NH HB1728

Establishes a statutory "standard of care" requiring operators of critical infrastructure technology systems serving more than 10,000 people or 3,300 households in New Hampshire to secure systems against foreseeable cybersecurity risks

Covered critical infrastructure includes drinking water systems, wastewater systems, electric power generation and distribution, natural gas systems, communications systems, emergency response systems, and public transportation systems

Operators must implement specific security measures including firewall protections, phishing-resistant multi-factor authentication for remote access, ability to terminate remote access sessions, regular patching of security systems, and cybersecurity incident response plans

Operators failing to exercise reasonable care face liability for harms caused by security failures, with courts considering the magnitude of risk to public health and safety, burden of precautions, and foreseeability of the hazard

Takes effect January 1, 2027, with municipalities potentially facing implementation costs ranging from $100,000 to $500,000 for necessary technology upgrades