Bill Amendment: IL SB0707 | 2017-2018 | 100th General Assembly

NOTE: For additional amemendments please see the Bill Drafting List

---

Bill Title: PERSONAL INFO PRTCT AGENCY RPT

Status: 2017-08-25 - Public Act . . . . . . . . . 100-0412 [SB0707 Detail]

Download: Illinois-2017-SB0707-Senate_Amendment_001.html

---

Sen. Michael E. Hastings

Filed: 3/7/2017

10000SB0707sam001 LRB100 08839 JLS 22985 a
AMENDMENT TO SENATE BILL 707
AMENDMENT NO. ______. Amend Senate Bill 707 on page 5, line
12, by changing "or" to "concerning more than 250 Illinois
residents or"; and
on page 5, line 18, by changing "45" to "60"; and
on page 5, line 20, by changing "or" to "concerning more than
250 Illinois residents or"; and
on page 6, by replacing lines 3 through 5 with the following:
"(iii) a description of the attack; and
(iv) an overview of corrective and preventative"; and
on page 6, line 8, by deleting "immediately"; and
on page 6, line 15, by changing "indefinitely" to "for a period
of 60 days; and

10000SB0707sam001 - 2 - LRB100 08839 JLS 22985 a
on page 6, by inserting immediately below line 15, the
following:
"(i) A State agency that has been subject to or has reason
to believe it has been subject to a single breach of the
security of the data concerning the personal information of
more than 250 Illinois residents or an instance of aggravated
computer tampering (as defined in Section 17-52 of the Criminal
Code of 2012) shall notify the Office of the Chief Information
Security Officer of the Illinois Department of Innovation and
Technology regarding the breach or instance of aggravated
computer tampering. Such notification shall be made without
delay but no later than 72 hours following the discovery of the
incident.
Upon receiving notification of such incident, the Chief
Information Security Officer shall without delay take
necessary and reasonable actions to:
(i) assess the incident to determine the potential
impact on the overall confidentiality, security, and
availability of State of Illinois data and information
systems;
(ii) ensure the security incident is contained to
minimize additional impact and risk to the State;
(iii) identify the root cause of the incident;
(iv) provide recommendations to the impacted State
agency to assist with eradicating the threat and removing

10000SB0707sam001 - 3 - LRB100 08839 JLS 22985 a
and mitigating any vulnerabilities to reduce the risk of
further compromise; and
(v) assist the impacted State agency in any necessary
recovery efforts to ensure effective return to a state of
normal operations.
The Department of Innovation and Technology may agree to
submit the comprehensive report required in subsection (f) in
lieu of the impacted agency.".