{"data":{"id":"us-ok/okla.-stat.-tit.-18-18-2070","jurisdiction":"us-ok","citation":"Okla. Stat. tit. 18, § 18-2070","heading":"Affirmative defense — Conditions","body":"A. The requirements of this section are voluntary; provided, a\n\ncovered entity may only seek an affirmative defense under this act\n\nif the following conditions are met:\n\n1. A covered entity seeking an affirmative defense under this\n\nact shall create, maintain, and comply, including documentation of\n\nsuch compliance, with a written cybersecurity program that contains\n\nadministrative, technical, and physical safeguards for the\n\nprotection of both personal information and restricted information\n\nand that reasonably conforms to an industry-recognized cybersecurity\n\nframework, as described in this section;\n\n2. A covered entity's cybersecurity program shall be designed\n\nto do all of the following with respect to the information described\n\nin paragraph 1 of this subsection, as applicable:\n\na. protect the security and confidentiality of the\n\ninformation,\n\nb. protect against any anticipated threats or hazards to\n\nthe security or integrity of the information, and\n\nc. protect against unauthorized access to and acquisition\n\nof the information that is likely to result in a\n\nmaterial risk of identity theft or other fraud to the\n\nindividual to whom the information relates;\n\n3. The scale and scope of a covered entity's cybersecurity\n\nprogram under this subsection is appropriate if it is based on all\n\nof the following factors:\n\na. the size and complexity of the covered entity,\n\nb. the nature and scope of the activities of the covered\n\nentity,\n\nc. the sensitivity of the information to be protected,\n\nd. the cost and availability of tools to improve\n\ninformation security and reduce vulnerabilities, and\n\ne. the resources available to the covered entity; and\n\n4. The cybersecurity program shall contain requirements that it\n\nbe reviewed, evaluated, and updated on at least an annual basis and\n\nshall require documentation of the same.\n\nB. A covered entity that satisfies paragraphs 1 through 4 of\n\nsubsection A of this section is entitled to an affirmative defense\n\nto any cause of action sounding in tort that is brought alleging\n\nthat the failure to implement reasonable information security\n\ncontrols resulted in a data breach concerning personal information\n\nor restricted information.","path":["OK Code","Title 18"],"source_url":"https://www.oklegislature.gov/OK_Statutes/CompleteTitles/os18.pdf","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:36Z","sha256":"e8d8fb01ef4d7d2c8bbd923f730ac98792e2fccd246c614bf6e76ac74de7a336","source_id":"us-ok","stale":false,"prev":"us-ok/okla.-stat.-tit.-18-18-2069","next":"us-ok/okla.-stat.-tit.-18-18-2071"},"notice":"GroundRules: Original legal text. Not legal advice."}