A group of U.S. senators recently introduced a bill that proposes up to five years in prison for executives who fail to report a data breach within 30 days.

The Data Security and Breach Notification Act outlined measures organizations would have to take to safeguard Social Security numbers, credit card data and other personally identifiable information (PII). Though the penalties around data breaches are severe, organizations can be exempt if they demonstrate efforts to protect data with encryption.

New Law to Broaden Data Breach Requirements

Given some of the most recent high-profile cybersecurity incidents, the government’s effort to look for a legislative solution comes as no surprise. In fact, as Bleeping Computer noted, a similar bill was introduced during the Obama administration in 2014 following data breaches at major retailers. That bill was never passed into law.

According to Wired, existing laws already penalize actions that could lead to a data breach, but these regulations vary by state. The national scope of the current bill, along with the potentially huge impacts from recent security incidents, might motivate Congress to act this time around.

Playing the Get Out of Jail Free Card

In addition to mandating timely disclosure, the bill also outlined specific forms the disclosure should take. This includes an alert to the Federal Trade Commission (FTC) and a notification to customers via email, letter and a posting on the organization’s website, eWeek reported. Organizations must also provide advice to help those affected by a breach remediate the threat.

While the prospect of jail time may sound onerous to senior business leaders, a close reading of the bill by TechTarget revealed some circumstances in which organizations could have more than a month to disclose a data breach. If business leaders can prove that the organization needed to pinpoint exactly which of its customers’ data might have been lost or stolen, for instance, or that it had made efforts to ward off further attacks, the penalties might not be as severe.

More from

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Deploying Security Automation to Your Endpoints

Globally, data is growing at an exponential rate. Due to factors like information explosion and the rising interconnectivity of endpoints, data growth will only become a more pressing issue. This enormous influx of data will invariably affect security teams. Faced with an enormous amount of data to sift through, analysts are feeling the crunch. Subsequently, alert fatigue is already a problem for analysts overwhelmed with security tasks. With the continued shortage of qualified staff, organizations are looking for automation to…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…