West Virginia § 5A-6B-4 Responsibilities of agencies for cybersecurity

West Virginia Statutes

§ 5A-6B-4 — Responsibilities of agencies for cybersecurity

West Virginia § 5A-6B-4

Ch. 5ADEPARTMENT OF ADMINISTRATION

Art. 6BCYBER SECURITY PROGRAM

This text of West Virginia § 5A-6B-4 (Responsibilities of agencies for cybersecurity) is published on Counsel Stack Legal Research, covering West Virginia primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

W. Va. Code § 5A-6B-4 (2026).

Text

State agencies and other entities subject to the provisions of this article shall:

(1)Undergo an appropriate cyber risk assessment as required by the cybersecurity framework or as directed by the Chief Information Security Officer;

(2)Adhere to the cybersecurity standard established by the Chief Information Security Officer in the use of information technology infrastructure;

(3)Adhere to enterprise cybersecurity policies and standards;

(4)Manage cybersecurity policies and procedures where more restricted security controls are deemed appropriate;

(5)Submit all cybersecurity policy and standard exception requests to the Chief Information Security Officer for approval;

(6)Complete and submit a cyber risk self-assessment report to the Chief Information Security Officer by December

Free access — add to your briefcase to read the full text and ask questions with AI

State agencies and other entities subject to the provisions of this article shall:

(1) Undergo an appropriate cyber risk assessment as required by the cybersecurity framework or as directed by the Chief Information Security Officer;

(2) Adhere to the cybersecurity standard established by the Chief Information Security Officer in the use of information technology infrastructure;

(3) Adhere to enterprise cybersecurity policies and standards;

(4) Manage cybersecurity policies and procedures where more restricted security controls are deemed appropriate;

(5) Submit all cybersecurity policy and standard exception requests to the Chief Information Security Officer for approval;

(6) Complete and submit a cyber risk self-assessment report to the Chief Information Security Officer by December 31, 2020;

(7) Manage a plan of action and milestones based on the findings of the cyber risk assessment and business needs; and

(8) Submit annual reports to the Chief Security Information Officer no later than November 1 of each year beginning on November 1, 2023. The report shall contain an analysis and evaluation of each agency or entity’s cybersecurity readiness, ability to keep user data safe, data classifications, and other steps that the agency or entity has taken towards information technology modernization that are consistent with the objectives of §5A-6-4d and §5A-6-4e of this code.