North Dakota Century Code Title 54. State Government § 54-10-29. Audits of computer systems--Penalty

1. The state auditor may:

2. An outside contractor hired to provide services in the review of the security of a computer system is subject to the confidentiality provisions of this section and section 44-04-27. Any individual who knowingly discloses confidential information is subject to the provisions of section 12.1-13-01.

3. The state auditor shall notify the executive officer of any state agency of the date, time, and location of any test conducted in connection with a review and assessment of computer systems or related security systems. The executive officer or the officer's designee may attend and observe any test during which confidential information may be accessed or controlled.

4. The state auditor shall notify the attorney general of the date, time, and location of any test conducted in connection with a review and assessment of computer systems or related security systems. The attorney general may designate an individual to participate in the test. The designee of the attorney general may order the test to be terminated if the individual believes a sensitive system is being breached, a sensitive system may be breached, or sensitive information may be revealed.

5. Notwithstanding any provision in chapter 32-12.2 to the contrary, if the attorney general and the director of the office of management and budget determine it is in the best interest of the state, the state auditor may agree to limit the liability of a contractor performing a review and assessment under this section. The liability limitation must be approved by the attorney general and director of the office of management and budget in writing. For any uninsured losses, the director of the office of management and budget may approve the risk management fund to assume all or part of the contractor's liability to the state in excess of the limitation.

6. A state agency receiving federal tax information under section 6103 of the Internal Revenue Code, as amended [26 U.S.C. 6103], in conjunction with the state auditor, may enter a contract with the vendor selected by the state auditor under subdivision c of subsection 1 to conduct a review and assessment of the state agency's computer systems and related security systems, including an assessment of system vulnerability, network penetration, potential security breach, and susceptibility to cyber attack or cyber fraud.