A written security program built to the standard Connecticut law names.
Under Connecticut's cybersecurity safe harbor law, businesses that maintain a written security program conforming to recognized frameworks, such as the NIST Cybersecurity Framework or CIS Controls, may be protected from punitive damages in data breach lawsuits.
What determines your timeline
Connecticut's safe harbor law sets no deadline, and it does not treat every business the same. The statute states that the scale and scope of a cybersecurity program shall be based on four factors:
- The size and complexity of the business
- The nature and scope of its activities
- The sensitivity of the information being protected
- The cost and availability of the tools that would protect it
Those same four factors determine how long your program takes to build. We assess them in the first conversation and give you a timeline before you commit to anything, not after.
What you get
A risk assessment, a written information security program with policies and controls mapped to a recognized framework, the evidence file behind it, and a roadmap your team can keep up. The same program strengthens your cyber insurance application and answers most of what customers ask in a security review.