New Iowa law adds liability protections for companies implementing cyber best practices

An Iowa law taking effect on July 1 provides a legal safe harbor for companies that voluntarily adopt cyber best practices such as the Center for Internet Security’s “Critical Security Controls” or other key “industry recognized” cybersecurity frameworks.

“There is no national statutory minimum standard of information security, which makes it difficult to improve cybersecurity on a wholesale basis,” said Curtis Dukes, CIS executive vice president and general manager for security best practices. “Iowa’s cybersecurity bill is a step in...