Cybersecurity safe harbor laws are state statutes that give a business a legal shield against data breach lawsuits when it can show it followed a recognized security framework before the breach happened. In practice, they create an affirmative defense: a company that maintained a written, framework-aligned cybersecurity program can block or limit tort claims alleging inadequate security, and in some states courts cannot award punitive damages against it. Ohio passed the first such law in 2018, and several states have followed with variations on the same idea.
How the Affirmative Defense Works
In a typical breach lawsuit, the plaintiff argues the company failed to use reasonable security measures and that this failure caused the breach. Without safe harbor protection, the company fights that claim on the merits, through discovery and expert testimony that can run for years. Safe harbor laws short-circuit that fight. If the company can demonstrate it had a written cybersecurity program conforming to a recognized framework at the time of the breach, it raises an affirmative defense that can end the case before it reaches a jury.
Some statutes go further. Connecticut prohibits courts from awarding punitive damages against a covered entity that maintained a compliant written cybersecurity program at the time of the breach. Utah’s statute provides a full affirmative defense to claims alleging that the business failed to implement reasonable information security controls.1Utah Legislature. Utah Code 78B-4-702 – Affirmative Defense for a Breach of System Security Punitive damages can dwarf compensatory awards, so removing them from the table changes the worst-case math significantly.
The phrase that runs through all of these laws is “at the time of the breach.” A program adopted three years ago but allowed to lapse six months before the incident earns no protection. The defense turns on active, ongoing compliance, not a one-time exercise.
What Safe Harbor Laws Do Not Cover
The protection has hard edges, and misreading them can be expensive. Most statutes carve out gross negligence and willful or intentional misconduct. Connecticut’s punitive damages bar does not apply if the security failure resulted from gross negligence or intentional misconduct, and Utah’s law contains similar language. A company that knew about a critical vulnerability and deliberately chose not to patch it cannot use the defense.
These laws also apply only to private civil suits under state tort law. They do not shield a business from regulatory enforcement. State attorney general investigations, FTC actions for unfair or deceptive practices, and obligations under HIPAA, the Gramm-Leach-Bliley Act, and state breach notification statutes all remain in full effect regardless of safe harbor compliance.
Finally, the defense does not guarantee a win. Courts still examine whether the program genuinely conformed to the framework the company claims to follow. Paper compliance with nothing behind it will not survive scrutiny.
States That Have Enacted Safe Harbor Protections
The specifics differ, but every one of these laws rewards documented compliance with a recognized framework.
Ohio
The Ohio Data Protection Act of 2018, codified at Ohio Revised Code Chapter 1354, was the first. It allows businesses that experience a breach of personal information to raise an affirmative defense in tort claims if their cybersecurity program reasonably conformed to a recognized industry framework. Ohio’s statute lists qualifying frameworks including the NIST Cybersecurity Framework, the CIS Critical Security Controls, the ISO 27000 series, HIPAA, and the Gramm-Leach-Bliley Act.
Utah
Utah’s Cybersecurity Affirmative Defense Act, at Utah Code Sections 78B-4-701 through 78B-4-706, protects entities that create, maintain, and reasonably comply with a written cybersecurity program containing administrative, technical, and physical safeguards for personal information.1Utah Legislature. Utah Code 78B-4-702 – Affirmative Defense for a Breach of System Security The defense applies to claims alleging that a failure to implement reasonable controls led to the breach.
Connecticut
Connecticut Public Act 21-119, codified at General Statutes Section 52-557v, prohibits courts from awarding punitive damages against a covered entity that maintained a compliant program at the time of the breach. The program must include administrative, technical, and physical safeguards and align with one of several listed frameworks. Businesses subject to PCI-DSS must comply with one of the general-purpose frameworks and the current version of PCI-DSS to qualify.
Texas
Texas Senate Bill 2610, effective September 1, 2025, protects Texas businesses with fewer than 250 employees that maintain an industry-compliant cybersecurity program. The framework requirement scales with size: companies with 100 to 249 employees must implement a full standard such as NIST or ISO/IEC. The statute also references alignment with SOC 2 as part of its compliance documentation for mid-sized businesses.
Nebraska
Nebraska took a different route. Its cybersecurity liability exemption provides that a private entity shall not be liable in a class action arising from a cybersecurity event unless the event was caused by willful, wanton, or gross negligence. The threshold question is the nature of the negligence rather than alignment with a specific framework.
Which Frameworks Qualify
Picking a framework your state’s statute doesn’t recognize defeats the purpose of the exercise, so start with the statutory list.
General-Purpose Frameworks
The NIST Cybersecurity Framework appears in nearly every safe harbor statute. It organizes cybersecurity risk management around five functions: identify, protect, detect, respond, and recover.2National Institute of Standards and Technology. Cybersecurity Framework It works for organizations of any size and does not prescribe specific technologies. NIST Special Publication 800-171 covers controlled unclassified information on non-federal systems, and NIST Special Publication 800-53 catalogs security controls primarily for federal systems. The CIS Critical Security Controls provide a more prescriptive alternative built as a set of specific defensive actions.3Center for Internet Security. CIS Critical Security Controls The ISO/IEC 27000 series is an internationally recognized information security management system standard common among businesses with global operations.
Industry-Specific Standards
Healthcare organizations look to the HIPAA Security Rule, which sets national standards for protecting electronic health information through administrative, physical, and technical safeguards.4U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule Financial institutions fall under the Gramm-Leach-Bliley Act, which requires an information security program with its own administrative, technical, and physical safeguards.5Federal Trade Commission. Gramm-Leach-Bliley Act Businesses that handle payment card data may also need PCI-DSS. Match the framework to your industry and to the exact statutory language of the state whose protection you want.
What the Written Program Has to Contain
Every safe harbor statute requires a written cybersecurity program. Without the document, the defense fails no matter how good the underlying practices are. A compliant program addresses three categories of safeguards:
- Administrative safeguards, including employee security training, incident response plans, vendor management policies, and access provisioning procedures.
- Technical safeguards, including encryption of sensitive data, multi-factor authentication, intrusion detection, vulnerability scanning, and patch management.
- Physical safeguards, including access controls for server rooms and data centers, secure hardware disposal, and visitor management for facilities housing critical systems.
Utah’s statute requires all three categories and specifies that the program must protect the security, confidentiality, and integrity of personal information and guard against anticipated threats.1Utah Legislature. Utah Code 78B-4-702 – Affirmative Defense for a Breach of System Security Connecticut adds that the program must be scaled to four factors: the size and complexity of the business, the nature and scope of its activities, the sensitivity of the information it holds, and the cost and availability of security tools. A five-person startup is not held to the same standard as a Fortune 500 company. What the law asks for is reasonableness relative to your situation.
Keeping the Defense Alive
The most common way businesses lose safe harbor protection is by writing the program once and never updating it. Courts and opposing counsel look at whether the program was actively maintained at the time of the breach, not whether it was strong the day it was written. A program that hasn’t been touched in two years and doesn’t address current threats is unlikely to satisfy the “reasonably complies” language in most statutes.
Ongoing compliance means recurring work. Vulnerability assessments should run on a set schedule, with documented findings and remediation steps. Employee training records need to be current. Incident response plans should be tested through tabletop exercises, and the results should be written down. Every update and assessment creates a timestamped record that strengthens the defense later.
Third-party audits produce the strongest evidence of framework alignment because they represent an independent assessment. Fees vary with the framework, the organization’s size, and the complexity of its systems, running from roughly $15,000 for a small business to well over $100,000 for large enterprises.
The Insurance Side of Compliance
Framework compliance also affects cyber insurance costs. A 2024 healthcare cybersecurity benchmarking study found that organizations using the NIST Cybersecurity Framework as their primary standard reported one-third lower cyber insurance premium cost growth than organizations using other frameworks or none. Underwriters evaluate cybersecurity maturity during quoting, and documented framework alignment signals lower risk. Insurers may require it as a condition of coverage or offer discounts for it. Even in states without a safe harbor statute, a written program aligned with NIST or a comparable standard can reduce premiums and improve coverage terms.