Tort Liability for Cybersecurity Programs (cybersecurity safe harbor)
Iowa Cybersecurity Safe Harbor
Data security · Breach notification
Iowa's cybersecurity safe harbor gives businesses an affirmative defense against tort lawsuits over data breaches if they maintain a written cybersecurity program that reasonably conforms to a recognized framework such as the NIST Cybersecurity Framework, NIST SP 800-171 or 800-53, FedRAMP, CIS Controls, or ISO/IEC 27000. It is voluntary: it rewards good security rather than mandating it.
- Where
- Iowa
- Citation
- Iowa Code ch. 554G (554G.1 to 554G.4)
- Status
- In force
- In force since
- 2023-07-01
- Enforced by
- None (courts apply the affirmative defense in tort suits)
- People can sue
- No
- Penalties
- No penalties. The chapter creates an affirmative defense to tort claims alleging that failure to implement reasonable security controls caused a data breach, and expressly creates no private right of action, including class actions (554G.2(4), 554G.4).
- Applies to
- Covered entities: businesses (for-profit or nonprofit, including financial institutions and 28E entities, but not municipalities) that access, receive, store, maintain, communicate, or process personal information or restricted information (554G.1(1), (3))
Security duties
- To claim the defense, create, maintain, and comply with a written cybersecurity program with administrative, technical, operational, and physical safeguards for personal and restricted information.Iowa Code 554G.2(1) · Only if: Business seeks the affirmative defense
- Design the program to continually evaluate and mitigate threats, evaluate at least annually the maximum probable loss from a breach, and tell affected parties about risks and mitigation steps after a known breach.Iowa Code 554G.2(2)(a)-(c) · Only if: Business seeks the affirmative defense
- The program must reasonably conform to a listed industry framework (or to applicable regulatory regimes such as HIPAA, GLBA, or FISMA) and be updated within one year after a framework revision.Iowa Code 554G.2(4)(b); 554G.3 · Only if: Business seeks the affirmative defense
Sources
- Official text
- Iowa Code ch. 554G (Iowa Code 2026, Iowa Legislature)
- 2023 Iowa Acts ch. 63 (HF 553), approved May 3, 2023, no special effective-date clause
- Iowa Code 3.7 (default July 1 effective date)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The list of regulatory regimes in 554G.3(1)(b) was not read in full; HIPAA, GLBA and FISMA are named as examples only.
Research reference, not legal advice.