2026 SESSION

INTRODUCED

26102122D

HOUSE BILL NO. 83

Offered January 14, 2026

Prefiled January 1, 2026

A BILL to amend the Code of Virginia by adding a section numbered 2.2-2012.2, relating to Virginia Information Technologies Agency; powers of the CIO; creation of Cyber Civilian Corps.

—————

Patron—Feggans

—————

Referred to Committee on Communications, Technology and Innovation

—————

Be it enacted by the General Assembly of Virginia:

1. That the Code of Virginia is amended by adding a section numbered 2.2-2012.2 as follows:

§ 2.2-2012.2. Additional powers and duties related to the Cyber Civilian Corps.

A. For purposes of this section:

"Advisor" means an individual who has entered into a volunteer agreement with VITA to serve as a non-deployable advisor in the Corps.

"Advisory board" means the Virginia Cyber Civilian Corps advisory board.

"Client" means a municipal, educational, nonprofit, or critical infrastructure organization that has requested and is using the rapid response assistance of the Corps under the direction of VITA.

"Corps" means the Virginia Cyber Civilian Corps.

"Critical infrastructure" means systems and assets, whether physical or virtual, so vital to the United States or the Commonwealth that the incapacity or destruction of such systems or assets would have a debilitating impact on security, economic security, public health or safety, or any combination thereof as determined by VITA.

"Cybersecurity incident" means an event occurring on or conducted through a computer network that actually or imminently jeopardizes the integrity, confidentiality, or availability of computers, information, or information systems, or information resident on any of these. "Cybersecurity incident" includes the existence of a vulnerability in an information system, system security procedures, internal controls, or implementation that is subject to exploitation.

"Volunteer" means an individual who has entered into a volunteer agreement with VITA to serve as a deployable volunteer in the Corps.

B. VITA may select persons to serve as Corps volunteers and Corps advisors for the purposes of facilitating the responsibilities of VITA as provided in this section.

C. VITA shall enter into a contract with any person who wishes to accept an invitation by VITA to serve as a volunteer or advisor and meets the qualifying criteria for such position as determined by the advisory board. Such contract shall include provisions:

1. Acknowledging the confidentiality of information relating to the Commonwealth and any residents or clients thereof;

2. Protecting from disclosure any confidential information of the Commonwealth and any residents or clients thereof acquired by the volunteer or advisor through participation in the Corps;

3. Requiring the volunteer or advisor to avoid and disclose any conflicts of interest;

4. Requiring the volunteer or advisor to comply with all existing VITA security policies and procedures regarding information technology resources;

5. Requiring the volunteer or advisor to consent to background screening considered appropriate by VITA; and

6. Requiring the volunteer or advisor to attest that he meets any standards of expertise established by VITA.

D. 1. After any person accepts an invitation to serve as a volunteer or advisor, VITA shall request the written consent of such person, on a form and in the manner prescribed by the Department of State Police, to have the Department of State Police conduct a criminal history check and criminal records check on such person to determine such person's eligibility to serve as a volunteer or advisor. Upon receipt of such written consent, VITA shall request the Department of State Police to conduct such criminal history check and criminal records check.

2. The Department of State Police shall conduct the criminal history check and criminal records check within a reasonable time of receipt of a complete request by VITA and shall provide a report of the results to VITA, which shall indicate that the individual is cleared or not cleared to become a volunteer or advisor.

3. If a criminal arrest fingerprint is subsequently submitted to the Department of State Police and matches against a fingerprint submitted pursuant to this section and stored in its automated fingerprint identification system database, the Department of State Police shall notify VITA that the person is still cleared or is no longer cleared to continue as a volunteer or an advisor.

4. If any person's background check results in previous criminal history, such person shall not be eligible for volunteer status. However, the CIO or his designee may, in his discretion, deem such person eligible for nondeployable advisor status.

5. No volunteer or advisor shall begin training for such position until the background check process has been completed and the CIO has determined the person is eligible to hold such position.

E. A volunteer or an advisor is not an agent, employee, or independent contractor of the Commonwealth for any purpose and has no authority to bind the Commonwealth with regard to any third parties. The Commonwealth shall not be liable to any volunteer or advisor for personal injury or property damage suffered by such volunteer or advisor in connection with his participation in the Corps.

F. 1. Except as otherwise provided in this section, VITA and the Commonwealth are immune from any tort liability for acts or omissions made by any volunteer or advisor.

2. Except as otherwise provided in this subsection, and without regard to the discretionary or ministerial nature of the conduct of a volunteer or advisor, each volunteer or advisor shall be immune from tort liability for any injury to any person or damage to any property that occurred while deployed by the Corps and acting on direction of VITA if:

a. Such person is acting or reasonably believes that he is acting within the scope of his authority;

b. Such person's conduct does not amount to gross negligence that is the proximate cause of the injury or damage; and

c. Such person's conduct does not amount to a material breach of the volunteer agreement during the deployment.

3. If a claim is made or a civil action is commenced against any volunteer or advisor for injuries to persons or property caused by the negligence of such person that occurred while in the course of his deployment at the direction of VITA and while acting within the scope of his authority, VITA may pay for, engage, or furnish the services of an attorney to advise the volunteer or advisor as to the claim and to appear for and represent such person in the action. VITA may compromise, settle, and pay the claim before or after the commencement of civil action. Whenever a judgment for damages is awarded against a volunteer or advisor while in the course of his deployment and while acting within the scope of his authority, VITA may indemnify such volunteer or advisor or pay, settle, or compromise the judgment.

4. If a criminal action is commenced against any volunteer or advisor based upon the conduct of such volunteer or advisor in the course of his deployment, if such person had a reasonable basis for believing that he was acting within the scope of his authority at the time of the alleged conduct, VITA may pay for, engage, or furnish the services of an attorney to advise the volunteer or advisor as to the action. Any volunteer or advisor who has incurred legal expenses for conduct prescribed in this subdivision may obtain reimbursement for those expenses under this subdivision.

5. The provisions of this subsection shall not be construed to impose liability on the Commonwealth or VITA.

6. As used in this subsection, "gross negligence" means conduct so reckless as to demonstrate a substantial lack of concern for whether an injury results.

G. 1. On the occurrence of any cybersecurity incident that affects a client, such client may request that VITA deploy one or more volunteers to provide rapid response assistance under the direction of VITA. VITA, in its discretion, may initiate deployment of volunteers upon such occurrence.

2. Acceptance of deployment by a volunteer for a particular cybersecurity incident must be made in writing. A volunteer may decline to accept deployment for any reason. To initiate deployment of a volunteer for a particular cybersecurity incident, VITA shall indicate in writing that the volunteer is authorized to provide such assistance. A single writing may authorize the deployment of more than one volunteer. VITA shall maintain such writing for at least six years from the time of deployment.

3. The deployment of a volunteer to provide assistance to a client must be for seven days unless the writing initiating the deployment contains a different amount of time. Such deployment may be extended in writing at the direction of VITA in the same manner as the initial deployment.

H. There is hereby established an advisory board within VITA to review and make recommendations to VITA regarding the policies and procedures governing the Corps. The advisory board shall be composed of the Adjutant General of Virginia, the CIO, and the Director of the Department of State Police or their respective designees. The advisory board shall meet at least twice annually and shall review and make recommendations on individuals applying for nondeployable advisor status.

I. The CIO shall, in consultation with the advisory board:

1. Approve the set of tools the Corps may use in response to a cybersecurity incident;

2. Determine the standards of expertise necessary for an individual to become a member of the Corps;

3. Establish and maintain a formal process to track volunteer and advisor trainings and compliance with standards as determined by VITA;

4. Publish guidelines for the operation of the Corps program. Such guidelines shall include (i) an explanation of the standard VITA will use to determine the eligibility requirements of volunteers and advisors and the process by which a person may become a volunteer or an advisor, (ii) an explanation of the requirements VITA will impose upon a client to receive the assistance of the Corps and an explanation of the process by which a client may request and receive the assistance of the Corps, and (iii) an explanation of the process by which the Corps will select and prioritize clients in the deployment of assistance;

5. Enter into contracts with clients as a condition of providing assistance through the Corps;

6. Provide appropriate training to individuals participating in the Corps; and

7. Provide compensation for actual and necessary travel and subsistence expenses incurred by volunteers on a deployment at the discretion of VITA.

J. VITA may establish a fee schedule to be charged to clients for assistance provided by the Corps. VITA may recoup expenses through such fees but shall not generate a profit and shall readjust fee schedules as necessary.

K. Information voluntarily given to VITA or obtained pursuant to this section that would identify or provide a means of identifying a person that may, as a result of disclosure of the information, become a victim of a cybersecurity incident or that would disclose a person's cybersecurity plans or cybersecurity-related practices, procedures, methods, results, organizational information system infrastructure, hardware, or software shall be exempt from disclosure under the Virginia Freedom of Information Act (§ 2.2-3700 et seq.).