Delaware Board directs 911 funding, vendors, and cyber response

The Board must manage the statewide 911 system’s fund and contracts. The duties concern the statewide 911 system and its public safety answering points. The Board acts through the Department of Safety and Homeland Security when it contracts for statewide 911 services. Local call centers may buy extra programs and equipment to supplement the statewide system.

The Board must make monthly payments from the 911 fund to public safety answering points and set a formula for dividing them. Payments go to Delaware public safety answering points. The formula uses billing addresses tied to certain residential and wireless services, along with other information the Board considers relevant. The Board may reduce, suspend, or end payments if a call center does not meet the law’s requirements or provide 911 service. If the fund lacks enough money, call centers receive a proportional share, and unpaid amounts carry forward. The formula-based payments begin January 1, 2027. The Board must recalculate and publish the formula on January 1, 2032, and every five years after that.

Each public safety answering point must move its 911 operations to vendors managed by the Board. This applies to every public safety answering point in Delaware. The Board may reduce, suspend, or end payments or technical support for a call center that has not moved by the deadline. The move must be complete by December 31, 2027.

An entity affected by a cyber incident involving the 911 system must respond and report the incident to the Board. The duties apply to an entity affected by ransomware or another cybersecurity incident involving the 911 system or related infrastructure. The entity must isolate affected systems, preserve evidence, and cooperate with state cybersecurity staff, law enforcement, and investigators. It may not contact or pay the attacker without written approval from the Board and appropriate law enforcement agencies. The entity must notify the Board within one hour after discovering the incident and file a written report within 10 business days after system restoration.