The Ransomware Payment Ban Patchwork: What Security Leaders Need to Know as More States Restrict Payments

As of this writing, only two states have passed laws that flatly prohibit public-sector entities from paying a ransomware demand: North Carolina and Florida. Both bans are narrower than the framing they often get in trade press coverage, which is exactly why the details matter for anyone drafting a playbook.

North Carolina moved first. Its 2021 Current Operations Appropriations Act added a new article to Chapter 143 of the state's General Statutes (N.C.G.S. § 143-800), prohibiting state agencies and local government entities from paying a ransom demand and, notably, from communicating with the entity that carried out the attack. That second piece, the communication restriction, is the detail practitioners most often miss. It is stricter than every other state law that followed it.

Florida's version came a year later. Florida Statute 282.3185, part of the Local Government Cybersecurity Act enacted through HB 7055 in 2022, prohibits a state agency, county, or municipality from paying or otherwise complying with a ransom demand. Unlike North Carolina, Florida's law does not appear to prohibit communicating with a threat actor to gather intelligence about the scope of an attack or negotiate for time, and it carries a mandatory reporting obligation: covered entities must report a ransomware incident, including details of the ransom demanded, to the state's Cybersecurity Operations Center, the Cybercrime Office of the Florida Department of Law Enforcement, and the sheriff with jurisdiction, within 12 hours of discovery.

The harder part of tracking this landscape is separating enacted law from the recurring wave of proposed bills that get media coverage every legislative session. Multiple states have introduced payment-ban legislation modeled on North Carolina's or Florida's approach, and as of this writing none of the following had been signed into law: Pennsylvania's SB 726 would bar the use of state and local public funds to pay a ransom, with a carve-out if the governor has declared a disaster emergency and authorizes payment in connection with it, and would separately require IT managed service providers serving state agencies to notify those agencies within one hour of discovering a ransomware incident. New York's S 6806 is broader in scope than either enacted law, proposing to prohibit not just governmental entities but business entities and healthcare entities from paying a ransom, alongside new incident-reporting obligations to the New York State Division of Homeland Security and Emergency Services. Texas HB 3892 would similarly restrict the use of state and local public funds for ransom payments.

Bills with a similar structure have also surfaced in Arizona and New Jersey in past sessions. The pattern across states considering this legislation is consistent: public-fund restrictions first, private-sector restrictions rarely, and reporting requirements attached more often than payment bans themselves. Treat any headline claiming a new state has banned ransom payments with a healthy dose of verification against the state's actual statute text and effective date before updating an incident response plan.

The practical trend that matters more than the ban count is how fast rapid-disclosure obligations are spreading independent of whether a payment ban exists. Florida's 12-hour reporting window to multiple state authorities, including a requirement to disclose the ransom amount demanded, is a meaningfully tighter clock than most organizations' existing breach notification procedures are built around. Proposed bills in other states follow the same shape: Pennsylvania's SB 726 would impose a one-hour MSP notification requirement to the client agency, and New York's S 6806 pairs its proposed payment ban with new state-level cyber incident reporting duties. Public-sector organizations and the managed service providers and incident response retainers that support them should assume that reporting-clock compliance, not payment-ban compliance, is the more immediate operational gap in most current incident response plans.

A jurisdiction-blind incident response plan is now a liability for any organization that touches state or local government work, whether directly as an agency or indirectly as a vendor, MSP, or contractor. The practical fix is to build jurisdiction awareness into the plan before an incident, not during one.

Payment bans intersect with cyber insurance in ways that are easy to miss when a policy was underwritten before the applicable statute existed or before the insured expanded into a newly covered jurisdiction. A policy that contemplates ransom reimbursement as a covered loss does not override a state law that makes the payment itself illegal for that insured; coverage for an illegal payment is not something an insurer can lawfully indemnify. That makes the payment-ban question a coverage-scoping conversation, not just an operational one: renewal reviews for public-sector-adjacent policyholders should explicitly confirm how the policy treats jurisdictions where payment is prohibited, what remains covered (forensics, notification costs, legal fees, business interruption) when the ransom line item is unavailable, and whether the insurer's own incident response panel and negotiation vendor are briefed on the no-communication restriction in states like North Carolina. Our related coverage on how the broader cyber insurance market is shifting as claims volume changes, and on the identity and MFA control requirements insurers are increasingly attaching to underwriting, are both useful companion reads when this jurisdiction question comes up during a renewal cycle.

The patchwork will keep changing one legislative session at a time, which means the checklist below is a process to repeat, not a one-time audit.