HRS §431:3B-204
What the board of directors must do for information security
If a licensee has a board of directors, the board or a board committee must make sure top management builds and runs an information security program. The board must get a written report at least once a year about the program's status and any major issues. If management hands off duties, they must still oversee the work and get a report.
businesses
The statute, as written — Oversight by board of directors
If the licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum: (1) Require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program; (2) Require the licensee's executive management or its delegates to report in writing at least annually, the following information: (A) The overall status of the information security program and the licensee's compliance with this article; and (B) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, third-party service provider arrangements, results of testing, cybersecurity events or violations and management's responses thereto, and recommendations for changes in the information security program; and (3) If executive management delegates any of its responsibilities under this part, it shall oversee the development, implementation, and maintenance of the licensee's information security program prepared by the delegate and shall receive a report from the delegate complying with the requirements of the report to the board of directors specified in paragraph (2).
LawTrove is not legal advice. The summary above is a computer-generated restatement — the authoritative text is the official version linked above.