Tort Liability for Cybersecurity Programs (cybersecurity safe harbor)

Iowa's cybersecurity safe harbor gives businesses an affirmative defense against tort lawsuits over data breaches if they maintain a written cybersecurity program that reasonably conforms to a recognized framework such as the NIST Cybersecurity Framework, NIST SP 800-171 or 800-53, FedRAMP, CIS Controls, or ISO/IEC 27000. It is voluntary: it rewards good security rather than mandating it.