Law / United States / 
West Virginia
State agencies and information custodians, cybersecurity program duties to the West Virginia Cybersecurity Office
W. Va. Code §§ 5A-6B-1, 5A-6B-4
In force since .
A sector security regimes rule binding government bodies.
- Obligation class
- Security
As of .
What it requires
- This duty binds each information custodian receiving centralized support from the West Virginia Office of Technology and any other entity subject to the article, which is all state agencies except higher education institutions, the State Police, the constitutional officers identified in section 6-7-2 of the code, the Legislature and the Judiciary. It does not bind a private business.
- Undergo a cyber risk assessment as the cybersecurity framework requires or the Chief Information Security Officer directs.
- Adhere to the cybersecurity standard the Chief Information Security Officer establishes for the use of information technology infrastructure, and to enterprise cybersecurity policies and standards.
- Manage cybersecurity policies and procedures where more restricted security controls are appropriate, and submit every cybersecurity policy and standard exception request to the Chief Information Security Officer for approval.
- Participate in at least one annual cybersecurity program review with representatives of the West Virginia Office of Technology before November 30 of each year.
These lines are LexLint's reading of the law's text, as of .
What this law does
The West Virginia Cybersecurity Office is created within the Office of Technology, to be led by the West Virginia Chief Information Security Officer, and may set standards for cybersecurity and is charged with managing the cybersecurity framework. The article applies to all state agencies, excluding higher education institutions, the State Police, state constitutional officers identified in section 6-7-2 of the code, the Legislature, and the Judiciary.
Each information custodian receiving centralized support from the West Virginia Office of Technology, or any other entity subject to the article, must undergo an appropriate cyber risk assessment as required by the cybersecurity framework or as directed by the Chief Information Security Officer.
The information custodian must adhere to the cybersecurity standard established by the Chief Information Security Officer in the use of information technology infrastructure and to enterprise cybersecurity policies and standards. The information custodian must participate in at least one annual cybersecurity program review with representatives of the West Virginia Office of Technology before November 30 of each year.
An information custodian is a state or local department, agency, office, board, commission, or other spending unit with custody of, or responsibility for, data assets residing on a state system, device, account, or networks owned, monitored, or maintained by the West Virginia Office of Technology.
If an information custodian fails to participate in the annual cybersecurity program review, the West Virginia Office of Technology may recover expenses associated with conducting any diagnostics or evaluations performed to assure safety of the network, devices, and systems. House Bill 5638 amended and reenacted sections 5A-6B-1 through 5A-6B-6 of the code. House Bill 5638 was passed and took effect 90 days from passage, on .