DIGITAL FORENSICS LABORATORY.

(a) The command shall establish a digital forensics laboratory to:

(1) in collaboration with the cybersecurity incident response unit under Section 2063.202, develop procedures to:

(A) preserve evidence of a cybersecurity incident, including logs and communication;

(B) document chains of custody; and

(C) timely notify and maintain contact with the appropriate law enforcement agencies investigating a cybersecurity incident;

(2) develop and share with relevant state agencies and covered entities, subject to a contractual agreement, cyber threat hunting tools and procedures to assist in identifying indicators of a compromise in the cybersecurity of state information systems and non-state information systems, as appropriate;

(3) conduct analyses of causes of cybersecurity incidents and of remediation options;

(4) conduct assessments of the scope of harm caused by cybersecurity incidents, including data loss, compromised systems, and system disruptions;

(5) provide information and training to state agencies and covered entities on producing reports required by regulatory and auditing bodies;

(6) in collaboration with the Department of Public Safety, the Texas Military Department, the office of the attorney general, and other state agencies, provide forensic analysis of a cybersecurity incident to support an investigation, attribution process, or other law enforcement or judicial action; and

(7) undertake any other activities necessary to carry out the duties described by this subsection.

(b) The chief shall employ a director for the digital forensics laboratory.