Connecticut SB 403: AN ACT CONCERNING INSURANCE MARKET CONDUCT AND INSURANCE LICENSING.

Bill Text

LCO No. 2691 1 of 6

General Assembly Raised Bill No. 403
February Session, 2026 LCO No. 2691

Referred to Committee on PUBLIC SAFETY AND SECURITY

Introduced by:
(PS)

AN ACT CONCERNING CYBERSECURITY.
Be it enacted by the Senate and House of Representatives in General
Assembly convened:

Section 1. (NEW) (Effective October 1, 2026) As used in this section and 1
sections 2 to 11, inclusive, of this act: 2
(1) "Covered entity" means any business, health care entity or 3
government contractor operating in the state that maintains or possesses 4
sensitive data or operates critical infrastructure; 5
(2) "AAL3 identity assurance" means authentication requiring high-6
confidence identity proofing and forensic-grade verification of identity 7
credentials that resists impersonation, replay and credential 8
compromise; 9
(3) "Non-repudiation" means a security state in which no party to a 10
transaction can deny the validity of such transaction or a corresponding 11
access log; and 12
(4) "Material security deficiency" means a systemic failure to maintain 13
cybersecurity standards that poses a foreseeable risk to public safety or 14

Raised Bill No. 403

LCO No. 2691 2 of 6

operational continuity. 15
Sec. 2. (NEW) (Effective October 1, 2026) (a) Notwithstanding any 16
provision of the general statutes, on and after July 1, 2027, any covered 17
entity that maintains a cybersecurity program in compliance with the 18
"Cybersecurity Framework 2.0" published by the National Institute of 19
Standards and Technology and AAL3 identity assurance standards shall 20
be deemed in compliance with all applicable state laws and regulations 21
that establish equivalent cybersecurity requirements. 22
(b) Not later than July 1, 2027, each critical infrastructure entity shall 23
utilize decentralized security architectures that provide non-24
repudiation functions and eliminate centrally stored passwords or 25
biometrics. 26
Sec. 3. (NEW) (Effective October 1, 2026) (a) No employer shall 27
discharge, discipline or otherwise penalize or threaten an employee 28
who is a cybersecurity professional because such employee, or a person 29
acting on behalf of such employee, reports a material security deficiency 30
or a failure to maintain non-repudiation standards to a supervisor or the 31
Division of Emergency Management and Homeland Security within the 32
Department of Emergency Services and Public Protection. 33
(b) The protections provided under subsection (a) of this section shall 34
be in addition to any protections provided under section 31-51m of the 35
general statutes. 36
Sec. 4. (NEW) (Effective October 1, 2026) (a) Not later than seventy-two 37
hours after a covered entity discovers a cybersecurity incident resulting 38
in unauthorized access to sensitive data, disruption of public services or 39
operational continuity or material risk to such critical entity's sensitive 40
data, critical infrastructure, public services or operational continuity, the 41
covered entity shall notify the Division of Emergency Management and 42
Homeland Security within the Department of Emergency Services and 43
Public Protection. 44

Raised Bill No. 403

LCO No. 2691 3 of 6

(b) The notification shall include, to the extent known by the covered 45
entity: (1) A description of the nature and scope of the cybersecurity 46
incident, (2) a description of the affected systems, networks or data, (3) 47
an estimate of the duration of the cybersecurity incident, and (4) an 48
assessment of any impact on the covered entity's operations, financial 49
effects or public impact. 50
(c) The covered entity shall provide supplemental notice to the 51
division as additional information becomes available. 52
Sec. 5. (NEW) (Effective October 1, 2026) On and after January 1, 2027, 53
each covered entity shall implement and maintain minimum 54
cybersecurity safeguards consistent with "cybersecurity framework" 55
principles published by the National Institute of Standards and 56
Technology, including, but not necessarily limited to: 57
(1) The timely installation of critical security patches and system 58
updates; 59
(2) The encryption of sensitive data at rest and in transit; 60
(3) The implementation of backup systems capable of restoring 61
operations in the event of a ransomware incident or system 62
compromise; and 63
(4) A cybersecurity risk assessment conducted at least annually. 64
Sec. 6. (NEW) (Effective October 1, 2026) (a) On and after January 1, 65
2028, each critical infrastructure entity, health care provider, financial 66
institution and state agency shall adopt a quantum-transition readiness 67
posture, including, but not necessarily limited to, planning for 68
migration toward post-quantum cryptography approved by the 69
National Institute of Standards and Technology. 70
(b) On and after January 1, 2028, such entities, providers, institutions 71
and agencies shall implement cryptographic agility architectures 72
capable of rapid algorithm replacement