(1) The chief information officer shall appoint a chief information security officer.
(2) The chief information security officer described in Subsection (1) shall:
(a) assess cybersecurity risks;
(b) coordinate with executive branch agencies to assess the sensitivity of information; and
(c) manage cybersecurity support for the department and executive branch agencies.