Creates affirmative defense for certain breaches of security.

This bill creates an "affirmative defense" for businesses and government entities (called "covered entities") that experience security breaches involving personal or restricted information. To qualify for this defense, covered entities must maintain a written cybersecurity program with administrative, technical, and physical safeguards that reasonably conforms to industry standards like NIST or PCI DSS. The program's requirements must be scaled based on factors including the entity's size, the sensitivity of information, and available resources. The Director of Consumer Affairs can determine if a cybersecurity program meets the standard, and courts will consider this determination when evaluating breach claims. The bill does not create new legal claims for individuals affected by security breaches.