Requires municipalities, counties, and school districts to report cybersecurity incidents.

This bill requires municipalities, counties, and school districts in New Jersey to report cybersecurity incidents that compromise billing systems, communications, data management, or critical infrastructure (like industrial control systems). Designated employees must submit incidents via an online form developed by the Attorney General and NJ Cybersecurity Integration Cell within a prompt timeframe. Within 30 days of receiving a report, the NJCCIC must contract an independent cybersecurity firm to audit the entity’s security program and response, identifying threats, vulnerabilities, and improvement strategies. All incident reports and audit details are exempt from public disclosure under New Jersey’s open records law. The Department of Law and Public Safety covers audit costs and allows reimbursement for related expenses incurred by affected entities.