PENNSYLVANIA, January 19 - Attorney General within three business days following

discovery of the breach. GENERAL.

(2) A STATE AGENCY CONTRACTOR SHALL NOTIFY THE CHIEF

INFORMATION SECURITY OFFICER, OR A DESIGNEE, OF THE STATE

AGENCY FOR WHOM THE WORK IS PERFORMED OF A BREACH OF THE

SECURITY OF THE SYSTEM WITHIN SEVEN BUSINESS DAYS FOLLOWING

DETERMINATION OF THE BREACH.

(2) (3) A State agency under the Governor's jurisdiction

shall also provide notice of a breach of THE security of the

system to the Governor's Office of Administration within

three business days following the discovery DETERMINATION of

the breach. Notification shall occur notwithstanding the

existence of procedures and policies under section 7.

(3) (4) A State agency that, on the effective date of

this section, has an existing contract with a State agency

contractor shall use reasonable efforts to amend the contract

to include provisions relating to the State agency

contractor's compliance with this act UNLESS THE EXISTING

CONTRACT ALREADY CONTAINS BREACH OF THE SECURITY OF THE

SYSTEM NOTIFICATION REQUIREMENTS .

(4) (5) A State agency that, after the effective date of

this section, enters into a contract with a State agency

contractor shall ensure that the contract includes provisions

relating to the State agency contractor's compliance with

this act.

(a.2) Notification by county, school district or

municipality.--If a county, school district or municipality is

the subject of a breach of security of the system, the county,

school district or municipality shall provide notice of the

breach of security of the system required under subsection (a)

20210SB0696PN1330 - 4 -

<--

<--

<--

<--

<--

<--

<--

<--

<--

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30