HB4055

Oregon HB4055 mandates local public bodies to report information security incidents and ransomware incidents to the State Chief Information Officer.

Oregon HB4055 requires local governments, local service districts, or special government bodies to notify and submit a report to the State Chief Information Officer within 48 hours of discovering an information security incident or ransomware incident. The report must detail the actions taken or to be taken to prevent, mitigate, or recover from the incident. The State Chief Information Officer is tasked with establishing a reporting system, maintaining a webpage with instructions for reporting, and creating an annual report on the incidents reported.