Utah – Cybersecurity Affirmative Defense Act was signed, on 11 March 2021

House Bill (‘HB’) 80 for the Cybersecurity Affirmative Defense Act was signed, on 11 March 2021, by the Utah State Governor. In particular, the Act creates affirmative defenses to certain causes of action arising out of a breach of system security. Specifically, the Act provides that a person that creates, maintains, and reasonably complies with a written cybersecurity program meeting certain requirements, and which is in place at the time of a breach of system security, has an affirmative defence to a claim brought under the laws of Utah alleging that the person failed to implement reasonable information security controls that resulted in the breach of system security. In addition, the Act details, among other things, circumstances under which an affirmative defence may not be claimed, components of a cybersecurity program eligible for an affirmative defence, as well as describing administrative, technical, and physical safeguards that a written cybersecurity program must provide.