§ 2063.007. EMERGENCY PURCHASING IN RESPONSE TO CYBERSECURITY INCIDENT.

(a) In the event the emergency response to a cybersecurity incident requires the command to purchase an item, the command is exempt from the requirements of Sections 2155.0755, 2155.083, and 2155.132(c) in making the purchase.

(b) The command shall, as soon as practicable after an emergency purchase is made under this section:

(1) provide written notice to the Legislative Budget Board and the governor describing the nature of the emergency, the purchase made, and the vendor selected;

(2) ensure that documentation of the purchase, including the justification for bypassing standard procedures and the terms of the contract, is maintained and made available for post-incident audit; and

(3) submit a report to the State Auditor's Office not later than the 90th day after the date of the purchase describing:

(A) the necessity for making the purchase;

(B) the cost and duration of the contract; and

(C) any competitive processes used, if applicable.