S 49

As introduced: - Requires every state, county, and municipal employee to complete general cybersecurity awareness training every year. - Establishes a cybersecurity control board to set minimum cybersecurity standards or requirements for covered entities. - Establishes a Massachusetts Cyber Incident Response Team to help the government prepare for, respond to, mitigate against and recover from significant cybersecurity incidents. - Sets procedure for critical infrastructure cybersecurity incidents. - Establishes an Automated Decision Making Control Board to make policy recommendations. - Establishes a Massachusetts Innovation Fund and State Agency Technology Upgrades Account. - Adds cybersecurity attacks to civil defense provisions. - Amends security breach law definition of "personal information" to add taxpayer identification number, biometric information, genetic information, health insurance information, medical information, date of birth, specific geolocation information, online account information. - Requires an unauthorized breach to represent harm to a resident. - Requires the victim of a breach to certify credit monitoring services unless compromised by a breach of medical information or specific geolocation information. - Amends notice requirements to a consumer upon a breach. - Makes it unlawful to manufacture, modify, sell, transfer, possess or operate a robotic device equipped or mounted with a weapon. - Prohibits an insurance policy from limiting or delaying the ability of a party to report a cybersecurity incident. - Creates a Cybersecurity Regional Alliances and Multistakeholder Partnerships Pilot Program Fund.