IL SB3204

Creates the Consumer Credit Reporting Agency Registration and Cybersecurity Program Act requiring consumer credit reporting agencies operating in Illinois to register with the Department of Financial and Professional Regulation.

Mandates agencies implement written cybersecurity programs by January 1, 2019 designed to protect confidentiality, integrity, and availability of information systems, including requirements for risk assessments, penetration testing, vulnerability assessments, and encryption.

Requires agencies to designate a Chief Information Security Officer to oversee cybersecurity compliance and report annually to the board of directors on cybersecurity risks and program effectiveness.

Establishes grounds for registration refusal, suspension, or revocation including violations of financial services laws, fraud, cybersecurity non-compliance, and felony convictions.

Mandates agencies notify the Department within 72 hours of cybersecurity events affecting normal operations or requiring notice to other supervisory bodies, and submit annual compliance certifications by February 15th.