Iowa Code Title XIII. Commerce [Chs. 505-554D] § 554G.2. Affirmative defenses

a. Continually evaluate and mitigate any reasonably anticipated internal or external threats or hazards that could lead to a data breach.

b. Periodically evaluate no less than annually the maximum probable loss attainable from a data breach.

c. Communicate to any affected parties the extent of any risk posed and any actions the affected parties could take to reduce any damages if a data breach is known to have occurred.

4. a. A covered entity that satisfies all requirements of this section is entitled to an affirmative defense to any cause of action sounding in tort that is brought under the laws of this state or in the courts of this state and that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information.

b. A covered entity satisfies all requirements of this section if its cybersecurity program reasonably conforms to an industry-recognized cybersecurity framework, as described in section 554G.3.