Section 21-2-804 - Arkansas Self-Funded Cyber Response Program - Establishment - Scope of program coverage(a)(1) There is established the Arkansas Self-Funded Cyber Response Program to provide coverage for cybersecurity incidents and risks, damages, or losses caused by a cyberattack that are committed against a participating governmental entity.(2) The program shall be administered by the Arkansas Cyber Response Board.(3) All municipalities, counties, and school districts in this state shall participate in the program.(b)(1) Program coverage shall include actual losses, including without limitation repairing hardware and software damage sustained by a participating governmental entity, to an amount not to exceed the lesser of: (A) One hundred thousand dollars ($100,000); or(B) A maximum amount of cyber response coverage for cyberattacks based on minimum cybersecurity standards as established by the board.(2) Program coverage for loss of property other than money and securities is limited to the actual cash value of the property on the day that the loss was discovered.(3) Program coverage shall not be provided for a claim in which a participating governmental entity, through fraudulent means, takes money or other property from another participating governmental entity.(c)(1) The board shall establish minimum cybersecurity criteria for participating governmental entities.(2) A participating governmental entity shall have twelve (12) months to become compliant with the minimum cybersecurity criteria established under subdivision (c)(1) of this section.(3) The minimum cybersecurity criteria established by the board under subdivision (c)(1) of this section may differ between varying types and sizes of participating governmental entities.(4)(A) Failure to comply with the minimum cybersecurity criteria established by the board under subdivision (c)(1) of this section may result in the board's establishing lower program coverage amounts under subdivision (b)(1) of this section.(B) The minimum program coverage shall not include:(i) Compensatory damages;(iv) Payment of a ransom demand; or(v) Any interest or penalty amounts that accrue on a claim made under this subchapter.(d) Program coverage shall not include a loss sustained by a participating governmental entity as a result of liability imposed upon or assumed by the participating governmental entity to exonerate or indemnify a public official or public employee from or against liability incurred by the public official or public employee in the performance of his or her duties.(e) A participating governmental entity is legally liable for damages as a result of: (1) The deprivation or violation of a civil right of an individual by a public official or public employee; or(2) The tortious conduct of a public official or public employee.(f) Program coverage shall not include a loss sustained by a party other than a participating governmental entity.(g)(1) To sustain program coverage, a participating governmental entity, including each segment or component of the participating governmental entity for which coverage is available under the program, shall procure an audit of its books and records for each fiscal year, including an information systems audit, review, or assessment performed by Arkansas Legislative Audit.(2)(A) If a participating governmental entity or covered component of the participating governmental entity is not audited by Arkansas Legislative Audit, then the participating governmental entity or covered component of the participating governmental entity shall procure an audit, review, or assessment of its books, records, and information systems by an accountant in good standing with the Arkansas State Board of Public Accountancy according to government auditing standards issued by the Comptroller General of the United States.(B) The audit, review, or assessment under subdivision (g)(2)(A) of this section shall be completed within eighteen (18) months of the close of each participating governmental entity's fiscal year.Added by Act 2023, No. 846,§ 2, eff. 8/1/2023.