{"data":{"id":"us-tn/tenn.-code-ann.-4-1-423","jurisdiction":"us-tn","citation":"Tenn. Code Ann. § 4-1-423","heading":"Cybersecurity - State payment of ransom prohibited - Incident reporting protocol","body":"(a) A state entity shall not submit payment with an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then subsequently offering to decrypt that data in exchange for a ransom payment. (b) A state entity experiencing a ransom request in connection with a cybersecurity incident shall immediately notify and consult with the technology and innovation division of the Tennessee bureau of investigation. (c) As used in this section, \"state entity\": (1) Means an agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branches of state government, including a public institution of higher education and all other entities for which this state has oversight responsibility; and (2) Does not mean a vendor, contractor, insurance company, law firm, or other third party that has a contract, or does other business, with a state entity. Added by 2024 Tenn. Acts, ch. 534,s 1, eff. 3/7/2024.\n(a) A state entity shall not submit payment with an entity that has engaged in a cybersecurity incident on an information technology system by encrypting data and then subsequently offering to decrypt that data in exchange for a ransom payment.\n(b) A state entity experiencing a ransom request in connection with a cybersecurity incident shall immediately notify and consult with the technology and innovation division of the Tennessee bureau of investigation.\n(c) As used in this section, \"state entity\": (1) Means an agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branches of state government, including a public institution of higher education and all other entities for which this state has oversight responsibility; and (2) Does not mean a vendor, contractor, insurance company, law firm, or other third party that has a contract, or does other business, with a state entity.\n(1) Means an agency, department, institution, board, commission, committee, division, bureau, officer, official, or other entity of the executive, judicial, or legislative branches of state government, including a public institution of higher education and all other entities for which this state has oversight responsibility; and\n(2) Does not mean a vendor, contractor, insurance company, law firm, or other third party that has a contract, or does other business, with a state entity.","path":["TN Code","Title 4","Chapter 1"],"source_url":"https://oss-data-us.vaquill.ai/v2026.08/us_tn_statutes.parquet","current_through":"2026-08-14","vintage":"open-us-law v2026.08, retrieved 2026-09-14","retrieved_at":"2026-09-14T18:32:26Z","sha256":"68060f6922840cef98fa496927411349b10a37cc15a275470e0e310fc45fa12b","source_id":"us-tn","stale":false,"prev":"us-tn/tenn.-code-ann.-4-1-422","next":"us-tn/tenn.-code-ann.-4-1-424"},"notice":"GroundRules: Original legal text. Not legal advice."}