Oregon legislation · 2026 Legislative Measures
Oregon HB4055: Relating to information security; declaring an emergency.
Status: Failed, March 6, 2026
Digest: Tells a local public body to give a report to the state when there is an information security incident. Prescribes what must be in the report. (Flesch Readability Score: 63.4). Requires a local government, local service district or special government body to notify and submit a report to the State Chief Information Officer within 48 hours of an information security incident or ransomware incident. Prescribes the information that a public body is required to report. Directs the State Chief Information Officer to establish a reporting system that allows a public body to submit a notification or report in a timely, secure and confidential manner. Directs the State Chief Information Officer to create a webpage to provide instructions on how to provide notification and submit a report. Requires the State Chief Information Officer to provide an annual report to the Governor and the Joint Legislative Committee on Information Management and Technology on the information security incidents and ransomware incidents reported for the preceding year. Exempts information security incident or ransomware incident reports from disclosure under public records laws and allows for the sharing of information under certain circumstances. Becomes operative July 1, 2026. Declares an emergency, effective on passage.
What the bill says
A bill FOR AN ACT Relating to information security; and declaring an emergency.
From the introduced text, January 28, 2026:
A BILL FOR AN ACT Relating to information security; and declaring an emergency. Be It Enacted by the People of the State of Oregon: SECTION 1. (1) As used in this section: (a) "Information security incident" means a substantial incident that leads to one or more of the following impacts: (A) Substantial loss of confidentiality, integrity or availability of a public body's information system. (B) Compromise in the safety and resilience of a public body's operational systems and processes. (C) Disruption of a public body's ability to engage in business, carry on operations or deliver services. (D) Unauthorized access to a public body's information system or nonpublic information, when the impact is caused by a compromise of a third-party information service or data hosting provider. (b) "Information system" means a system of computers and related hardware, software, storage media and networks and any other means by which a public body collects, uses or manages the public body's information resources. (c) "Public body" means: (A) A local government, as defined in ORS 174.116. (B) A local service district, as defined in ORS 174.116. (C) A special government body, as defined in ORS 174.117. matter [italic and bracketed] is existing law to be omitted. New sections are in boldfaced type. LC HB 4055 (d) "Ransomware incident" means an information security incident in …
Sponsors
- Nancy Nathanson (D, 13) · primary sponsor
Latest actions
- : In committee upon adjournment.
- : Public Hearing held.
- : Referred to Information Management and Technology with subsequent referral to Ways and Means.
- : First reading. Referred to Speaker's desk.
Common questions
- What is HB4055?
- HB4055 is a bill in the Oregon Legislature (2026 Legislative Measures): Relating to information security; declaring an emergency.
- What does HB4055 do?
- In its own words: A bill FOR AN ACT Relating to information security; and declaring an emergency.
- What is the status of HB4055?
- Failed as of March 6, 2026. Latest action: In committee upon adjournment. (March 6, 2026).
- Who sponsored HB4055?
- Nancy Nathanson (D, 13).
- Where is the official record for HB4055?
- On the Oregon Legislature website: https://olis.oregonlegislature.gov/liz/2026R1/Measures/Overview/4055
Source: official Oregon record. Tracked by Delilah, AI for legislation across all 50 states and Congress.