Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor? - JD Supra

This website utilizes technologies such as cookies to enable essential site functionality, as well as for analytics, personalization, and targeted advertising. To learn more, view the following link: Privacy Policy Manage Preferences October 15, 2025 Incident Response Defenses: Can You Take Advantage of a Cyber Program Safe Harbor? LinkedIn Facebook X Send Embed We are in the final quarter of the year, which is typically budgeting and planning for many issues, including -hopefully!- data incident preparedness. Is your organization able to take advantage of one of the growing number of states’ safe harbor provisions? In particular, Connecticut, Iowa, Ohio, Oklahoma (beginning January 1, 2026), Oregon, – as of September 2025 Texas (for entities with less than 250 employees) – and Utah provide certain affirmative defenses against claims resulting from data breaches. The safe harbor is available if the company has a “qualified” cybersecurity program. What that means varies by state. 3 For Connecticut, Ohio, Utah, and Texas, the program must protect the confidentiality and security of personal information against threats, as well as against unauthorized access or acquisition that could result in material fraud. In Oregon, the business must use “reasonable” security measures. In Iowa, the program must evaluate and protect against risks, annually calculate the probable loss due to a breach, and communicate to impacted parties how they can reduce damages. Additionally, in Texas companies must meet specific operational requirements (like access controls and training) with specifics that depend on the size of the organization. In Connecticut, Iowa, Ohio, and Utah, businesses can also qualify if they comply with industry-recognized cybersecurity frameworks (such as the NIST’s Cybersecurity Framework) or, if applicable, laws like the Gramm-Leach-Bliley Act or HIPAA. Texas, however, makes compliance with one of these programs a requirement for the program. Finally, Tennessee and Nebraska both provide a safe harbor not based on a company’s security program, but instead as long as the incident was not based on a company’s willful misconduct or gross negligence. Putting It Into Practice: Now is a good time to review your current cybersecurity program. Many are planning incident response tabletops, but examining if you qualify for a safe harbor is another good way to look for risk mitigation for the “not if but when” of data incidents. Send Print Report LATEST POSTS French Insider Episode 44, Pt. 1 | From Leveraged Finance to Founder: Building, Scaling and Reinventing a Brand with Nicolas Nemeth  Audio  Unpacking FAR Case 2026-001: What the Overhaul Means for SAM Registration, Agency-Level Protests, and Information Security and Supply Chain Security Seven Insurance Regulatory Issues That Frequently Arise in Private Equity Transactions A Recent $21.3 Million Settlement to Resolve Alleged SDVOSB Fraud Scheme Signals A Renewed Focus on Protecting Veterans and Small Businesses? Restructure THIS! Episode 28 | Retail Bankruptcy, Then and Now, with Lorenzo Marinuzzi  Audio  See more » DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Attorney Advertising. © Sheppard, Mullin, Richter & Hampton LLP 2026 WRITTEN BY: Sheppard, Mullin, Richter & Hampton LLP Contact + Follow Kathryn Smith + Follow Liisa Thomas + Follow PUBLISH YOUR CONTENT ON JD SUPRA ✔ Increased readership ✔ Actionable analytics ✔ Ongoing writing guidance Join more than 70,000 authors publishing their insights on JD Supra Start Publishing » PUBLISHED IN: Affirmative Defenses + Follow Cybersecurity + Follow Data Breach + Follow Data Privacy + Follow Data Security + Follow Incident Response Plans + Follow NIST + Follow Risk Management + Follow Safe Harbors + Follow State Privacy Laws + Follow Privacy + Follow Science, Computers & Technology + Follow more SHEPPARD, MULLIN, RICHTER & HAMPTON LLP ON: