HRS §431:3B-207
Written plan for responding to cyber attacks
Each licensee must have a written plan to respond to and recover from cyber events that affect private information or business operations. The plan must cover how to respond, who does what, how to communicate, fix weaknesses, document events, and review the plan after an incident.
The statute, as written — Incident response plan
(a) As part of its information security program, each licensee shall establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, the licensee's information systems, or the continuing functionality of any aspect of the licensee's business or operations. (b) The incident response plan shall address the following areas: (1) The internal process for responding to a cybersecurity event; (2) The goals of the incident response plan; (3) The definition of clear roles, responsibilities, and levels of decision-making authority; (4) External and internal communications and information sharing; (5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls; (6) Documentation and reporting regarding cybersecurity events and related incident response activities; and (7) The evaluation and revision, as necessary, of the incident response plan following a cybersecurity event.
LawTrove is not legal advice. The summary above is a computer-generated restatement — the authoritative text is the official version linked above.