Law / United States / 
West Virginia
State agencies, local governments and other public bodies, cyber incident reporting to the Cybersecurity Office
W. Va. Code §§ 5A-6C-2, 5A-6C-3
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds all state agencies within the executive branch, constitutional officers, local government entities as defined in West Virginia Code 7-1-1 or 8-1-2, county boards of education as defined in 18-1-1, the Judiciary, and the Legislature. It does not bind a private business.
- Report a qualified cybersecurity incident to the Cybersecurity Office before any citizen notification, and no later than 10 days after determining that the entity experienced a qualifying cybersecurity incident.
- An incident qualifies when state or federal law requires reporting it to regulatory or law-enforcement agencies or affected citizens, when it substantially affects the entity's ability to conduct business, or when the federal Cybersecurity and Infrastructure Security Agency would classify it as emergency, severe, or high.
- State in the report at least the approximate date of the incident, the date it was discovered, the nature of any data that may have been illegally obtained or accessed, and the state, federal, self-regulatory and foreign regulators to whom notice has been or will be provided.
These lines are LexLint's reading of the law's text, as of .
What this law does
Qualified cybersecurity incidents must be reported to the Cybersecurity Office before any citizen notification, but no later than 10 days following a determination that the entity experienced a qualifying cybersecurity incident.
A qualified cybersecurity incident meets at least one of three criteria: state or federal law requires the reporting of the incident to regulatory or law-enforcement agencies or affected citizens, the ability of the entity to conduct business is substantially affected, or the incident would be classified as emergency, severe, or high by the federal Cybersecurity and Infrastructure Security Agency.
The report must contain at a minimum the approximate date of the incident, the date the incident was discovered, the nature of any data that may have been illegally obtained or accessed, and a list of the state and federal regulatory agencies, self-regulatory bodies, and foreign regulatory agencies to whom the notice has been or will be provided.
The article applies to all state agencies within the executive branch, constitutional officers, all local government entities, county boards of education, the Judiciary, and the Legislature. An incident is a violation, or imminent threat of violation, of computer security policies, acceptable use policies, or standard security practices. The Cybersecurity Office establishes the procedure for reporting cybersecurity incidents and disseminates it to the covered entities.