Your documents name your state. Not a placeholder.

Every US state has its own data-breach notification duty. The intake asks which one you’re in, and your incident response plan and security program name it as the baseline — see what that actually looks like for yours.