Congress preparing to draft federal breach notification legislation. Lawmakers must decide whether the measure should also include provisions to regulate information security. Advocates for such federal legislation disagree about what should be included in a federal law. One professor says breach notification alone would be substantially less effective at preventing reportable security breach incidents than a combination of breach notification and comprehensive information security regulation. Another professor says the states should retain the authority of regulating information security conduct, acting as a laboratory to identify best ways to regulate conduct.”]
Source: https://www.cuinfosecurity.com/drafting-national-breach-notification-law-a-5922