There has been a recent trend of legislatures considering or passing laws that incentivize companies to voluntarily take cybersecurity measures to prevent cyberattacks. Specifically, a number of states have proposed safe harbors or affirmative defenses that shield companies from some types of liability when they maintain a cybersecurity program that meets certain prescribed standards. The authors of this article discuss safe harbors adopted in Ohio, Utah, and Connecticut and similar bills that have been proposed in other states.