HB 5638 West Virginia House of Delegates · 2026 Regular Session

Relating to the requirements of the state’s cyber security program and responsibilities and authority of the state chief information security officer

HB 5638 establishes the West Virginia Cybersecurity Office within the Office of Technology, led by a Chief Information Security Officer (CISO), to manage the state's cybersecurity program. It requires most state agencies (excluding higher education, the State Police, constitutional officers, the Legislature, and Judiciary) to follow standardized cybersecurity practices, conduct risk assessments, and implement security controls for protecting information systems. The CISO is tasked with developing agency-wide cybersecurity policies, creating a risk management service to clarify agency responsibilities, and setting cyber risk standards based on federal and industry best practices. The bill aims to strengthen the state's ability to prevent, detect, and respond to cyber threats across government operations.
Bill status signed all 5 stages cleared
Introduction
Feb 2026
Committee Review
Mar 2026
House of Delegates Passage
Mar 2026
Senate Passage
Mar 2026
Signed into Law
Jun 2026
Introduced Feb 17, 2026 Signed Jun 29, 2026
Maddy AI version diff · 3 comparisons

What changed between versions

hb5638 s gov am _1 3-10 adopted.htm Enrolled Version · 5 edits · Apr 1, 2026
MODERATE
The bill was amended to streamline the cybersecurity office's structure by removing redundant titles and correcting the appointment authority to the Chief Information Officer. It also updated definitions to remove confusing phrasing regarding risk assessments and clarified the responsibilities of agencies, including the removal of specific past due dates and the consolidation of reporting requirements to ensure a more flexible and modernized cybersecurity framework.
Scope change
The scope of applicability remains largely the same, but the definition of an 'information custodian' was broadened to explicitly include 'office, board, commission,' and the specific exemptions for the State Police and constitutional officers were removed from the text, though the article's applicability section still lists them.
DEFINITION

The definition of 'Cyber risk assessment Cybersecurity program review' was corrected to simply 'Cybersecurity program review,' removing redundant and confusing text.

The definition of 'Information custodian' was expanded to explicitly list 'office, board, commission,' clarifying which state entities are responsible for data security.

REQUIREMENT

Specific deadlines for submitting reports (e.g., December 31, 2020) were removed, replacing them with recurring annual requirements to allow for ongoing compliance rather than one-time fixes.

The requirement for agencies to complete a specific self-assessment report by a past date was removed, focusing instead on the ongoing requirement to participate in annual cybersecurity program reviews.

TECHNICAL

Several grammatical errors and redundant phrases were removed from the text, such as 'authority to may' and 'functions and duties as provided by lawand as or directed,' to improve clarity and legal precision.

Floor votes · Senate Mar 12, 2026 · House of Delegates Mar 2, 2026

How they voted

330
Passed
Total votes 33
Mar 12, 2026
D Democratic2
2 Yea
100% Yea
R Republican31
31 Yea
100% Yea
Vote distribution
All Yea All Nay Mixed No data
Full legislative history

Actions timeline

Total actions
37
Key actions
9
Committee
5
Apr 1, 2026
Signed into law
Approved by Governor 4/1/2026
lower
Mar 14, 2026
Signed into law
Approved by Governor 4/1/2026 - House Journal
lower
Mar 14, 2026
Signed into law
Approved by Governor 4/1/2026 - Senate Journal
upper
Mar 14, 2026
Lower · Passed
House concurred in Senate amendment and passed bill (Roll No. 644)
lower
Mar 12, 2026
Upper · Passed
Passed Senate (Roll No. 514)
upper
Mar 11, 2026
Upper · Passed
Committee amendment adopted (Voice vote)
upper
Mar 10, 2026
Upper · Passed
Reported do pass, with amendment
upper
Mar 4, 2026
Committee
To Government Organization
upper
Mar 4, 2026
Introduced
Introduced in Senate
upper
Mar 2, 2026
Lower · Passed
Passed House (Roll No. 251)
lower
Feb 25, 2026
Lower · Passed
Do pass
lower
Feb 17, 2026
Committee
To House Energy and Public Works
lower
Feb 17, 2026
Introduced
Introduced in House
lower
1 primary · 0 co-sponsors

Sponsors

Role
Legislator
Party
State
District
P
Photo of Daniel Linville
Daniel Linville
RRepublican
WV
22