Technology

SB 2471 limits liability for government entities (like counties and municipalities) and commercial businesses if they adopt cybersecurity programs aligned with nationally recognized standards, such as the NIST Cybersecurity Framework. It creates a "rebuttable presumption" against liability for compliant entities, meaning plaintiffs must prove non-compliance with these standards to override the protection. The law requires documentation of compliance and shifts the burden of proof to the plaintiff in lawsuits, though it does not create new private lawsuits for non-compliance. This bill applies to entities handling personal information and takes effect July 1, 2025.