Existing Legal Frameworks Governing Civilian Cyber Corps

For C3s in the United States and abroad, the existing legal frameworks generally include: (1) a statute; (2) contracts or MOUs between the state and beneficiaries and between the state and volunteers; and (3) rules and guidance for programs. The contractual component has been written about elsewhere,¹ so this report focuses on the statutes governing C3s. Of the five existing state C3s, all but Wisconsin have governing statutes—laws enacted for the specific purpose of governing the activities of the C3.

Enacting legislation specific to C3s helps lay the foundation for their success by establishing clear rules of the road and legal protections for all stakeholders involved. Without a specific statute, key legal issues like roles and responsibilities, liability, and confidentiality will be governed by existing state and federal laws, which could limit C3s’ activities or result in unintended outcomes. As a result, states like Oklahoma, Indiana, and Virginia, who are actively considering C3s, continue to carefully consider the gaps in existing laws that may not adequately support the effective use of volunteer cybersecurity professionals. Key issues addressed in existing C3 statutes fall into three broad issue categories, with sub-issues under each, as described in Table 1 below.