Oregon public bodies would report substantial cyber incidents within 48 hours

A public body would notify the State Chief Information Officer and submit a report about an incident. This applies to local governments, local service districts, and special government bodies after discovering a substantial incident affecting their systems or services, including certain unauthorized access caused by a third-party service or data-hosting provider. The report must describe steps taken or reasonably needed to prevent, reduce, or recover from harm to the body's information system. The duty would begin July 1, 2026. The 48-hour period would start when the public body discovers the incident.

The State Chief Information Officer would establish a secure reporting system and maintain a webpage with reporting instructions. The system would securely accept the required notices and reports from public bodies. The system must track incident trends and allow reports about incident types, threat indicators, defenses, and reporting entities. The officer would have to establish the system and webpage within 90 days after the Act takes effect. Reporting duties would begin July 1, 2026.

The State Chief Information Officer would keep incident reports confidential and send an annual summary to the Governor and a legislative committee. The confidentiality rule covers reports submitted under this section. The annual summary would describe notices received from public bodies. The officer could share report information with the Oregon Cybersecurity Center of Excellence, law enforcement, or another entity the officer considers appropriate, and could share anonymized threat indicators and defensive measures. The annual summary could not include information or materials exempt from public disclosure. The annual report would cover the preceding year and be sent to the Governor and presented to the legislative committee.