North Dakota Century Code Title 15. Education § 15-10-44.2. Audits of computer systems--Penalty

a. Conduct a review and assessment of any computer system or related security system of the state board of higher education or any entity under the control and supervision of the board. A review and assessment under this section may include an assessment of system vulnerability, network penetration, any potential security breach, and the susceptibility of the system to cyber attack or cyber fraud.

b. Disclose the findings of a review and assessment to an individual or committee designated by the state board of higher education or to the board. Any record relating to a review and assessment, including a working paper or preliminary draft of a review and assessment report and a report of the findings of a review and assessment, and any record that may cause or perpetuate vulnerability of a computer system or related security system which is obtained or created during a review and assessment is an exempt record.

c. In conjunction with the state board of higher education or a committee designated by the board, procure the services of a specialist in information security systems or any other contractor deemed necessary in conducting a review and assessment under this section.