Nevada § 603A.210 - Security measures

§ 603A.210. Security measures

1. A data collector that maintains records which contain personal information of a

resident of this State shall implement and maintain reasonable security measures to

protect those records from unauthorized access, acquisition, destruction, use, modification

or disclosure. 2. If a data collector is a governmental agency and maintains records which contain

personal information of a resident of this State, the data collector shall, to the

extent practicable, with respect to the collection, dissemination and maintenance

of those records, comply with the current version of the CIS Controls as published

by the Center for Internet Security, Inc. or its successor organization, or corresponding

standards adopted by the National Institute of Standards and Technology of the United

States Department of Commerce. 3. A contract for the disclosure of the personal information of a resident of this

State which is maintained by a data collector must include a provision requiring the

person to whom the information is disclosed to implement and maintain reasonable security

measures to protect those records from unauthorized access, acquisition, destruction,

use, modification or disclosure. 4. If a state or federal law requires a data collector to provide greater protection

to records that contain personal information of a resident of this State which are

maintained by the data collector and the data collector is in compliance with the

provisions of that state or federal law, the data collector shall be deemed to be

in compliance with the provisions of this section. 5. The Office of Information Security of the Office of the Chief Information Officer

within the Office of the Governor shall create, maintain and make available to the

public a list of controls and standards with which the State is required to comply

pursuant to any federal law, regulation or framework that also satisfy the controls

and standards set forth in subsection 2.