HB1728

Chair Vose, Vice Chair Thomas and Honorable Members of the New Hampshire House Science, Technology and Energy Committee: On behalf of the Secure Resilient Future Foundation (SRFF), I am writing to express our strong support for HB 1728-FN, An Act requiring sufficient cybersecurity protections for critical infrastructure and technology projects. We commend the bill’s bi-partisan sponsors for advancing thoughtful, practical legislation that recognizes cybersecurity as a core public safety and resilience issue for the State of New Hampshire. SRFF is a nonpartisan, nonprofit organization of cybersecurity experts, technologists, and public-interest advocates working to advance the security, resilience, and sustainability of technology systems that underpin modern life. Our mission is to promote policies and practices that ensure technology products and infrastructure are secure by design, maintainable over time, and resilient in the face of foreseeable failures and cyber threats. We focus particularly on systems whose failure could endanger public health, safety, economic stability, or community continuity. As written, HB 1728-FN appropriately establishes a clear statutory standard of care for operators of critical infrastructure operational technology systems serving large populations. From our work across sectors including water, energy, healthcare, and emergency services, SRFF has repeatedly observed that preventable cybersecurity failures in operational technology environments create foreseeable risks not only to system operators, but to entire communities. That includes cybercriminal and nation-backed attacks that have compromised and disrupted critical infrastructure including medical facilities, pipelines, elements of the electric grid, water treatment facilities and more. In other words, these risks are not hypothetical - they exist and are exacerbated by insecure remote access, inadequate network segmentation, unsupported or poorly maintained systems, and the absence of incident response and recovery planning—precisely the hazards HB 1728-FN addresses. We strongly support the bill’s emphasis on reasonable care rather than prescriptive or one-size-fits-all mandates. By grounding responsibility in well-established principles of foreseeability, proportionality, and risk to public welfare, HB 1728-FN provides operators with flexibility while making clear that basic cybersecurity hygiene is not optional when essential services are at stake. This approach aligns with long-standing norms in public safety, engineering, and professional liability, and reflects current best practices in cybersecurity risk management. Importantly, this legislation also acknowledges a critical reality: operational technology systems are increasingly exposed to cyber threats that can have real-world, physical consequences. As cyber incidents targeting water systems, energy infrastructure, and other essential services continue to rise nationwide, states like New Hampshire have an obligation to ensure that reasonable safeguards are in place to protect residents from avoidable harm. For these reasons, the Secure Resilient Future Foundation urges the Committee to support HB 1728-FN and advance it favorably through the legislative process. We believe this bill represents a measured, responsible step toward strengthening New Hampshire’s resilience in the face of evolving cyber and operational risks. Thank you for your consideration and for your leadership on this critical issue. SRFF would be pleased to serve as a resource to the Committee and provide noted cybersecurity experts to answer any questions regarding cybersecurity, operational technology risk, or resilience best practices. Respectfully submitted, Paul F. Roberts President Secure Resilient Future Foundation www.secure-resilient.org