West Virginia HB5638: Relating to the requirements of the state’s cyber security program and responsibilities and authority of the state chief information security officer

What the bill says

An act to amend and reenact §5A-6B-1, §5A-6B-2, §5A-6B-3, §5A-6B-4, §5A-6B-5, and §5A-6B-6 of the Code of West Virginia, 1931, as amended, relating to the requirements of the states cyber security program and responsibilities and authority of the state Chief Information Security Officer. ARTICLE 6B. CYBER SECURITY PROGRAM. §5A-6B-1. West Virginia Cybersecurity Office; scope; exemptions. (a) There is hereby created the West Virginia Cybersecurity Office within the Office of Technology, to be led by the West Virginia Chief Information Security Officer. The office may set standards for cybersecur.

From the enrolled text, March 14, 2026:

AN ACT to amend and reenact §5A-6B-1, §5A-6B-2, §5A-6B-3, §5A-6B-4, §5A-6B-5, and §5A-6B-6 of the Code of West Virginia, 1931, as amended, relating to the requirements of the states cyber security program and responsibilities and authority of the state Chief Information Security Officer. ARTICLE 6B. CYBER SECURITY PROGRAM. §5A-6B-1. West Virginia Cybersecurity Office; scope; exemptions. (a) There is hereby created the West Virginia Cybersecurity Office within the Office of Technology, to be led by the West Virginia Chief Information Security Officer. The office may set standards for cybersecurity and is charged with managing the cybersecurity framework. (b) The provisions of this article are applicable to all state agencies, excluding higher education institutions, the State Police, state constitutional officers identified in §6-7-2 of this code, the Legislature, and the Judiciary. §5A-6B-2. Definitions. As used in this article: "Cybersecurity framework" means computer technology security guidance for organizations to assess and improve their ability to prevent, detect, and respond to cyber incidents. "Cyber incident" means any event that threatens the security, confidentiality, integrity, or availability of information assets, information systems, or the networks that deliver the information. "Cybersecurity program review" means the process of identifying, analyzing and evaluating risk, and applying the appropriate security controls relevant to the information custodian. "Cyber risk management service" means technologies, practices, and policies that address threats and …