HB 5638 — Relating to the requirements of the state’s cyber security program and responsibilities and authority of the state chief information security officer

WEST VIRGINIA LEGISLATURE REGULAR SESSION ENGROSSEDENROLLED House Bill 5638 ByBYD DelegateELEGATE LinvilleLINVILLE [By(BYR RequestEQUEST ofOF theTHEDEPARTMENT DepartmentOF ofADMINISTRATION) Administration][Passed [IntroducedMarch February14, 17,2026;2026;

referredin toeffect the90 Committeedays onfrom Energypassage and(June Public12, Works]2026)] EngEnr HB 5638 AAN BILLACT to amend and reenact §5A-6B-1, §5A-6B-2, §5A-6B-3, §5A-6B-4, §5A-6B-5, and §5A-6B-6§5A- 6B-6 of the Code of West Virginia, 1931, as amended, relating to the requirements of the states cyber security program and responsibilities and authority of the state Chief Information Security Officer.

CYBER SECURITY PROGRAMPROGRAM. .

The office has the authority to may set standards for cybersecurity and is charged with managing the cybersecurity framework.

(b) The provisions of this article are applicable to all state agencies, excluding higher education institutions, the State Police, state constitutional officers identified in §6-7-2 of this code, the LegislatureLegislature, and the Judiciary.

"Cyber"Cybersecurity risk assessment Cybersecurity program review" means the process of identifying, analyzing and evaluating riskrisk, and applying the appropriate security controls relevant to the information custodian.

"Cyber risk management service" means technologies, practicespractices, and policies that address threats and vulnerabilities in networks, computers, programs, and data flowing from or enabled by Eng HB 5638 connection to digital infrastructure, information systems, networks, devices, or Enr HB 5638 industrial control systems, including, but not limited to, information security, supply chain assurance, information assistanceassistance, and hardware or software assurance.

"Enterprise" means the collective departments, agenciesagencies, and boards within state government that provide services to citizens and other state entities.

"Information custodian" means a state or local department, agency, or person that has the actual custody of, or is responsible for the accountability for a set of office, board, commission, or other spending unit with custody of, or responsibility for, data assets residing on a state system, device, accountaccount, or network.networks owned, monitored, or maintained by the West Virginia Office of Technology.

Networks"Plan owned,of monitored,action and milestones" means a remedial plan, or maintainedthe byprocess of accepting or resolving risk, which helps the Westinformation Virginiacustodian Officeto ofidentify Technology.and assess information system security and privacy weaknesses, set priorities, and monitor progress toward mitigating the weaknesses.

"Plan of action and milestones" means a remedial plan, or the process of accepting or resolving risk, which helps the information custodian to identify and assess information system security and privacy weaknesses, set priorities and monitor progress toward mitigating the weaknesses.

"User" means an entity or person with access to a state system, device, accountaccount, or network.

Eng HB 5638 (a) The West Virginia Cybersecurity Office is under the supervision and control of a Chief Information Security Officer appointed by the Chief Technology Information Officer and shall be staffed appropriately by the Office of Technology to implement the provisions of this article.

(b) The Chief Information Security Officer has the following powers and duties may:

Enr HB 5638 (1) Develop policies, proceduresprocedures, and standards necessary to establish an enterprise cybersecurity program that recognizes the interdependent relationship and complexity of technology in government operations and the nature of shared risk of cyber threats to the state;

(4) Establish the cyber risk assessment requirements such as assessment type, scope, frequencyfrequency, and reporting;

(6) Assist agencies in the development of plans and procedures to manage, assistassist, and recover in the event of a cyber incident;

(7) Assist agencies in the management of the framework relating to information custody, classification, accountabilityaccountability, and protection;

(9) Notwithstanding the provisions of §5A-6B-1(b) of this code, enter into feefee-based based agreements with state government entities exempted from the application of this article or other political subdivisions of the state that desire to voluntarily participate in the cybersecurity program administered pursuant to this article;

Eng HB 5638 (10) Develop policy outlining use of the privacy impact assessment as it relates to safeguarding of data and its relationship with technology;

and (11) Establish minimal training requirements for users of state networks, systems, or devices.

Enr HB 5638 (12) Perform such other functions and duties as provided by law and as or directed by the Chief Technology Information Officer.

(c) The SecretaryChief ofInformation Security Officer, along with the DepartmentChief ofInformation AdministrationOfficer, shall proposeensure rulesthat any state contract for legislativelicensing approvalsoftware inapplications, accordancewhich withare §29A-3-1designed etto seq.run on generally available desktop or server hardware, shall not limit the state’s ability to install or run the software on the hardware of the state’s choosing.

(d) The Secretary of the Department of Administration shall propose rules for legislative approval in accordance with §29A-3-1 et seq.

Responsibilities of agencies for cybersecurity.

State agencies and other entities (a) Each information custodian receiving centralized support from the West Virginia Office of Technology, or any other entity subject to the provisions of this article, shall:

(6) CompleteParticipate andin submitat aleast cyberone riskannual self-assessmentcybersecurity reportprogram toreview with representatives of the ChiefWest InformationVirginia SecurityOffice Officerof byTechnology Decemberbefore 31,November 2020;30 of each year.

(7)The Managereview awill planprovide the Office of actionTechnology with an analysis and milestonesevaluation basedof oneach theinformation findingscustodian’s ofcybersecurity readiness, ability to keep user data safe, data classifications, and other steps that Enr HB 5638 the cyberinformation custodian has taken towards safeguarding, risk assessmentmanagement, andcybersecurity businessreadiness, needs;or information technology modernization.

and(b) EngIf HBan 5638information (8)custodian Submitfails to participate in the annual reportscybersecurity toprogram review, the ChiefWest SecurityVirginia InformationOffice Officerof noTechnology latermay thanrecover Novemberexpenses 1associated ofwith eachconducting yearany beginningdiagnostics onor Novemberevaluations 1,performed 2023.to assure safety of the network, devices, and systems.

The report shall contain an (6) Participate in at least one annual cybersecurity program review with representatives of the West Virginia Office of Technology before November 30 of each year.

The review will provide the Office of Technology with an analysis and evaluation of each agency or entity’s information custodian’s cybersecurity readiness, ability to keep user data safe, data classifications, and other steps that the agency, or entity information custodian has taken towards safeguarding, risk management, cybersecurity readiness, or information technology modernization.

that are consistent with the objectives of §5A-6-4d and §5A-6-4e of this code (A) If an information custodian fails to participate in the annual cybersecurity program review, the West Virginia Office of Technology may recover expenses associated with conducting any diagnostics or evaluations performed to assure safety of the network, devices, and systems.

Any information, including, but not limited to, cyber risk assessments, cybersecurity program review, plans of action and milestones, remediation plans, or information indicating the cyber threat, vulnerability, information, or data that may identify or expose potential impacts or risk to agencies or to the state or that could threaten the technology infrastructure critical to government operations and or services, public safety, or health is exempt from §29B-1-1 et seq.

The Chief Information Security Officer shall annually, beginning on December 1, 2019, and on December 1 of each year thereafter report to the Joint Committee on Government and Finance and to the Governor on the status of the cybersecurity program, including any recommended Eng HB 5638 statutory changes.

The report shall include a comprehensive summary of each state agency’s report submitted the annual cybersecurity program reviews completed pursuant to §5A-6B-4 of this code regarding the agency’s information custodian’s cybersecurity readiness and the agency’s a list of information technology modernization efforts taken by the West Virginia Office of Technology.

Enr HB 5638 The Clerk of the House of Delegates and the Clerk of the Senate hereby certify that the foregoing bill is correctly enrolled.

...............................................................

Clerk of the House of Delegates ...............................................................

Clerk of the Senate Originated in the House of Delegates.

In effect 90 das from passage.