caused a data breach No private right of action created. The act says it sets no minimum standard. The text has no gross-negligence exception. Defense covers restricted information only if the program does. 1 year after a framework revision
Utah
Utah Code 78B-4-701 to 78B-4-706
H.B. 80 (2021), Laws of Utah 2021, ch. 40		 May 5, 2021 Affirmative defense Any person: individuals, corporations, partnerships, associations and other organizations, including financial institutions. No size limit. 800-171, 800-53, FedRAMP, CIS, ISO 27000; HIPAA, GLBA, FISMA, HITECH and other regulation if subject; PCI DSS for card data; or an own reasonable security program. NIST CSF is not named Claims under Utah law or in Utah courts alleging failed security controls, failed breach response, or failed notification. The last two also require written protocols that were followed. Lost if the person had actual notice of a threat, did not act within a reasonable time, and the threat caused the breach. A risk assessment is not actual notice. No private cause of action created. 1 year for frameworks; a reasonable time for regulations
Iowa
Iowa Code ch. 554G
House File 553; 2023 Iowa Acts ch. 63		 Jul 1, 2023
July 1 by operation of Iowa Code 3.7(1); the act states no date of its own		 Affirmative defense Any business, for-profit or not-for-profit, including financial institutions and chapter 28E entities. Municipalities are excluded. No size limit. NIST CSF, 800-171, 800-53, FedRAMP, CIS, ISO 27000; HIPAA, GLBA, FISMA, HITECH, Iowa ch. 507F, EPA, CISA and North American reliability rules if subject; PCI DSS with another Tort claims under Iowa law or in Iowa courts alleging a failure to implement reasonable security controls caused a breach of personal or restricted information, including business information Program must evaluate maximum probable loss at least annually and tell affected parties about risk after a known breach. No private right of action created. Framework’s own timeline, at most 1 year
Connecticut
Conn. Gen. Stat. 42-901
Public Act 21-119 (Sub. H.B. 6607)		 Oct 1, 2021 Bar on punitive damages Any business, for-profit or not-for-profit, including individuals and sole proprietors, that handles personal or restricted information. No size limit. NIST CSF, 800-171, 800-53, FedRAMP, CIS, ISO 27000; HIPAA, GLBA, FISMA, HITECH if subject; PCI DSS with another Tort claims under Connecticut law or in Connecticut courts alleging a failure to implement reasonable cybersecurity controls caused a data breach Lost for gross negligence or wilful or wanton conduct. Class certification is unaffected. Attorney General and Consumer Protection authority is preserved. 6 months after a revision
Texas
Tex. Bus. and Com. Code ch. 542
S.B. 2610 (89th Legislature)		 Sep 1, 2025
Applies only to causes of action accruing on or after this date		 Bar on exemplary damages A business entity in Texas with fewer than 250 employees that owns or licenses computerized data including sensitive personal information. NIST CSF, 800-171, 800-53, FedRAMP, CIS, ISO 27000, HITRUST, Secure Controls Framework, SOC 2, other similar; HIPAA, GLBA, FISMA, HITECH if subject; PCI DSS added if applicable Any action arising from a breach of system security. The entity must show the program existed at the time of the breach. Headcount tiers: under 20, simplified requirements; 20 to 99, including CIS Controls Implementation Group 1; 100 to 249, a full listed framework. No private cause of action, and no change to any common law or statutory duty. Later of the standard’s implementation date or 1 year after publication
Tennessee
Tenn. Code Ann. Title 29, ch. 34, pt. 2 (new section)
Public Chapter 991 (H.B. 2434 / S.B. 2018), 2024		 May 21, 2024
Takes effect on becoming law; approval date read from the signed act		 Not liable in a class action Any private entity, for-profit or not-for-profit. No size limit. No security program required. None required Class action lawsuits resulting from a cybersecurity event. The text does not address individual suits. Lost if the event was caused by willful and wanton misconduct or gross negligence. Government entities are outside the definition. None: no framework
Nebraska
Neb. Rev. Stat. 87-1201
Laws 2025, LB 241, sec. 1		 Sep 3, 2025 Not liable in a class action Any private entity, for-profit or not-for-profit. No size limit. No security program required. None required Class actions resulting from a cybersecurity event. The text does not address individual suits. Lost if the event was caused by willful, wanton, or gross negligence. Government entities are outside the definition. None: no framework
Nevada
NRS 603A.215
Added to NRS by 2009 Statutes, p. 1603; amended 2011 and 2025		 2009 session, date unconfirmed Not liable for damages Any data collector doing business in Nevada: government agencies, higher education, corporations, financial institutions, retailers and other businesses. No size limit. PCI DSS if accepting payment cards; otherwise encryption Damages for a breach of the security of the system data Lost for gross negligence or intentional misconduct by the collector, its officers, employees or agents. Compliance means PCI DSS if the collector accepts payment cards, otherwise encryption of outbound transfers and moved storage devices. PCI DSS compliance date set by the Council
Oregon
ORS 646A.622(2) and (4)
Current text last amended by Oregon Laws 2019, ch. 180, sec. 4		 Current text from 2019 c.180, date unconfirmed Deemed compliance, plus a defense to an allegation of breaching the safeguards duty Covered entities and vendors: anyone who owns, licenses, maintains, stores or processes personal information in a business, occupation or volunteer activity. Small businesses have a scaled path. GLBA or HIPAA and HITECH rules, a stricter law, or an own program with listed safeguards Allegations of not complying with the duty in ORS 646A.622(1) only. Not a tort shield. The defense applies to data not covered by GLBA or HIPAA, by showing the measures those Acts would require. The section names no NIST, ISO or CIS framework. Federal Acts fixed as in effect on January 1, 2020
Oklahoma (hospitals)
18 O.S. 2068 to 2072
H.B. 2790 (2023)		 Nov 1, 2023 Affirmative defense Hospitals, for-profit or not-for-profit, owned or managed by hospitals subject to HIPAA. Nobody else. Both HIPAA security requirements and HITECH Tort claims alleging a failure to implement reasonable security controls caused a breach of personal or restricted information Program must conform to both HIPAA security requirements and HITECH, must document compliance, and must be reviewed and updated at least annually. 1 year after an amendment
Oklahoma
24 O.S. 165(C)
S.B. 626; O.S.L. 2025, ch. 406		 Jan 1, 2026
Became law without the Governor’s signature on May 28, 2025		 No civil penalties, plus an affirmative defense Any individual or entity, including governments, that owns or licenses computerized personal information of Oklahoma residents. None named: reasonable safeguards, including risk assessments, layered defenses, training and an incident response plan Attorney General or district attorney penalties and civil actions filed under the Security Breach Notification Act only. Not a tort shield. Requires reasonable safeguards and notice. Notice without safeguards: actual damages plus a $75,000 civil penalty. Otherwise the penalty runs up to $150,000 per breach. None: no framework

Two differences change the sales conversation. Tennessee and Nebraska need no program at all: Public Chapter 991 and LB 241 protect any private entity from a class action unless gross negligence or worse caused the event. And Iowa’s text is harder to read than most summaries suggest. Section 554G.2(3) says a program’s scale is appropriate if its cost is “no less than” the maximum probable loss, which one law-firm summary treats as a spending floor. But section 554G.2(4)(b) says a covered entity “satisfies all requirements of this section” if its program reasonably conforms to a listed framework. We did not search case law, so treat that reading as an open question and keep the annual loss calculation either way.

Oregon’s and Oklahoma’s provisions differ in kind from the rest. ORS 646A.622(4) defends only against an allegation of breaching the safeguards duty in the same section, and Oklahoma’s 24 O.S. 165(C) reaches penalties and actions under the breach act itself. Neither is a shield against a negligence suit. Tennessee’s better-known Information Protection Act defense (section 47-18-3213 as enacted in Public Chapter 408, effective July 1, 2025) answers a violation of that privacy act, using a privacy program and the NIST Privacy Framework. It is not a breach defense, so we do not count it. For the privacy side, see our state privacy laws tracker.

Where the laws are, and how many people live there

Alaska: no statute found. Population 737,270 (Census 2025 estimate)AKMaine: no statute found. Population 1,414,874 (Census 2025 estimate)MEVermont: no statute found. Population 644,663 (Census 2025 estimate)VTNew Hampshire: no statute found. Population 1,415,342 (Census 2025 estimate)NHWashington: no statute found. Population 8,001,020 (Census 2025 estimate)WAIdaho: no statute found. Population 2,029,733 (Census 2025 estimate)IDMontana: no statute found. Population 1,144,694 (Census 2025 estimate)MTNorth Dakota: no statute found. Population 799,358 (Census 2025 estimate)NDMinnesota: no statute found. Population 5,830,405 (Census 2025 estimate)MNIllinois: no statute found. Population 12,719,141 (Census 2025 estimate)ILWisconsin: no statute found. Population 5,972,787 (Census 2025 estimate)WIMichigan: no statute found. Population 10,127,884 (Census 2025 estimate)MINew York: no statute found. Population 20,002,427 (Census 2025 estimate)NYRhode Island: no statute found. Population 1,114,521 (Census 2025 estimate)RIMassachusetts: no statute found. Population 7,154,084 (Census 2025 estimate)MAOregon: Defense to the safeguards duty, ORS 646A.622(2) and (4). Population 4,273,586 (Census 2025 estimate)OR2020Nevada: Damages shield, PCI or encryption, NRS 603A.215. Population 3,282,188 (Census 2025 estimate)NV2009Wyoming: no statute found. Population 588,753 (Census 2025 estimate)WYSouth Dakota: no statute found. Population 935,094 (Census 2025 estimate)SDIowa: Affirmative defense, Iowa Code ch. 554G. Population 3,238,387 (Census 2025 estimate)IA2023Indiana: no statute found. Population 6,973,333 (Census 2025 estimate)INOhio: Affirmative defense, Ohio R.C. 1354.01 to 1354.05. Population 11,900,510 (Census 2025 estimate)OH2018Pennsylvania: no statute found. Population 13,059,432 (Census 2025 estimate)PANew Jersey: no statute found. Population 9,548,215 (Census 2025 estimate)NJConnecticut: Punitive damages bar, Conn. Gen. Stat. 42-901. Population 3,688,496 (Census 2025 estimate)CT2021California: no statute found. Population 39,355,309 (Census 2025 estimate)CAUtah: Affirmative defense, Utah Code 78B-4-701 to 78B-4-706. Population 3,538,904 (Census 2025 estimate)UT2021Colorado: no statute found. Population 6,012,561 (Census 2025 estimate)CONebraska: Class action bar, Neb. Rev. Stat. 87-1201. Population 2,018,006 (Census 2025 estimate)NE2025Missouri: no statute found. Population 6,270,541 (Census 2025 estimate)MOKentucky: no statute found. Population 4,606,864 (Census 2025 estimate)KYWest Virginia: bill vetoed in 2024, no statute. Population 1,766,147 (Census 2025 estimate)WVvetoVirginia: no statute found. Population 8,880,107 (Census 2025 estimate)VAMaryland: no statute found. Population 6,265,347 (Census 2025 estimate)MDDelaware: no statute found. Population 1,059,952 (Census 2025 estimate)DEArizona: no statute found. Population 7,623,818 (Census 2025 estimate)AZNew Mexico: no statute found. Population 2,125,498 (Census 2025 estimate)NMKansas: no statute found. Population 2,977,220 (Census 2025 estimate)KSArkansas: no statute found. Population 3,114,791 (Census 2025 estimate)ARTennessee: Class action bar, Tenn. Code Ann. Title 29, ch. 34, pt. 2 (new section). Population 7,315,076 (Census 2025 estimate)TN2024North Carolina: no statute found. Population 11,197,968 (Census 2025 estimate)NCSouth Carolina: no statute found. Population 5,570,274 (Census 2025 estimate)SCDistrict of Columbia: no statute found. Population 693,645 (Census 2025 estimate)DCOklahoma: Penalty bar and statutory defense, 24 O.S. 165(C). Population 4,123,288 (Census 2025 estimate)OK2026Louisiana: no statute found. Population 4,618,189 (Census 2025 estimate)LAMississippi: no statute found. Population 2,954,160 (Census 2025 estimate)MSAlabama: no statute found. Population 5,193,088 (Census 2025 estimate)ALGeorgia: no statute found. Population 11,302,748 (Census 2025 estimate)GAHawaii: no statute found. Population 1,432,820 (Census 2025 estimate)HITexas: Exemplary damages bar, Tex. Bus. and Com. Code ch. 542. Population 31,709,821 (Census 2025 estimate)TX2025Florida: bill vetoed in 2024, no statute. Population 23,462,518 (Census 2025 estimate)FLveto

affirmative defensedamages barclass action bar, no programnarrow lawvetoed bill, no statuteno statute found

Year shown is the effective year of the state’s main provision. Nevada’s 2009 is the session year in the NRS history note and Oregon’s 2020 is approximate; see Methodology. Oklahoma is shown for its 2026 law, and its hospital act dates from 2023.

Population share is only a proxy for reach. Ohio, Utah, Connecticut and Iowa turn on the governing law or the forum, and Texas on a business entity “in this state,” rather than on where customers live. Using Census Bureau 2025 estimates, the 10 states hold 22.0% of US residents, about 75 million people, and 267 million people live elsewhere. Texas alone is 9.3%, so its September 2025 law supplied much of the recent jump, and that law reaches only entities under 250 employees and only exemplary damages. An affirmative defense to the claim itself, for businesses generally, exists in Ohio, Utah and Iowa, which hold 5.5%. California (11.5%) has none, and Florida (6.9%) would rank second in the group behind Texas had the 2024 bill been signed.

0%5%10%15%20%2017201820192020202120222023202420252026Nevada added Oct 1, 2009: 1.0% of US residentsNVOhio added Nov 2, 2018: 4.4% of US residentsOHOregon added Jan 1, 2020: 5.7% of US residentsORUtah added May 5, 2021: 6.7% of US residentsUTConnecticut added Oct 1, 2021: 7.8% of US residentsIowa added Jul 1, 2023: 8.8% of US residentsIATennessee added May 21, 2024: 10.9% of US residentsTNTexas added Sep 1, 2025: 20.2% of US residentsNebraska added Sep 3, 2025: 20.8% of US residentsTX, NEOklahoma added Jan 1, 2026: 22.0% of US residentsOK22.0%Ohio added Nov 2, 2018: 3.5% of US residentsUtah added May 5, 2021: 4.5% of US residentsConnecticut added Oct 1, 2021: 5.6% of US residentsIowa added Jul 1, 2023: 6.5% of US residentsTexas added Sep 1, 2025: 15.8% of US residentsTX15.8%

any statute limiting breach liabilitygeneral framework laws only

Cumulative share of US residents (Census Vintage 2025, July 1, 2025 population held constant) by each state’s first general provision. Oklahoma enters on January 1, 2026, since its 2023 act reaches hospitals only. Nevada is plotted at the left edge because it predates the axis.

Timeline: every enactment, veto and stalled bill

Affirmative defenseDamages barClass action barNarrow lawsVetoed or stalled201820192020202120222023202420252026Ohio: Affirmative defense, effective Nov 2, 2018OHNov 2 2018Utah: Affirmative defense, effective May 5, 2021UTMay 5 2021Connecticut: Punitive damages bar, effective Oct 1, 2021CTOct 1 2021Iowa: Affirmative defense, effective Jul 1, 2023IAJul 1 2023Texas: Exemplary damages bar, effective Sep 1, 2025TXSep 1 2025Tennessee: Class action bar, effective May 21, 2024TNMay 21 2024Nebraska: Class action bar, effective Sep 3, 2025NESep 3 2025Oklahoma: Penalty bar and statutory defense, effective Jan 1, 2026OK SB 626Jan 1 2026Oklahoma (hospitals): Affirmative defense, hospitals only, effective Nov 1, 2023OK hospitalsNov 1 2023Oregon: Defense to the safeguards duty, effective Jan 1, 2020ORJan 1 2020NV from 2009 (off axis)West Virginia Enr. CS for HB 5338: Vetoed by Governor, Mar 27, 2024WV vetoFlorida CS/CS/HB 473: Vetoed by Governor, Jun 26, 2024FL vetoWest Virginia HB 2987: Passed House; last action referred to Senate Judiciary, Mar 27, 2025WV stalledFlorida CS/CS/HB 1183: Died in State Affairs Committee, Jun 16, 2025FL diedFlorida CS/SB 692: Died in Appropriations, Mar 13, 2026FL diedOklahoma SB 1716: Passed Senate 45 to 1; last action a House policy committee do-pass recommendation; no enrolled version listed, Apr 6, 2026OK stalled

The red dashed line marks November 5, 2026. Red crosses are bills, not laws. Hover for bill numbers. Scroll sideways on a phone.

At the end of 2021 the framework group was Ohio, Utah and Connecticut, which answers the common “safe harbor cybersecurity laws by state 2021” search; Nevada’s narrower provision was already in the code. Iowa and Oklahoma’s hospital act followed in 2023. Tennessee then introduced a different model in May 2024, with no program needed, and Nebraska’s LB 241, effective September 3, 2025, uses nearly the same wording. Since Texas, no state has enacted a general framework law that we can find.

Date State Event Status
Apr 6, 2026 Oklahoma SB 1716: Would add a class action bar to 24 O.S. 165, on the Tennessee and Nebraska model Passed Senate 45 to 1; last action a House policy committee do-pass recommendation; no enrolled version listed
Mar 13, 2026 Florida CS/SB 692: Liability shield for local governments, covered entities and third-party agents that meet set requirements Died in Appropriations
Mar 13, 2026 Florida CS/HB 635: Identical House bill to SB 692 Died in State Affairs Committee
Jan 1, 2026 Oklahoma S.B. 626; O.S.L. 2025, ch. 406 in effect: penalty bar and statutory defense Enacted
Sep 3, 2025 Nebraska Laws 2025, LB 241, sec. 1 in effect: class action bar Enacted
Sep 1, 2025 Texas S.B. 2610 (89th Legislature) in effect: exemplary damages bar Enacted
Jul 1, 2025 Tennessee Information Protection Act in effect, including a privacy-program defense Enacted (privacy law)
Jun 16, 2025 Florida CS/CS/HB 1183: Reintroduced liability shield; its official summary also refers to a presumption against liability Died in State Affairs Committee
Jun 16, 2025 Florida SB 1576: Similar Senate bill to HB 1183 Died in Judiciary
Mar 27, 2025 West Virginia HB 2987: Consumer Data Protection Act bill that again contained Article 8H Passed House; last action referred to Senate Judiciary
Jun 26, 2024 Florida CS/CS/HB 473: Would have created s. 768.401: not liable in connection with a cybersecurity incident, for commercial entities, third-party agents and local governments that substantially align with a framework Vetoed by Governor
May 21, 2024 Tennessee Public Chapter 991 (H.B. 2434 / S.B. 2018), 2024 in effect: class action bar Enacted
Mar 27, 2024 West Virginia Enr. CS for HB 5338: Would have added Article 8H to Chapter 31A: an Ohio-style affirmative defense, in effect January 1, 2025 Vetoed by Governor
Mar 5, 2024 Florida CS/SB 658: Similar Senate bill to HB 473 Laid on table
Nov 1, 2023 Oklahoma (hospitals) H.B. 2790 (2023) in effect: affirmative defense, hospitals only Enacted
Jul 1, 2023 Iowa House File 553; 2023 Iowa Acts ch. 63 in effect: affirmative defense Enacted
Oct 1, 2021 Connecticut Public Act 21-119 (Sub. H.B. 6607) in effect: punitive damages bar Enacted
May 5, 2021 Utah H.B. 80 (2021), Laws of Utah 2021, ch. 40 in effect: affirmative defense Enacted
Nov 2, 2018 Ohio Sub. S.B. 220, 132nd General Assembly in effect: affirmative defense Enacted

Newest first. Pink rows are bills that did not become law. Nevada and Oregon are left out because we could not confirm a first effective date.

Vetoed, failed and stalled bills

These are not law, whatever some guides say. One page in the current top 10 describes Florida’s protection as “recently enacted” and says West Virginia’s is similar. Florida’s official bill page shows CS/CS/HB 473 “Vetoed by Governor” on June 26, 2024, and the current official text of Florida Statutes chapter 768 has no section 768.401. West Virginia’s page shows HB 5338 “Vetoed by Governor 3/27/24.” Both states’ legislatures have since tried again, without an enactment we can find.

State Bill What it would have done Status Last official action
Florida CS/CS/HB 473 (2024) Would have created s. 768.401: not liable in connection with a cybersecurity incident, for commercial entities, third-party agents and local governments that substantially align with a framework Vetoed by Governor Jun 26, 2024
Florida CS/SB 658 (2024) Similar Senate bill to HB 473 Laid on table Mar 5, 2024
Florida CS/CS/HB 1183 (2025) Reintroduced liability shield; its official summary also refers to a presumption against liability Died in State Affairs Committee Jun 16, 2025
Florida SB 1576 (2025) Similar Senate bill to HB 1183 Died in Judiciary Jun 16, 2025
Florida CS/SB 692 (2026) Liability shield for local governments, covered entities and third-party agents that meet set requirements Died in Appropriations Mar 13, 2026
Florida CS/HB 635 (2026) Identical House bill to SB 692 Died in State Affairs Committee Mar 13, 2026
West Virginia Enr. CS for HB 5338 (2024) Would have added Article 8H to Chapter 31A: an Ohio-style affirmative defense, in effect January 1, 2025 Vetoed by Governor Mar 27, 2024
West Virginia HB 2987 (2025) Consumer Data Protection Act bill that again contained Article 8H Passed House; last action referred to Senate Judiciary Mar 27, 2025
Oklahoma SB 1716 (2026) Would add a class action bar to 24 O.S. 165, on the Tennessee and Nebraska model Passed Senate 45 to 1; last action a House policy committee do-pass recommendation; no enrolled version listed Apr 6, 2026
Tennessee HB 1033 (2026) Would add an Ohio-style affirmative defense on top of the class action bar Not confirmed. The Tennessee General Assembly site refused our connections; a third-party tracker showed it in committee Not confirmed

Limited to bills we could read on an official site, plus Tennessee HB 1033, flagged as unconfirmed. Trackers also show New Jersey affirmative defense bills across several sessions, which we did not confirm on the Legislature’s site and left out. This list is not exhaustive.

The operative sentence in each law

Most summaries paraphrase. These are the words that do the work, copied from the saved official text and rechecked at every build.

Ohio: affirmative defense

“is entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information.”

Ohio R.C. 1354.01 to 1354.05. Read from search-prod.lis.state.oh.us (Internet Archive copy).

Utah: affirmative defense

“has an affirmative defense to a claim that: (a) is brought under the laws of this state or in the courts of this state; and (b) alleges that the person failed to implement reasonable information security controls that resulted in the breach of system security.”

Utah Code 78B-4-701 to 78B-4-706. Read from le.utah.gov.

Iowa: affirmative defense

“is entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information.”

Iowa Code ch. 554G. Read from www.legis.iowa.gov.

Connecticut: bar on punitive damages

“the Superior Court shall not assess punitive damages against a covered entity if such entity created, maintained and complied with a written cybersecurity program”

Conn. Gen. Stat. 42-901. Read from www.cga.ct.gov.

Texas: bar on exemplary damages

“a person harmed as a result of the breach may not recover exemplary damages from a”

Tex. Bus. and Com. Code ch. 542. Read from capitol.texas.gov.

Tennessee: not liable in a class action

“A private entity is not liable in a class action lawsuit resulting from a cybersecurity event unless the cybersecurity event was caused by willful and wanton misconduct or gross negligence on the part of the private entity.”

Tenn. Code Ann. Title 29, ch. 34, pt. 2 (new section). Read from publications.tnsosfiles.com.

Nebraska: not liable in a class action

“A private entity shall not be liable in a class action resulting from a cybersecurity event unless the cybersecurity event was caused by willful, wanton, or gross negligence on the part of the private entity.”

Neb. Rev. Stat. 87-1201. Read from nebraskalegislature.gov (Internet Archive copy).

Nevada: not liable for damages

“A data collector shall not be liable for damages for a breach of the security of the system data if”

NRS 603A.215. Read from www.leg.state.nv.us (Internet Archive copy).

Oregon: deemed compliance, plus a defense to an allegation of breaching the safeguards duty

“entity or vendor in an action or proceeding may affirmatively defend against an allegation that the covered entity or vendor has not complied with subsection (1) of this section”

ORS 646A.622(2) and (4). Read from www.oregonlegislature.gov (Internet Archive copy).

Oklahoma (hospitals): affirmative defense

“is entitled to an affirmative defense to any cause of action sounding in tort that is brought alleging that the failure to implement reasonable information security controls resulted in a data breach”

18 O.S. 2068 to 2072. Read from webserver1.lsb.state.ok.us.

Oklahoma: no civil penalties, plus an affirmative defense

“An individual or entity that uses reasonable safeguards and provides notice as required by Section 163 or 164 of this title shall not be subject to civil penalties and may use such compliance”

24 O.S. 165(C). Read from webserver1.lsb.state.ok.us.

What the ranking guides get wrong

  • Bill numbers. One guide cites Ohio HB 57, Utah SB 80, Tennessee SB 2005 and Oklahoma HB 2005. The enacted measures are Ohio Sub. S.B. 220, Utah H.B. 80, Tennessee Public Chapter 991 (H.B. 2434) and Oklahoma S.B. 626.
  • NIST CSF “in all” states. Utah’s list does not contain it. The words “critical infrastructure” appear nowhere in Utah’s Part 7, a check the build repeats.
  • SOC 2 in Ohio. Ohio’s act never mentions SOC 2. Texas is the only enacted law that does, although Florida’s vetoed HB 473 also named it.
  • Missing states. None of the six top-10 pages we fetched mentions Nebraska or Nevada, although both have statutes on the books.
  • Date confusion. March 11, 2021 is when Utah’s governor signed H.B. 80. The official bill page gives the effective date as May 5, 2021.

What this means for MSPs

Selling a documented framework program

  • Do not sell immunity. Sell a written program that gives the client an argument in 5 states, and say plainly which remedy each one touches. In Connecticut and Texas the prize is removal of punitive or exemplary damages, not a defense to the claim.
  • Standardize on CIS Controls, and map to the rest. It is named in all 5 general laws. Add a crosswalk for clients who ask for NIST CSF, because a CSF-only program lacks a named path in Utah. A SOC 2 report earns named credit only in Texas, so do not present it as a multistate answer.
  • Price Texas by headcount. Section 542.004 sets tiers at under 20, 20 to 99 and 100 to 249 employees, and an entity at 250 falls out of the chapter entirely. Ask for headcount at each renewal.
  • Know when a program changes nothing. In Tennessee and Nebraska the class action bar applies with or without one. The sales case there is different: a documented program is evidence against the gross negligence that removes the bar. That is our inference from the text, not a holding we found. For the cost side, see our cyber insurance statistics.

Evidence clients must keep

  • A dated, written program in force before the breach. Utah requires a program “in place at the time of a breach,” and Texas makes the entity demonstrate one existed “at the time of the breach.” Keep version history and approval dates.
  • Proof of compliance, not just policy. Ohio, Connecticut and Iowa say “comply,” Utah “reasonably complies.” Oklahoma’s hospital act goes furthest: “including documentation of such compliance,” plus review and update at least annually, also documented.
  • Threat-to-fix records. Utah’s defense is lost when a person with actual notice of a threat did not act in a reasonable time and that threat caused the breach. So your ticket history matters: alert, decision, remediation date. The statute also says a risk assessment is not actual notice, so do not avoid assessments out of fear of that clause.
  • Annual loss calculation in Iowa. Section 554G.2 calls for evaluating maximum probable loss at least annually. Keep the worksheet and the program’s cost alongside it.
  • Revision calendar. Connecticut gives 6 months to conform after a framework revision, against 1 year in Ohio and Utah. A multistate client should run to the 6-month clock.
  • Breach notice records. Oklahoma’s Attorney General notice, required when 500 or more residents are affected, must describe “any reasonable safeguards the entity employs,” and notice to residents is a condition of its protection. Utah’s notification defense needs protocols that were followed. Our analysis of how long companies take to report data breaches shows typical timing.

Contract language to take to counsel

These are starting points, not advice. Have counsel adapt them.

No assurance of legal outcome. “Provider supplies the services listed in Schedule A to support Client’s written cybersecurity program. Provider does not represent that Client qualifies for, or will succeed in asserting, any statutory defense or limit on liability.”

Program ownership. “Client owns and approves the written cybersecurity program. Schedule B allocates each framework control to Client, Provider or a named third party.”

Evidence. “Provider will keep the records listed in Schedule C for [period] and deliver them to Client within [days] of a written request, on termination, or on notice of a legal hold.”

Framework revisions. “Provider will notify Client within [days] of a final revision to the framework named in Schedule B and propose a plan that allows conformance within six months of publication.”

  • Look at governing law. Utah Code 78B-4-705 says a clause choosing Utah law applies the act “regardless of whether the civil action is brought in this state or another state.” Ask counsel whether that matters for a client’s contracts.
  • Remember your own exposure. Ohio’s “covered entity” includes a business that “accesses, maintains, communicates, or processes” personal information, which on its face could describe an MSP, so the same program may help you too. Tort-only statutes do not reach a client’s breach of contract claim against you. Florida’s vetoed HB 473 named third-party agents expressly. Among the enacted laws here, only Oregon’s section names vendors.
  • Sector rules still apply. A safe harbor is separate from federal enforcement: Public Law 116-321 only tells HHS to consider recognized security practices in place for “not less than the previous 12 months” when setting HIPAA fines, audits and remedies. See our notes on HIPAA Security Rule changes.

Frequently asked questions

Which states have safe harbor laws?

Ten states have a statute that limits breach-related liability as of November 5, 2026. Ohio, Utah and Iowa give an affirmative defense; Connecticut and Texas bar punitive or exemplary damages; Tennessee and Nebraska bar class actions with no program required; Nevada, Oklahoma and Oregon have narrower provisions. Florida and West Virginia passed bills in 2024, but both were vetoed.

What states have cybersecurity laws?

All of them in some form: the National Conference of State Legislatures says all 50 states have security breach laws. Fewer give anything back for good security. Only 10 states have a liability limit, covering 22.0% of US residents, and only 5 of those name security frameworks for businesses generally.

Which state is no. 1 in cyber crime?

California. The FBI’s Internet Crime Complaint Center 2025 report lists 116,414 complaints from California and $3.67 billion in reported losses, ahead of Texas (97,912) and Florida (71,843). Per resident the order changes: the District of Columbia has 448.8 complaints per 100,000 people, then Alaska at 434.3 and Nevada at 407.2. These are complaints filed, not a count of all crime.

Do all states have data breach notification laws?

Yes. The National Conference of State Legislatures reports that all 50 states have security breach laws. Safe harbors usually leave those duties in place: Connecticut’s act says nothing in it limits section 36a-701b, and Oklahoma’s 2026 protection requires notice as a condition. Only Utah’s act offers a defense to a claim of failing to notify, and only if written notification protocols existed and were followed.

Does California have a cybersecurity safe harbor law?

We found none. California works the opposite way: Civil Code 1798.150 lets consumers sue over certain breaches caused by a failure to maintain reasonable security, for $100 to $750 per consumer per incident or actual damages, whichever is greater, with amounts subject to CPI adjustment. One ranking guide lists a California safe harbor under the CCPA; the section we read contains no such defense, and it says later security improvements do not count as a cure.

Does a safe harbor stop a lawsuit or a regulator?

No. An affirmative defense is raised after a suit is filed. Ohio, Connecticut and Iowa reach tort claims only, so contract claims fall outside them, and Connecticut expressly preserves Attorney General authority. Texas and Connecticut remove only punitive or exemplary damages. Tennessee and Nebraska bar class actions, and their text does not address individual suits.

Download the data. safe-harbor-cybersecurity-laws-by-state-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Methodology

Scope. State statutes in force on November 5, 2026 that give an organization a legal defense or a limit on breach-related liability, whether or not they require a security program. We count 11 laws in 10 states. “General framework laws” are the 5 that name security frameworks for businesses generally. Privacy-act defenses are excluded from the count, and sector-only laws are labeled. Maryland’s 2026 H.B. 957 (Chapter 34) was checked and left out because it addresses state cybersecurity standards and contains no liability language.

Sources. For each law we downloaded the enrolled act and/or official code in November 2026 (Oregon and California on October 30, 2026), saved the text, and recorded each value with a verbatim quote. A script checks all 215 quotes against the saved files, runs 61 negative checks on blank grid cells, and stops the build if any fails. Law-firm and vendor pages were used only to find laws and to see what the query’s top results cover; no value comes from them. Tennessee’s approval date (May 21, 2024) was read from the signature page image of Public Chapter 991.

Internet Archive copies. Where an official host did not answer our requests we used the Internet Archive’s copy of the same official URL: codes.ohio.gov, nebraskalegislature.gov, publications.tnsosfiles.com, search-prod.lis.state.oh.us, www.leg.state.nv.us, www.oregonlegislature.gov. That covers Ohio’s enrolled S.B. 220 and code section 1354.04, Nevada’s NRS chapter 603A, Nebraska’s section 87-1201, Oregon’s ORS chapter 646A and Tennessee’s Public Chapter 408.

Population. Census Bureau Vintage 2025 resident estimates for July 1, 2025 (US total 341,784,857). Population is held constant for earlier dates. It measures where people live, not who can use a given defense.

Limitations. We did not research case law, so we cannot say how any court has applied these laws. Ohio’s current code pages other than 1354.04 and Texas’s codified chapter did not load, so those values rest on the enrolled acts; we cannot rule out a later amendment. Utah’s values come from the official code PDF for the version effective May 5, 2021, which shows no amendment notes, but the interactive current-version page did not load. Oklahoma’s values come from enrolled bills, and the 18 O.S. section numbers are those the bill directs “unless there is created a duplication in numbering.” Tennessee’s act adds a new section to Title 29, chapter 34, part 2 without stating its number; law-firm summaries cite it as 29-34-215, which we could not confirm on an official site. Nevada’s first effective date and Oregon’s first application of the defense are unconfirmed. Tennessee HB 1033’s status is unconfirmed because the General Assembly’s site refused connections. ncsl.org refused our direct request, so the all-50-states statement comes from its text as shown in the Google results we saved. A statute we did not find may exist: this tracker covers what we could verify, not every state code.

Not legal advice. This is a research summary of public statutes, and contract language above is illustrative. Confirm with the statute text and counsel.

Cite as:The Uptime Report. "Safe Harbor Cybersecurity Laws by State: 10 States Limit Breach Liability, but Only 5 Reward a Named Framework." November 2026. https://theuptimereport.com/safe-harbor-cybersecurity-laws-by-state/

References

  1. Ohio R.C. 1354.04, effective date and enacting act: codes.ohio.gov/ohio-revised-code/section-1354.04 (read through the Internet Archive copy). Accessed November 2026.
  2. Ohio Sub. S.B. 220, as enrolled: search-prod.lis.state.oh.us/api/v2/general_assembly_132/legislation/sb220/05_EN/pdf/ (read through the Internet Archive copy). Accessed November 2026.
  3. Utah H.B. 80 (2021), status page: le.utah.gov/~2021/bills/static/HB0080.html. Accessed November 2026.
  4. Utah Code Title 78B, ch. 4, Part 7: le.utah.gov/xcode/Title78B/Chapter4/C78B-4-P7_2021050520210505.pdf. Accessed November 2026.
  5. Connecticut Public Act 21-119: www.cga.ct.gov/2021/ACT/PA/PDF/2021PA-00119-R00HB-06607-PA.PDF. Accessed November 2026.
  6. Connecticut General Statutes ch. 747, sec. 42-901: www.cga.ct.gov/current/pub/chap_747.htm. Accessed November 2026.
  7. Iowa Code 3.7, effective dates: www.legis.iowa.gov/docs/code/3.7.pdf. Accessed November 2026.
  8. Iowa Code ch. 554G (2026): www.legis.iowa.gov/docs/code/554G.pdf. Accessed November 2026.
  9. Texas S.B. 2610, as enrolled: capitol.texas.gov/tlodocs/89R/billtext/pdf/SB02610F.pdf. Accessed November 2026.
  10. Texas S.B. 2610, bill history: capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2610. Accessed November 2026.
  11. Tennessee Public Chapter 991: publications.tnsosfiles.com/acts/113/pub/pc0991.pdf. Accessed November 2026.
  12. Nebraska Rev. Stat. 87-1201: nebraskalegislature.gov/laws/statutes.php?statute=87-1201 (read through the Internet Archive copy). Accessed November 2026.
  13. Nevada NRS chapter 603A: www.leg.state.nv.us/NRS/NRS-603A.html (read through the Internet Archive copy). Accessed November 2026.
  14. Oklahoma S.B. 626, enrolled: webserver1.lsb.state.ok.us/cf_pdf/2025-26%20ENR/SB/SB626%20ENR.PDF. Accessed November 2026.
  15. Oklahoma S.B. 626, bill information: www.oklegislature.gov/BillInfo.aspx?Bill=SB626&Session=2500. Accessed November 2026.
  16. Oklahoma S.B. 1716, introduced: www.oklegislature.gov/cf_pdf/2025-26%20INT/SB/SB1716%20INT.PDF. Accessed November 2026.
  17. Oklahoma H.B. 2790, enrolled: webserver1.lsb.state.ok.us/cf_pdf/2023-24%20ENR/hB/HB2790%20ENR.PDF. Accessed November 2026.
  18. Oklahoma H.B. 2790, bill information: www.oklegislature.gov/BillInfo.aspx?Bill=HB2790&Session=2300. Accessed November 2026.
  19. Oregon ORS chapter 646A: www.oregonlegislature.gov/bills_laws/ors/ors646a.html (read through the Internet Archive copy). Accessed October 2026.
  20. Tennessee Public Chapter 408 (Information Protection Act): publications.tnsosfiles.com/acts/113/pub/pc0408.pdf (read through the Internet Archive copy). Accessed November 2026.
  21. FBI Internet Crime Complaint Center, 2025 report: www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf. Accessed November 2026.
  22. California Civil Code 1798.150: leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.15. Accessed October 2026.
  23. Public Law 116-321: www.congress.gov/116/plaws/publ321/PLAW-116publ321.pdf. Accessed November 2026.
  24. Florida Statutes chapter 768: www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0700-0799/0768/0768.ht. Accessed November 2026.
  25. Maryland H.B. 957 (2026), Chapter 34: mgaleg.maryland.gov/2026RS/Chapters_noln/CH_34_hb0957t.pdf. Accessed November 2026.
  26. Florida CS/CS/HB 473, bill page: www.flsenate.gov/Session/Bill/2024/473. Accessed November 2026.
  27. Florida CS/CS/HB 473, enrolled: www.flsenate.gov/Session/Bill/2024/473/BillText/er/PDF. Accessed November 2026.
  28. Florida CS/CS/HB 1183, bill page: www.flsenate.gov/Session/Bill/2025/1183. Accessed November 2026.
  29. Florida CS/SB 692, bill page: www.flsenate.gov/Session/Bill/2026/692. Accessed November 2026.
  30. Florida CS/HB 635, bill page: www.flsenate.gov/Session/Bill/2026/635. Accessed November 2026.
  31. West Virginia HB 5338 (2024), bill status: www.wvlegislature.gov/Bill_Status/Bills_history.cfm?input=5338&year=2024&sessiontype=RS. Accessed November 2026.
  32. West Virginia Enrolled CS for HB 5338: www.wvlegislature.gov/Bill_Text_HTML/2024_SESSIONS/RS/bills/hb5338%20sub%20enr.pdf. Accessed November 2026.
  33. West Virginia HB 2987 (2025), bill status: www.wvlegislature.gov/Bill_Status/Bills_history.cfm?input=2987&year=2025&sessiontype=RS. Accessed November 2026.
  34. West Virginia HB 2987, introduced: www.wvlegislature.gov/Bill_Text_HTML/2025_SESSIONS/RS/bills/hb2987%20intr.pdf. Accessed November 2026.
  35. Oklahoma S.B. 1716 (2026), bill information: www.oklegislature.gov/BillInfo.aspx?Bill=SB1716&Session=2600. Accessed November 2026.
  36. US Census Bureau, Vintage 2025 state population estimates: www2.census.gov/programs-surveys/popest/datasets/2020-2025/state/totals/NST-EST2025-ALLDAT. Accessed November 2026.
  37. National Conference of State Legislatures, Security Breach Notification Laws, as shown in saved Google results: www.ncsl.org/technology-and-communication/security-breach-notification-laws. Accessed November 2026.
  38. Context only, not a source of values: Crowell and Moring client alert, April 2, 2026: www.crowell.com/en/insights/client-alerts/reducing-your-exposure-liability-limitations-for. Accessed November 2026.
  39. Context only, not a source of values: Quinn Emanuel, September 19, 2025: www.quinnemanuel.com/the-firm/publications/new-state-level-safe-harbor-statutes-attempt-to. Accessed November 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

One response to “Safe Harbor Cybersecurity Laws by State: 10 States Limit Breach Liability, but Only 5 Reward a Named Framework”

  1. vSphere 8 End of Support: Oct 11, 2027 (333 Days Left)

    […] Safe Harbor Cybersecurity Laws by State10 states, 11 laws, framework grid […]

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts