The new rules include having written policies and procedures, hiring a designated chief information security officer, and reporting hacking attempts to the state within 72 hours.  The state rules are first-in-nation and are widely expected to become a model for other states.