Requires businesses in financial, essential infrastructure, and health care industries to report cybersecurity incidents.

This bill requires businesses in New Jersey's financial, essential infrastructure, and healthcare sectors (defined as "sensitive businesses") to report specific cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) promptly. It mandates reporting for incidents compromising billing, communications, data management, or industrial control systems that affect confidentiality, integrity, or availability. Within 30 days of receiving a report, the NJCCIC must order an independent cybersecurity audit of the business at the business's expense, identifying vulnerabilities and requiring corrective action plans. The audit findings and plans must then be submitted to the NJCCIC. The law takes effect 90 days after enactment.