Nevada combines cybersecurity offices and requires city and county response plans

The law places the cybersecurity office in the Governor’s Office and combines it with the Office of Information Security. The combined Office of Information Security and Cyber Defense is part of the Office of the Chief Information Officer in the Governor’s Office. The law took effect July 1, 2025.

The Office must assess risks to state agency systems and prepare a public statewide cybersecurity plan. The plan covers information systems in Nevada and includes preparation, risk reduction, recovery, and response to threats or attacks. The public plan must not reveal details that identify specific weaknesses in information systems. State agencies with cybersecurity policies must periodically test whether employees follow them and report the results to the Office each year. The first plan was due by January 1, 2026.

Each city and county must keep a cybersecurity incident response plan and file it with the Office. These duties apply to every Nevada city and county. The Chief sets required plan contents by regulation. After reviewing its plan each year, a city or county must file any revision or certify that its latest filed plan is current. Plans are confidential, except for disclosure under a lawful court order, as reasonably needed during terrorism or a related emergency, or as allowed by law. New or revised plans must be filed within 10 days of adoption or revision. The annual review and filing must happen as soon as practical, no later than December 31.