The Phone Call Every Contractor Dreads
At 2:15 PM on a Wednesday, the controller at a 60-person Las Vegas mechanical contractor noticed something wrong. The company's bank called to verify a $94,000 wire transfer to an account they'd never seen before. The controller hadn't authorized it. Within an hour, the IT consultant confirmed what everyone feared: the company's email system had been compromised for at least two weeks.
The attackers hadn't just redirected one payment. They'd been reading every email — including employee W-2 data sent to the company's accountant, subcontractor bank information, and client project budgets. Personal information for 340 individuals was potentially exposed.
Now what? Under Nevada's NRS 603A, this contractor had specific legal obligations that started immediately. The clock was ticking.
Understanding NRS 603A: Nevada's Breach Notification Framework
Nevada Revised Statutes Chapter 603A governs the collection, storage, and protection of personal information by businesses operating in Nevada. For contractors, the key provisions are:
What Qualifies as "Personal Information" Under NRS 603A?
NRS 603A defines personal information as a first name or initial combined with a last name, plus any of the following:
- Social Security number
- Driver's license or state ID number
- Account number, credit card, or debit card number with security code, access code, or PIN
- Medical identification number or health insurance number
- Username or email address with password or security question/answer
For contractors, the most common personal information includes:
- Employee records: SSNs (W-4/W-9), driver's licenses (I-9 verification), bank account numbers (direct deposit)
- Subcontractor data: EINs, bank routing information, owner personal guarantees on subcontracts
- Client information: Personal data on residential project owners, financial information on commercial clients
When Is Notification Required?
Notification is required when you discover or are notified of a "breach of the security of the system data" — meaning unauthorized acquisition of computerized personal information that compromises the security, confidentiality, or integrity of the data.
Exceptions:
- Good-faith acquisition by an employee or agent (if used for a lawful purpose)
- Encrypted data where the encryption key was not compromised
- Data that is reasonably determined not to have been used for unauthorized purposes
Notification Timeline
NRS 603A.220 requires notification "in the most expedient time possible and without unreasonable delay." Nevada doesn't specify an exact number of days (unlike some states with 30-day or 60-day deadlines). In practice:
- Investigation should begin immediately upon discovery
- Notification should occur as soon as the scope is reasonably determined and the system's integrity is restored
- Delay is permitted when law enforcement determines notification would impede a criminal investigation
Who Gets Notified?
- Affected individuals — Every Nevada resident whose personal information was or is reasonably believed to have been acquired by an unauthorized person
- Consumer reporting agencies — If more than 1,000 persons must be notified at one time
Nevada's breach statute does not require a separate notice to the Attorney General, though the AG can enforce NRS 603A.
Step-by-Step Breach Response for Nevada Contractors
Hour 0-4: Discovery and Containment
- Isolate affected systems — Disconnect compromised machines from the network, but do NOT power them off (forensic evidence is lost)
- Activate your cyber insurance — Call the carrier's incident response hotline immediately. Early notification is often a policy condition
- Preserve evidence — Do not attempt to "clean up" or investigate on your own. Wait for the forensic team
- Notify your attorney — Engage breach counsel familiar with NRS 603A (your cyber carrier typically provides this)
Day 1-3: Forensic Investigation Begins
The forensic team will:
- Determine the attack vector (how they got in)
- Assess the scope of compromised data
- Identify what personal information was accessed or exfiltrated
- Contain the breach and prevent further access
- Preserve evidence for potential law enforcement involvement
Day 3-14: Scope Assessment
Once forensics determines what data was compromised:
- Catalog affected individuals — Name, type of data exposed, current contact information
- Assess notification obligations — Does the compromised data meet NRS 603A's definition of personal information?
- Evaluate the encryption defense — Was the data encrypted? Was the encryption key also compromised?
- Consider law enforcement involvement — FBI Cyber Division (Las Vegas field office) and/or local law enforcement
Day 14-30: Notification Preparation
Working with breach counsel:
- Draft notification letters compliant with NRS 603A requirements
- Establish a call center for affected individuals' questions
- Arrange credit monitoring services (typically 12-24 months)
- Prepare consumer reporting agency notices if more than 1,000 persons will be notified
- Draft media statement if the breach is likely to attract attention
Day 30-45: Notification Delivery
- Mail notifications to all affected individuals
- Notify consumer reporting agencies if more than 1,000 persons are being notified
- Activate call center and credit monitoring enrollment
NRS 603A.215: PCI DSS, Encryption, and Liability Protection
NRS 603A.215 is the part of Nevada's law that rewards good security. Here's how it works:
What It Requires
- PCI DSS — If you accept payment cards, comply with the current PCI Data Security Standard
- Encryption — Otherwise, encrypt personal information you transmit electronically outside your secure system (other than by fax) and personal information on data storage devices moved beyond your logical or physical controls
What It Provides
A data collector that complies with NRS 603A.215 is not liable for damages for a breach of the security of the system data, unless the breach was caused by the gross negligence or intentional misconduct of the collector, its officers, employees, or agents.
Separately, NRS 603A.210 requires every business that maintains personal information of Nevada residents to implement and maintain reasonable security measures.
For Contractors Specifically
A practical security program for a Las Vegas contractor — covering the encryption rule and reasonable security more broadly — includes:
| Control | Implementation | Evidence |
|---|---|---|
| MFA | Email, VPN, financial systems | Configuration screenshots, policy document |
| Encryption | Data at rest and in transit | Encryption certificates, configuration records |
| EDR/Antivirus | All endpoints | Deployment reports, alert logs |
| Backup & Recovery | Regular backups, tested quarterly | Backup logs, recovery test results |
| Access Controls | Least privilege, terminated employee procedures | Access review logs, offboarding checklists |
| Training | Annual security awareness, phishing simulations | Training records, simulation results |
| Incident Response Plan | Written plan, tested annually | Plan document, tabletop exercise records |
| Vendor Management | Security requirements in subcontracts | Contract templates, vendor assessments |
The Insurance Connection
Buying cyber insurance does not make you compliant with NRS 603A. But cyber underwriters look for the same controls, and contractors who can document them generally see:
- More favorable premiums
- Broader coverage terms
- Lower deductibles
- Fewer coverage exclusions
Real Cost of NRS 603A Compliance vs. Non-Compliance
| Scenario | With Strong Controls + Insurance | Without Either |
|---|---|---|
| Breach affecting 200 employees | ~$120,000 (insured) | $350,000+ (uninsured, lawsuit exposure) |
| Ransomware with 10-day outage | ~$280,000 (insured, BI covered) | $600,000+ (ransom + BI + restoration) |
| BEC wire fraud ($150K) | ~$175,000 (insured, funds recovered or covered) | $150,000+ (funds unrecoverable) |
| AG investigation | ~$50,000 (insured defense) | $150,000+ (defense + penalties) |
The annual cost of maintaining these security controls for a typical Las Vegas contractor: $15,000-$40,000 including security tools, training, and compliance documentation. The annual cost of cyber insurance: $3,000-$15,000 for most mid-size contractors. Combined investment: $18,000-$55,000/year to protect against incidents averaging $300,000-$800,000.
Common Mistakes Nevada Contractors Make After a Breach
-
Trying to fix it internally — Your IT person isn't a forensic investigator. Attempting to clean up destroys evidence and may miss the full scope of the breach.
-
Delaying notification — "We'll figure out the full scope first" can stretch notification out for months, which risks violating the "without unreasonable delay" standard.
-
Not activating insurance immediately — Late notice to your cyber carrier can jeopardize coverage. Call the hotline within hours, not days.
-
Forgetting the consumer reporting agencies — If more than 1,000 persons must be notified at one time, NRS 603A.220 also requires notifying consumer reporting agencies without unreasonable delay.
-
Ignoring NRS 603A.215 — After a breach, make sure you meet PCI DSS (if you take cards) and encrypt data in transit and on portable devices. Compliance brings liability protection for future incidents, and carriers will look favorably on your proactive response.