Which state safe harbor laws name the CIS Controls, and what do they protect?
A customer, insurer or board member asks whether your security program would earn safe harbor protection if a breach led to litigation. The short answer starts with the statutes. CIS reports that the CIS Controls appear in state cybersecurity safe harbor laws in Ohio, Utah, Connecticut and Iowa. These laws reward a written program that reasonably conforms to a recognized framework. They do not mandate specific tools, products or configurations, so the question is whether your documented program is one the statute accepts, not whether you bought a particular platform.
The defense differs by state, and the difference matters when you scope your work. Under Iowa Code chapter 554G, a covered entity gets an affirmative defense to tort claims under Iowa law or in Iowa courts that allege a failure to implement reasonable security controls caused a breach of personal or restricted information. Connecticut takes a different route. Under the 2021 law CIS describes, the Superior Court may not assess punitive damages against an organization that created, maintained and complied with a conforming written program. Iowa's chapter also states that it creates no private right of action. Each statute sets its own conditions, including how often you must evaluate risk, how you treat maximum probable loss, and when you must conform to a revised framework. Confirm those conditions against the statute text with counsel before you rely on them.
No law certifies a company, and no state issues a safe harbor determination you can file with a customer. The defense is something you would argue in litigation, supported by evidence that your program existed, was maintained and was followed. The organization owns its controls and its program. An implementation partner can help prepare systems, documentation and evidence, but only a court or an independent assessor can decide whether the conditions were met. Start by mapping which states your customers, data and operations touch, then ask counsel which statute applies and what evidence that statute expects.
How Iowa, Connecticut, Ohio and Utah differ
Iowa Code chapter 554G gives a covered entity an affirmative defense to tort claims brought under Iowa law or in Iowa courts that allege a failure to implement reasonable information security controls caused a breach of personal or restricted information. The defense depends on a written cybersecurity program with administrative, technical, operational and physical safeguards that reasonably conforms to an industry-recognized framework. Section 554G.3 names the CIS Critical Security Controls alongside the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, FedRAMP and the ISO/IEC 27000 family.
- Written program: The covered entity must create, maintain and comply with the program, so a document that is not followed does not support the defense.
- Risk evaluation: Section 554G.2 requires continual evaluation and mitigation of anticipated threats, and at least annual evaluation of the maximum probable loss from a breach.
- Spending test: Under section 554G.2, the program's scale is appropriate if its operating cost is no less than the most recently calculated maximum probable loss value.
- Framework revisions: When a listed framework publishes a final revision, the program must reasonably conform to it no later than one year after publication.
- No private right of action: Section 554G.4 states the chapter creates no private right of action, including class actions, so it limits claims but does not create new ones.
Check with counsel how the defense applies to your Iowa exposure and how the risk and spending tests will be documented each year.
Connecticut took a different route. Governor Ned Lamont signed HB 6607 in July 2021, and under CIS's account of the law, it bars the Superior Court from assessing punitive damages in a data breach case against an organization that created, maintained and complied with a written cybersecurity program conforming to frameworks such as the NIST CSF and the CIS Controls. The law removes one form of exposure rather than granting a complete defense to all claims. CIS reported that it took effect on October 1, 2021.
- Punitive damages bar: The protection applies to punitive damages in Superior Court, not to every category of damages or every court.
- Written program: The organization must have created, maintained and complied with a written program, so evidence of operation matters as much as the document.
- Effective date: CIS reported the law took effect on October 1, 2021, so the statute applies to breaches after that date.
- Six-month revision rule: CIS reported that organizations must conform to revisions of a recognized framework within six months after publication, which is much shorter than Iowa's one-year window.
- Incentive design: CIS describes Connecticut as joining Ohio and Utah in rewarding practices rather than mandating them.
Confirm the current statutory text, the six-month rule and how the program must be documented before you plan your framework update cycle.
CIS lists Ohio among the states that include the CIS Controls in cybersecurity safe harbor statutes, and CIS describes Ohio as one of the incentive-based states that reward businesses for adopting cybersecurity best practices. The details of the defense, including the kinds of claims it covers, the framework conditions and any revision requirements, were not part of the material used for this page, so you should not assume they match Iowa or Connecticut.
- Named by CIS: CIS includes Ohio in its list of states with CIS Controls safe harbor provisions.
- Incentive approach: CIS characterizes Ohio's law as rewarding a documented program rather than requiring specific controls.
- Scope of defense: Confirm whether the protection is an affirmative defense, a limit on damages or something else, and which courts and claims it covers.
- Program conditions: Confirm what a qualifying written program must contain and whether it must be maintained and followed in practice.
- Framework updates: Confirm whether Ohio requires conformance to new framework versions and by when.
Read the Ohio statute itself and have counsel confirm each condition before you describe the protection to a customer or regulator.
CIS also lists Utah among the states that include the CIS Controls in cybersecurity safe harbor statutes, as part of the same incentive-based group as Ohio and Connecticut. The material available for this page does not describe Utah's defense, its qualifying program elements or its update conditions, so treat any summary of Utah's law as unconfirmed until you have read the statute.
- Named by CIS: CIS lists Utah with Ohio, Iowa and Connecticut as a state with CIS Controls safe harbor provisions.
- Incentive approach: CIS describes the group of states as rewarding best practices rather than mandating them.
- Defense type: Confirm whether Utah offers a defense to tort claims, a damages limit or another protection, and where it applies.
- Conformance conditions: Confirm how the statute defines a reasonable program and whether it names a framework version or a revision deadline.
- Documentation: Confirm what records you must keep to show ongoing compliance with the written program.
Once you have the statute, map each condition to an owner and an evidence source in your CIS program, and ask counsel to confirm the result.
What conditions must the program meet to claim the defense?
The core condition is that the organization must create, maintain and comply with a written cybersecurity program that reasonably conforms to a recognized framework such as the CIS Controls. The program has to cover administrative, technical, operational and physical safeguards, so a document that addresses only IT settings will not carry the defense. In Iowa, the statute under Iowa Code chapter 554G applies this test to tort claims that a failure to implement reasonable information security controls caused a breach of personal or restricted information. Connecticut and Ohio use similar written-program language to shape what a court may consider, so counsel should confirm the exact wording and scope of each state law that applies to the organization.
For Iowa, the program must also run as a continuing process. Under Iowa Code section 554G.2, the organization must evaluate and mitigate anticipated threats continually, and it must evaluate at least once a year its maximum probable loss from a data breach. The statute then ties the program's scale to money: the program is appropriate only if its operating cost is no less than the most recently calculated maximum probable loss value. Finance, risk and security leaders should agree that figure in writing, record how it was calculated, and confirm the operating budget for the program meets or exceeds it. If the number is not known, the first task is to produce it, not to assume it.
Compliance has to be shown in practice, not only on paper. A policy that names the CIS Controls but is never applied will fail when a plaintiff's counsel asks for evidence. Teams should keep dated proof that each safeguard operates, such as asset inventories, access reviews, patch records, log samples, tabletop exercise reports and risk register updates tied to the annual loss evaluation. Under Iowa Code section 554G.3, a covered entity must also reasonably conform to a revised framework no later than one year after the revision is published, so the program needs an owner who tracks framework versions and plans updates. Confirm the current conformance deadlines for each state with qualified counsel before relying on them.
How framework version updates change your deadline
This sequence shows how a new CIS Controls revision starts a conformance clock under state safe harbor law, and how to record each decision so you can prove you met the deadline.
Recognize when CIS publishes a revision
CIS publishes a new version of the CIS Critical Security Controls on its website, and the release date is the starting point for any statutory clock. CIS published version 8.1, an iterative update to version 8, on 24 June 2024, and it remains the current version on cisecurity.org. Assign one person in security governance to watch the CIS Controls version page and the press release feed, and log each publication date in your compliance calendar. The step is complete when every CIS revision you rely on has a recorded publication date and a named owner.
Confirm which statute applies to your organization
Identify which state safe harbor laws cover your organization, since each one sets its own conformance period and eligibility conditions. Iowa Code chapter 554G lists the CIS Controls among qualifying frameworks, and CIS reports that Ohio, Utah, Connecticut and Iowa include the Controls in their safe harbor statutes. Ask counsel to confirm the statute, the covered entity definition and whether the revision triggers a new conformance duty for your specific facts. The step is complete when a written applicability note names each statute and the period it sets.
Set the conformance deadline for each statute
Translate the statutory rule into a dated deadline for your program. Under Iowa Code section 554G.3, a covered entity must reasonably conform its program to a final framework revision no later than one year after the publication date. CIS reports that Connecticut requires conformance to a revision within six months after publication. Record the earlier of the applicable dates as your working deadline, and confirm the calculation with counsel. The step is complete when the deadline for each applicable statute appears in the compliance calendar with its source citation.
Compare the revision against your current program
Run a gap analysis that compares the new revision with your written cybersecurity program, Safeguard by Safeguard. For CIS Controls v8.1, review the realigned NIST CSF 2.0 function mappings, including the new Govern function, the revised asset classes and Safeguard descriptions, and the expanded glossary definitions. Assess which Safeguards changed in wording or scope and whether your documented processes, owners and evidence still match. The step is complete when the gap analysis lists each changed Safeguard, its current status and the evidence that supports it.
Decide and document the adoption approach
Decide whether to adopt the revision, retain the prior version with a documented rationale, or adopt it in phases. The decision should be approved by the executive or board body that owns the written program, and it should state the reasoning in terms the statute recognizes: that the program reasonably conforms to an industry-recognized framework. Record the approver, the date and the scope. The step is complete when a signed decision record references the gap analysis and the statutory deadline it addresses.
Update the written program and its evidence
Revise the policies, procedures, control owners and evidence sources to reflect the decisions in the gap analysis. Update the written program so each changed Safeguard maps to a current process, a named owner and an evidence source, such as configuration exports, access reviews or incident exercise records. Keep the prior version so you can show how the program evolved over time. The step is complete when the updated program is approved, versioned and distributed to control owners.
Verify conformance and retain the record
Test that the updated controls operate as written, using internal testing or an independent assessor if your organization engages one. Your organization owns the conformance determination, and only an independent auditor or assessor issues reports or certifications, which CIS does not offer for the Controls. Retain the gap analysis, decision record, evidence and test results together so you can produce them if a breach claim tests the defense. The step is complete when the verification results and the retained record are indexed and accessible to counsel.
Repeat the cycle for each new revision
Treat each new CIS revision as a recurring trigger that restarts steps one through seven. Review the revision schedule, the statutory periods in each state where you operate and any changes to the statutes themselves, since the conditions may change over time. Confirm the cycle with counsel at least when a revision is published. The step is complete when the next review date and owner are recorded in the compliance calendar.
What safe harbor does not do
Safe harbor laws reward a written program that reasonably conforms to a framework such as the CIS Controls, but they are narrower than they sound. The cards below cover what the defense does not do, so that legal, security and executive teams size their expectations and their program correctly before relying on it.
A defense that must be raised
Under Iowa Code chapter 554G, the protection is an affirmative defense, which means the covered entity must raise it in a tort claim and prove that its written program existed, was maintained and was complied with. The program must have been in place before the breach, so a framework adopted after an incident does not help. Ask counsel which records, such as policy approvals, risk assessments and CSAT or assessment outputs, would be needed to prove compliance.
No protection against breaches
A safe harbor limits liability after a breach. It does not reduce the likelihood of one. The Iowa program must still evaluate and mitigate anticipated threats continually, and the scale of the program is tied to the entity's most recently calculated maximum probable loss. An organization that treats conformance as a paperwork exercise may pass a legal test while remaining exposed, so pair the written program with the technical Safeguards it describes.
Not a certification
No organization can be certified against the CIS Controls, and a safe harbor statute does not create a certificate either. The entity must demonstrate that its program reasonably conforms, typically with evidence mapped to Safeguards and reviewed by counsel. Do not describe a program to customers or regulators as certified or accredited on the basis of a state statute.
Limited to listed claim types
Each statute addresses specific kinds of claims. Iowa's defense covers tort claims under Iowa law or in Iowa courts alleging that a failure to implement reasonable information security controls caused a breach of personal or restricted information. It does not address regulator enforcement, contractual liability to customers or claims under other states' laws. Connecticut and Ohio each use their own terms, so map every obligation separately rather than assuming one statute covers the rest.
No private right of action in Iowa
Iowa Code section 554G.4 states that chapter 554G does not create a private right of action, including a class action. The statute therefore gives no new basis for suing an organization. Its value lies in the defense against claims brought on other grounds. Confirm with counsel which claims remain available under other Iowa law, and how the absence of a private right of action affects the entity's exposure in other states.
Conditions and version updates
Safe harbor depends on ongoing conformance, not a one-time adoption. Iowa requires an entity to conform to a final revision of a listed framework within one year of its publication, and Connecticut requires conformance to revisions within six months. Track CIS version changes, such as the move to v8.1 published on 24 June 2024, and document the decision and timeline for each update. Have counsel confirm the deadline that applies to each jurisdiction where the entity operates.
What evidence shows the program reasonably conforms
The CIS Controls Assessment Specification (CAS) is the most precise public description of what a reviewer will look for. For each Safeguard it defines the inputs, operations, measures and metrics used to verify that the Safeguard is implemented. CIS is explicit that the specification says what to measure, not how, so the organization still decides how each measure is produced and recorded. Read the CAS entry for every Safeguard in scope, then write down, for each one, the artifact that shows the measure was met. Under a safe harbor statute, that written record is what a court would weigh when deciding whether the written program reasonably conforms to the framework, so the record matters as much as the controls themselves. Confirm with counsel which version of the CAS and which framework revision your state's statute names, because Iowa and Connecticut both tie conformance to published revisions.
The core evidence set is predictable. Keep the written policies and procedures that the Safeguards call for, dated and approved by an accountable owner. Keep the asset and software inventories, with the export or extract that proves they were produced on a stated date. Keep configuration baselines and hardening records for enterprise assets, access review results showing who was granted, changed and removed access and when, and log samples that show collection, retention and review. Each item should carry a date, an owner and a version so an examiner can see the program operating over time rather than existing once on paper. Illustratively, an access review that records a reviewer, the population reviewed, the exceptions and the closure date will answer more questions than a policy that says reviews happen quarterly.
CIS offers a free self-assessment tool, CSAT, that lets an organization record its implementation status against each Safeguard and keep the results. It is useful for building the evidence index and for showing progress, but a CSAT result is the organization's own statement, not an independent finding. No organization can be certified against the CIS Controls, and CIS's own materials say the Controls do not replace any regulatory or compliance scheme. Where a customer or court expects independent assurance, ask a qualified third-party assessor to test specific Safeguards and issue its own report. DeployOpen can prepare systems, configuration records, inventories and logs for that testing, but only the independent assessor issues the findings.
Who owns the program, who prepares evidence, and who attests
A safe harbor defense depends on a written cybersecurity program that the organization itself creates, maintains and follows. Four parties touch that program, and each one carries a different responsibility, so the roles should be settled in writing before any work starts.
The organization owns the program
The covered entity owns its controls, its written cybersecurity program and the decisions that follow from its risk assessment. Iowa's statute requires the entity to create, maintain and comply with that program, so the organization cannot hand this duty to a vendor. Before engaging anyone, check that named internal owners sign off on the scope, the Safeguards in scope and the risk acceptance decisions. A partner can draft material, but the organization must adopt it and run it.
Counsel decides how the statute applies
Whether a program qualifies for a safe harbor defense, how the statute applies to a particular breach and whether a claim can succeed are legal questions for counsel. Ask counsel to confirm which state laws apply to your data and operations, which framework version the program should reflect and how the one-year Iowa update window or the six-month Connecticut window affects your calendar. Technical teams should not present a conformity position to a court or regulator without that review.
The implementation partner prepares evidence
An implementation partner such as DeployOpen prepares systems, configurations, documentation and evidence for the CIS Controls Safeguards in a written, fixed scope. Typical work includes hardening builds, setting up logging and access controls, and collecting the records an assessor would request. The partner does not decide whether the program conforms, and it does not own the risk decisions. Confirm in the statement of work which deliverables are handed over and who keeps the evidence after the engagement ends.
Independent assessors attest
Only an independent assessor, auditor or certification body issues a report or attestation. DeployOpen does not issue reports, attestations or certificates against the CIS Controls. No organization can be certified against the CIS Controls, so a claim of conformance should describe the self-assessment method used and the evidence behind it. If a customer or regulator asks for independent assurance, ask the assessor to state its scope, method and independence in writing.
Questions buyers ask about safe harbor and the CIS Controls
Do I need to meet every CIS Safeguard to claim safe harbor?
Not necessarily, but you must run a written cybersecurity program that reasonably conforms to a recognized framework, and you must be able to defend that judgment. Iowa's law requires written administrative, technical, operational and physical safeguards that reasonably conform to an industry-recognized framework, and it lists the CIS Critical Security Controls among qualifying frameworks. Nothing in the supplied statute text requires a checklist of all 153 Safeguards. The scale of your program is tied to your maximum probable loss, so the Safeguards you prioritize should follow your real data exposure. Document why any Safeguard is not applicable or is handled another way. Connecticut's safe harbor also depends on a written program that conforms to recognized frameworks. Ask your counsel how courts in each relevant state read the phrase "reasonably conforms" before you rely on it.
Which CIS Implementation Group should I target first?
Start with IG1, then move up based on your data sensitivity and threat exposure. CIS defines IG1 as essential cyber hygiene and a minimum standard for every enterprise, with 56 Safeguards. IG2 adds 74 Safeguards for enterprises with more operational complexity that often hold sensitive information, and IG3 adds the remaining 23 for enterprises with security specialists and regulated, sensitive assets. IG1 alone is unlikely to satisfy a court that expects continual threat evaluation and annual maximum probable loss analysis, as Iowa's law requires. An organization that holds personal or restricted information will usually need to show IG2 coverage at minimum. Use your risk assessment to set the target, and record the reasons for the group you chose.
Can my own team do the CIS Controls work without outside help?
Yes, many teams do the work internally, but the harder question is whether your evidence will hold up to an assessor, a customer or a court. Ownership stays with your organization: you set the policies, make the risk decisions and sign off the program. Outside help is usually about preparing systems, configuring logging and access controls, writing procedures and organizing evidence. Your effort depends on the number of systems in scope, how accurate your asset inventory is today and how much internal staff time you can commit. Whoever you hire should give you a written, fixed scope that names the Safeguards covered, the deliverables and the dates. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure and prepares evidence, but it does not issue reports or certificates.
How long does it take to conform to the CIS Controls?
No duration has been established for this, so the answer depends on your starting point. The main drivers are how accurate your asset and software inventories are, how many Safeguards fall in your target Implementation Group, whether written policies already exist, and how much change your systems need. A timeline should come from a written assessment of your environment, not from a generic estimate. The timing rules matter more for planning ongoing compliance. Iowa requires a covered entity to reasonably conform its program to a final revision of a listed framework no later than one year after the revision is published. Connecticut's law, as CIS reported it, requires conformance within six months. CIS published v8.1 on 24 June 2024. Confirm both deadlines with counsel and plan your change cycle around them.
Is there a CIS Controls certification my organization can get?
No. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme, and no organization can be certified against them. What does exist includes CIS Controls Accreditation, run with CREST, which accredits CIS SecureSuite member organizations that provide implementation, auditing or assessment services. CIS lists an application fee of $1,500 for CREST members and $2,500 for non-members. Other options are individual courses and self-assessment using CIS's CSAT tool and the Assessment Specification. Be cautious with any vendor that offers a CIS certificate for your organization. Accreditation applies to the service provider, not to your systems, and a self-assessment is not an independent certification.
How do I show CIS Controls conformance to a customer or a court?
Show a written program, a current inventory and evidence for each in-scope Safeguard, then have it reviewed independently. Customers typically ask for a questionnaire and an evidence pack, while a court looks at whether the written program existed, was maintained and was followed. Build your evidence around the measures in the CIS Controls Assessment Specification, which defines what to measure for each Safeguard. Keep dated records of risk decisions, exceptions and remediation. Use the CSAT self-assessment as the structure for your answers, and consider a qualified independent assessor for a formal review. Iowa's law also requires that you communicate risks to affected parties after a known breach, so keep your notification procedures in the program as well. Ask counsel what documentation your state expects.
How DeployOpen prepares the evidence your program needs
DeployOpen works inside your own cloud accounts, data centers or air-gapped networks to prepare the systems, written program and evidence that a safe harbor defense depends on. We do not issue reports or certifications; the conformance judgment stays with your legal counsel and, where you commission one, an independent assessor.
How we scope
- We agree a written scope that names the in-scope systems, business units and data covered by your cybersecurity program.
- Scope documents which CIS Controls Safeguards and Implementation Group you target, and which state statutes your counsel has asked us to address.
- Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts.
How we build
- We implement and harden self-hosted open-source platforms that produce logs, inventories, access records and configuration evidence for in-scope Safeguards.
- We draft the written program documents, mapping each policy and procedure to the Safeguards it supports and the assessment specification measures.
- We run security testing against the in-scope systems and record findings, remediation status and validation results as dated evidence.
How we hand over
- You receive the documented program, configuration baselines, evidence index and runbooks, with ownership assigned to named roles in your organization.
- We walk your staff through how each artifact is produced, refreshed and retained, so the program can run without us.
- Your counsel and any independent assessor receive a clear record of what was built, when and by whom, for their own review.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, which can keep the program current after a framework revision.
- Retainers can track when a listed framework publishes a new revision and plan the conformance update inside the statutory window your counsel confirms.
- Confirm with your counsel the exact revision deadlines, program documentation requirements and the scope of any defense before relying on them.
Sources and further reading
- Iowa Code chapter 554G, Tort liability: cybersecurity programs ↗
- Connecticut becomes third state to incentivize cybersecurity best practices for businesses ↗
- CIS releases CIS Controls v8.1 with new governance recommendations ↗
- CIS Critical Security Controls Version 8.1 ↗
- CIS Critical Security Controls FAQ ↗
- CIS Controls Assessment Specification: Terms of Use ↗
