COMMAND POWERS AND DUTIES.

(a) The command shall:

(1) approve the incident response tools the incident response team may use in responding to a cybersecurity incident;

(2) establish the eligibility criteria an individual must meet to become a volunteer;

(3) develop and publish guidelines for operation of the incident response team, including the:

(A) standards and procedures the command uses to determine whether an individual is eligible to serve as a volunteer;

(B) process for an individual to apply for and accept incident response team membership;

(C) requirements for a participating entity to receive assistance from the incident response team; and

(D) process for a participating entity to request and obtain the assistance of the incident response team; and

(4) adopt rules necessary to implement this subchapter.

(b) The command may require a participating entity to enter into a contract as a condition for obtaining assistance from the incident response team.

(c) The command may provide appropriate training to prospective and approved volunteers.

(d) In accordance with state law, the command may provide compensation for actual and necessary travel and living expenses incurred by a volunteer on a deployment using money available for that purpose.

(e) The command may establish a fee schedule for participating entities receiving incident response team assistance. The amount of fees collected may not exceed the command's costs to operate the incident response team.