§5A-6B-3. Powers and duties of Chief Information Security Officer; staff; rule-making.

(a) The West Virginia Cybersecurity Office is under the supervision and control of a Chief Information Security Officer appointed by the Chief Information Officer and shall be staffed appropriately by the Office of Technology to implement the provisions of this article.

(b) The Chief Information Security Officer may:

(1) Develop policies, procedures, and standards necessary to establish an enterprise cybersecurity program that recognizes the interdependent relationship and complexity of technology in government operations and the nature of shared risk of cyber threats to the state;

(2) Create a cyber risk management service designed to ensure that officials at all levels understand their responsibilities for managing their agencies "cyber risk";

(3) Designate a cyber risk standard based on federal and industry best practices and accepted principles for the cybersecurity framework;

(4) Establish the cyber risk assessment requirements such as assessment type, scope, frequency, and reporting;

(5) Provide agencies cyber risk guidance for information technology projects, including the recommendation of security controls and remediation plans;

(6) Assist agencies in the development of plans and procedures to manage, assist, and recover in the event of a cyber incident;

(7) Assist agencies in the management of the framework relating to information custody, classification, accountability, and protection;

(8) Ensure a minimum standard for uniformity and adequacy of the cyber risk assessments;

(9) Notwithstanding the provisions of §5A-6B-1(b) of this code, enter into fee-based agreements with state government entities exempted from the application of this article or other political subdivisions of the state that desire to voluntarily participate in the cybersecurity program administered pursuant to this article;

(10) Develop policy outlining use of the privacy impact assessment as it relates to safeguarding of data and its relationship with technology;

(11) Establish minimal training requirements for users of state networks, systems, or devices.

(12) Perform such other functions and duties as provided by law or directed by the Chief Information Officer.

(c) The Chief Information Security Officer, along with the Chief Information Officer, shall ensure that any state contract for licensing software applications, which are designed to run on generally available desktop or server hardware, shall not limit the state’s ability to install or run the software on the hardware of the state’s choosing.

(d) The Secretary of the Department of Administration shall propose rules for legislative approval in accordance with §29A-3-1 et seq. of this code to implement and enforce the provisions of this article.