Cybersecurity for Las Vegas businesses that hold client data

What Nevada law actually asks of a business

Nevada's data-security law is NRS Chapter 603A. Here is what it says, in plain terms. Read the statute itself for anything you're relying on.

What counts as "personal information" (NRS 603A.040). A person's first name or first initial and last name, together with any of these, when the data is not encrypted:

• Social Security number
• Driver's license, driver authorization card, or ID card number
• Account, credit or debit card number, along with any code or password that would allow access to the financial account
• Medical ID or health insurance ID number
• A username or email address together with a password or security question and answer that would allow access to an online account

It does not include the last four digits of an SSN or license number, or information lawfully available from public government records.

If your office keeps client tax files, intake forms, payroll, or insurance details, you almost certainly hold this kind of data.

The duty to protect it (NRS 603A.210). A business that keeps records containing a Nevada resident's personal information must "implement and maintain reasonable security measures" to protect them from unauthorized access, acquisition, destruction, use, modification or disclosure. If you share that data with a vendor under contract, the contract must require the vendor to do the same. The statute doesn't list specific tools for private businesses. (It points government agencies to the CIS Controls.) "Reasonable" is judged by the facts.

Encryption (NRS 603A.215). If you accept payment cards, you must comply with the current PCI Data Security Standard for those transactions. If you don't accept cards, you may not send personal information electronically outside your secure system (other than by true fax), and you may not move a storage device holding it outside your control, unless it's encrypted. A business that complies with this section is not liable for damages from a breach, unless the breach came from gross negligence or intentional misconduct.

Breach notice (NRS 603A.220). If unencrypted personal information of a Nevada resident was, or is reasonably believed to have been, taken by an unauthorized person, the business that owns or licenses it must notify those residents "in the most expedient time possible and without unreasonable delay." Law enforcement can ask for a delay. If you hold data for someone else, you must tell the owner immediately. If more than 1,000 people need notice at one time, the nationwide credit reporting agencies must be told too.

Violations can be treated as a deceptive trade practice (NRS 603A.260), and the Attorney General or a district attorney can seek an injunction (NRS 603A.290).

This is a summary for general information, not legal advice. Talk with your attorney about how NRS 603A applies to your business.

What "reasonable security" looks like on a real network

The law doesn't hand you a checklist, so here's what we put in place and can document when an insurer, a client, or your attorney asks:

• MFA on every account that touches client data: email, Microsoft 365, the client portal, remote access, and accounting platforms.
• 24/7 threat detection with human review. Unusual sign-ins, remote-access tools showing up on a workstation, or mass file changes get looked at by a person within minutes, any hour of the day.
• Encryption on laptops and phones, and encrypted email for sending tax documents, IDs, and account numbers. That's the 603A.215 piece.
• Backups that ransomware can't delete, with restore tests written down.
• Vendor contracts that require security, the 603A.210(3) piece. We'll help you list the vendors who hold client data.
• A written incident plan that covers who decides, who calls counsel, and how notice timing is handled, so nobody makes it up during a breach.
• Phishing training built around the fake invoices, IRS notices, and wire-change requests local offices actually receive.

For the full service list, see Cybersecurity services. For profession-specific duties, see law firms (ABA 1.1 and 1.6) and CPA practices (Pub 4557 / WISP).

Proof we already publish

5.0★ Google rating · under 15 minutes average response · 99.9% uptime maintained · 24/7 threat detection.