The status of new cybersecurity laws proposed in Virginia

As employers in the private and public sectors adjust to the advent of flexible work over the last two years, they're simultaneously trying to protect their organizations from attackers looking to steal and sell data.

2021 was a year defined by significant cyberattacks that crippled infrastructure and shut down hospitals, schools, and municipal governments. It's the same year the Colonial Pipeline, which supplies gasoline to millions living in the Northeast U.S., was hobbled by a ransomware attack that triggered a gas panic and elevated prices for consumers.

And lawmakers were paying attention—passing dozens of laws in 2022 aimed at training workers, securing government agencies, and funneling money into cybersecurity education programs.

Drata compiled a list of new cybersecurity-related legislation in Virginia through February 2023 based on data collected by the National Conference of State Legislatures.

States that passed the most cybersecurity legislation in the past year:

#1. Maryland - 8 laws enacted

#2. Florida - 4

#3 (tie). Virginia - 3

#3 (tie). Kentucky - 3

Virginia new cybersecurity laws in 2022
- Bills enacted: 3
- Bills failed: 2
- Bills vetoed: 0

VA HB 30
- Description: Relates to Budget Bill, provides for all appropriations of the Budget submitted by the Governor of Virginia in accordance with the provisions of Section 2.2-1509, Code of Virginia, and to provide a portion of revenues for the two years ending respectively on the thirtieth day of June, 2023, and the thirtieth day of June, 2024. Provides funding for the Commonwealth Cyber Initiative (CCI) for resources for faculty recruiting and to the Cybersecurity Public Service Grant Program (the Program) as a public-private initiative for the purpose of attracting to and retaining in qualified employment talented recent graduates and veterans to meet qualified employers' growing demand for cybersecurity professionals.
- Read more about the bill here

VA HB 1290
- Description: Relates to public bodies, relates to security of government databases and data communications.
- Read more about the bill here

VA SB 764
- Description: Relates to public bodies, relates to security of government databases and data communications. Requires every public body to report all (i) known incidents that threaten the security of the Commonwealth's data or communications or result in exposure of data protected by federal or state laws and (ii) other incidents compromising the security of the public body's information technology systems with the potential to cause major disruption to normal activities of the public body or other public bodies. Such reports shall be made to the Virginia Fusion Intelligence Center within 24 hours from when the incident was discovered. The Virginia Fusion Intelligence Center shall share such reports with the Chief Information Officer or his designee at the Virginia Information Technologies Agency, promptly upon receipt.
- Read more about the bill here