Cybersecurity Safe Harbor Laws in the United States: Legal Framework, Trends and Practical Implications

Jan 8

Consider the following scenario: A technology company suffers a widespread ransomware attack that impacted a number of customers all over the United States. Weeks after news of the breach goes public, the company faces 8 data breach class action lawsuits. The company consolidates the different class actions into a single case and files a motion to dismiss by demonstrating compliance with NIST CSF 2.0 and the absence of any evidence of gross negligence. The judge throws out the case, finding that the cybersecurity safe harbor statute doesn’t allow claimants the right to any damages.

Introduction

In an age where data breaches are not a question of if but when, the cybersecurity legal landscape continues to evolve. This is particularly true in the rise of data breach class action lawsuits. The scenario described above where an enterprise maintains a documented, framework-based cybersecurity program and successfully defends against a breach lawsuit by demonstrating “reasonable security” illustrates a key shift: States are increasingly offering affirmative legal defenses or liability shields to entities that proactively adopt recognized cybersecurity frameworks. While these laws provide an important legal defense to cybersecurity risk, they are still unevenly adopted and feature important caveats.

This article (1) explains the safe harbor concept in the cybersecurity context; (2) provides readers with a usable chart of the U.S. state safe harbor laws currently in effect; and (3) concludes with specific safe harbor implications and impacts for cybersecurity governance, risk management, and compliance efforts.

Understanding Cybersecurity Safe Harbor Laws

A “safe harbor” in the cybersecurity context refers to a statute that provides a legal shield (typically in the form of an affirmative defense or limitation on liability) to organizations that proactively implement and maintain a written cybersecurity program aligned with recognized industry or government frameworks (such as the NIST Cybersecurity Framework, CIS Controls, ISO/IEC 27000 series, among others). The underlying policy behind a cybersecurity safe harbor is to align statutory incentives with good cyber hygiene. Consequently, companies are motivated to proactively adopt robust security practices to mitigate risk.

From a risk management perspective, the key features are:

the entity must adopt and maintain a written cybersecurity program;
the program must reasonably conform with defined frameworks of administrative, technical, and physical safeguards;
the entity must comply with its program (or, in some statutes, reasonably comply);
the entity may then assert an affirmative defense or shield itself from certain liabilities (often tort-based claims, punitive/ exemplary damages, or class actions) should a cybersecurity event (e.g., a data breach) occur.

It is important to emphasize what safe harbor laws do not generally provide:

They do not outright eliminate the prospect of a lawsuit;
They do not eliminate all liability (e.g., gross negligence or willful misconduct may still trigger liability); and
They do not replace breach notification obligations or shield a business from regulatory scrutiny.

As the opening scenario reflects, the existence of a well-documented security regime helped the hypothetical company prevail in litigation by showing it had acted with diligence and consistency, thus satisfying the threshold of “reasonable security.”

Survey of U.S. State Safe Harbor Laws

Below is a comparative survey of jurisdictions (as of January 2026) that have enacted safe harbor statutes tied to cybersecurity programs. Note that this list is likely to expand with upcoming state legislative sessions.

    State
    Statute & Effective Date
    Covered Entities / Scope
    Safe Harbor Trigger & Protection
    Notable Limitations / Distinctions


    Connecticut
    Public Act 21-119 (Conn. Gen. Stat. Ann. § 42-471) – Effective Oct. 1, 2021
    Businesses subject to CT consumer protection statutes
    Provides for the avoidance of punitive damages in data breach litigation if entity conforms to recognized cybersecurity frameworks
    Only addresses punitive damages rather than all civil liability

    Iowa
    House File 553 (I.C.A. § 554G.2 and 554G.3) – Effective July 1, 2024
    Business subject to Iowa consumer protection statutes
    Entity may assert an affirmative defense to tort claims arising from data breaches if compliant with NIST, ISO, CIS, etc.
    The cost-based threshold is unique and arguably creates ambiguity; calculated “maximum probable loss” value (i.e., multiplying the threat event frequency by the probable loss magnitude)

    Nebraska
    Legislative Bill 241 – Effective three months after Nebraska Legislature adjourns
    Private entities subject to class-action liability under Nebraska law
    Provides that a private entity is not liable if it creates, maintains, and complies with a written cybersecurity program
    Not tied to conformance to any framework; it’s a reasonableness standard

    Nevada
    Nevada Security and Privacy of Personal Information Law (NRS § 603A) – Updated Oct. 1, 2023
    Data collectors who maintain personal information of Nevada residents
    Provides that a data collector will not be liable for certain damages if reasonable security measures were in place
    Uses a “reasonable security” requirement rather than mandating conformance with specific frameworks

    Ohio
    Ohio Data Protection Act (Ohio Rev. Code §§ 1354.01–1354.05) – Effective Nov. 2, 2018
    Entities maintaining personal information of Ohio residents
    Entity may assert an affirmative defense to tort claims if it maintains a cybersecurity program reasonably conforming to NIST, ISO, CIS, etc.
    Requires ongoing conformity as frameworks evolve
Oklahoma
    Senate Bill 626 - In effect January 2026
    Any entity storing personal information of Oklahoma residents
    Entity may assert an affirmative defense in civil actions brought under the state's breach notification statute if the entity complies with the statute's notice requirements and uses reasonable data security safeguards
    Depending upon entity's size and types of information it collects, reasonable safeguards include risk assessments, technical defenses, employee training for how to handle personal information, and an incident response plan.  

Tennessee
    Cybersecurity Event (T.C.A. § 29-34-215(b)) - Adopted in May 2024
    Private entities subject to class-action liability following a cybersecurity event
    Provides that a private entity is not liable in a class action lawsuit resulting from a cybersecurity event unless the event was caused by willful and wanton misconduct or gross negligence
    Not tied to conformance to any framework, it's arguably the broadest safe harbor (or liability limitation) but depends on proving the absence of willful/grossly negligent conduct
     *Tennessee Information Protection Act (TIPA) features an affirmative defense if covered entity can demonstrate compliance with privacy frameworks  

Texas
    S.B. 2610 (V. T. C. A., Bus. & C. § 542.001 et seq.) – Effective September 1, 2025
    Businesses with fewer than 250 employees in Texas that collects sensitive personal information
    Offers safe harbor against exemplary (punitive) damages if the business implements a security program aligned with recognized frameworks
    The size limit (<250 employees) limits scope; the protection is limited to exemplary damages (not necessarily all liabilities)

Utah
    Cybersecurity Affirmative Defense Act (U.C.A. § 78B-4-702) - Effective in May 2021
    Businesses subject to Utah law
    Offers an affirmative defense against tort-related breach claims where business implements and complies with qualified cybersecurity written program
    To invoke the protection, the organization has to reasonably conform to a framework and the written cybersecurity program includes certain features (e.g., designated employee in charge of program, employee training, risk assessments, etc.)

State	Statute & Effective Date	Covered Entities / Scope	Safe Harbor Trigger & Protection	Notable Limitations / Distinctions
Connecticut	Public Act 21-119 (Conn. Gen. Stat. Ann. § 42-471) – Effective Oct. 1, 2021	Businesses subject to CT consumer protection statutes	Provides for the avoidance of punitive damages in data breach litigation if entity conforms to recognized cybersecurity frameworks	Only addresses punitive damages rather than all civil liability
Iowa	House File 553 (I.C.A. § 554G.2 and 554G.3) – Effective July 1, 2024	Business subject to Iowa consumer protection statutes	Entity may assert an affirmative defense to tort claims arising from data breaches if compliant with NIST, ISO, CIS, etc.	The cost-based threshold is unique and arguably creates ambiguity; calculated “maximum probable loss” value (i.e., multiplying the threat event frequency by the probable loss magnitude)
Nebraska	Legislative Bill 241 – Effective three months after Nebraska Legislature adjourns	Private entities subject to class-action liability under Nebraska law	Provides that a private entity is not liable if it creates, maintains, and complies with a written cybersecurity program	Not tied to conformance to any framework; it’s a reasonableness standard
Nevada	Nevada Security and Privacy of Personal Information Law (NRS § 603A) – Updated Oct. 1, 2023	Data collectors who maintain personal information of Nevada residents	Provides that a data collector will not be liable for certain damages if reasonable security measures were in place	Uses a “reasonable security” requirement rather than mandating conformance with specific frameworks
Ohio	Ohio Data Protection Act (Ohio Rev. Code §§ 1354.01–1354.05) – Effective Nov. 2, 2018	Entities maintaining personal information of Ohio residents	Entity may assert an affirmative defense to tort claims if it maintains a cybersecurity program reasonably conforming to NIST, ISO, CIS, etc.	Requires ongoing conformity as frameworks evolve
Oklahoma	Senate Bill 626 - In effect January 2026	Any entity storing personal information of Oklahoma residents	Entity may assert an affirmative defense in civil actions brought under the state's breach notification statute if the entity complies with the statute's notice requirements and uses reasonable data security safeguards	Depending upon entity's size and types of information it collects, reasonable safeguards include risk assessments, technical defenses, employee training for how to handle personal information, and an incident response plan.
Tennessee	Cybersecurity Event (T.C.A. § 29-34-215(b)) - Adopted in May 2024	Private entities subject to class-action liability following a cybersecurity event	Provides that a private entity is not liable in a class action lawsuit resulting from a cybersecurity event unless the event was caused by willful and wanton misconduct or gross negligence	Not tied to conformance to any framework, it's arguably the broadest safe harbor (or liability limitation) but depends on proving the absence of willful/grossly negligent conduct *Tennessee Information Protection Act (TIPA) features an affirmative defense if covered entity can demonstrate compliance with privacy frameworks
Texas	S.B. 2610 (V. T. C. A., Bus. & C. § 542.001 et seq.) – Effective September 1, 2025	Businesses with fewer than 250 employees in Texas that collects sensitive personal information	Offers safe harbor against exemplary (punitive) damages if the business implements a security program aligned with recognized frameworks	The size limit (<250 employees) limits scope; the protection is limited to exemplary damages (not necessarily all liabilities)
Utah	Cybersecurity Affirmative Defense Act (U.C.A. § 78B-4-702) - Effective in May 2021	Businesses subject to Utah law	Offers an affirmative defense against tort-related breach claims where business implements and complies with qualified cybersecurity written program	To invoke the protection, the organization has to reasonably conform to a framework and the written cybersecurity program includes certain features (e.g., designated employee in charge of program, employee training, risk assessments, etc.)

In the last seven years, states have continued to pass safe harbor laws with greater frequency. In fact, the West Virginia and Florida state legislatures passed their own respective safe harbors only to see their governors veto the bills. With data breach litigation trends on the rise, it’s safe to assume more states will contemplate enacting cybersecurity safe harbors.

GRC Takeaways

In light of the foregoing, organizations should consider the following in evaluating their broader risk management strategies:

Map relevant state safe harbor statutes.
Determine which states the entity operates in or touches (customers, data centers, employees) and whether safe harbor laws apply. Given the patchwork of laws, map which state safe harbors apply, align internal policies accordingly, and consider whether the most stringent regime becomes the standard for all internal operations (so as to avoid carve-out risk). That may help a business efficiently manage compliance across multiple jurisdictions.

Adopt and document a written cybersecurity program aligned with recognized frameworks.
As illustrated in the introductory scenario, what matters is not just having controls but documenting them consistently and showing calibration to the entity’s size, sector, risk profile, and the chosen framework (e.g., NIST CSF, CIS Controls). That includes risk assessments, policies, procedures, training, monitoring, and incident response protocols.

Ensure evidence of compliance (or reasonable compliance) with the program.
Many statutes hinge not simply on program adoption but on the entity’s compliance with it. That means regular review, updates, record-keeping of assessments and remediation actions, and incident response logs.

Monitor framework updates and revise the program accordingly.
Because many statutes require that the program conform to the “current version” of the recognized framework (or within a defined update window), organizations should track framework changes and document revisions.

Beware the limitations and avoid overreliance on safe harbor.
Safe harbors do not absolve all risk. They may not cover all types of liability (e.g., regulatory penalties, contractual breach, reputation damage). They may exclude coverage when there is gross negligence or willful misconduct. Industries with heightened regulation (e.g., healthcare, financial services) may still face sector-specific cybersecurity obligations. Insurance and contractual risk transfer remain essential.

Use safe harbor statutes as part of the broader board/management narrative.
Because many boards and senior management still view cybersecurity as a technical issue, the existence of state safe harbor statutes is a strategic argument for investing in governance, documentation, and alignment with enterprise risk management. CIOs and CISOs can propose the safe harbor compliance program as a tool to shift cybersecurity into the enterprise-risk domain (alongside finance, legal, operations).

Incident-response readiness remains essential.
Even with safe harbor protections, a breach will still impose cost (response, remediation, loss of trust). The safe harbor defense is most useful when an entity can demonstrate that it was ready, had a program, followed it, and responded appropriately. Documentation of incident response, decision logs, forensic reports, and regulatory breach notification actions will support a defense.

Conclusion

For enterprises, emerging safe harbor statutes represent a meaningful incentive to treat cybersecurity not as a compliance checkbox but as a core enterprise risk discipline. As the fictional scenario illustrated, a documented, framework-based cybersecurity program can offer not just operational resilience but legal protection. However, leveraging the legal benefits are dependent on advance planning, documentation, and ongoing compliance.

Ryan Gallagher