Azeem Khan, a presidential fellow at West Virginia University, told the Joint Judiciary Committee that a new Cyber Resilience Resource Center (CRRC) backed by a $1,500,000 Appalachian Regional Commission grant will give free, hands-on cybersecurity assistance to West Virginia businesses and provide paid fellowships for students across the state's 55 counties.

"The Cyber Resilience Resource Center was created as a result of a $1,500,000 grant award from the Appalachian Regional Commission. It will provide free and direct assistance to West Virginia businesses attempting to improve their organization's best practices," Khan said. He said the center will use faculty and student talent at WVU plus outside experts to offer consulting, strategic guidance and technical services with special emphasis on small- and medium-sized businesses and critical infrastructure.

Khan urged the committee to consider adopting a cybersecurity "safe harbor" law to incentivize businesses to implement and comply with recognized cybersecurity frameworks. "If West Virginia were to have a cybersecurity safe harbor law, we would be the sixth state with one of those," Khan said, citing Ohio, Utah, Iowa, Tennessee and Connecticut as states that have enacted versions of such laws.

Khan described why the center emphasizes both legal incentives and practical assistance: large firms typically can afford consultants and internal cybersecurity staff, but smaller businesses often cannot. The CRRC aims to bridge that gap by providing free, direct help and paid student fellowships so businesses can adopt standards tied to a potential safe-harbor defense. Khan said more than 200 students will participate and that fellowships will be paid and open to students at any West Virginia institution of higher education.

He told lawmakers the center is intended to reduce the frequency and cost of breaches, which he described with industry estimates: "In 2020, the estimated annual cost of cybercrime was nearly $105,000,000,000; that estimated cost was $452,300,000,000. And by 2028, it's estimated to go all the way up to $1,800,000,000,000." Khan also cited an IBM report showing an average total cost of a data breach in 2024 of nearly $4,900,000.

Committee members asked practical and legal questions. Delegate Hillenbrand asked which state model was best; Khan suggested recent enactments merit study. Senator Willis asked whether the market already incentivizes businesses to protect data; Khan replied the program is not regulatory and would be optional, arguing the center strengthens the market by increasing the trained cybersecurity workforce and making assistance accessible to small businesses. Lawmakers also asked about interstate or international data flows and whether safe-harbor language could inadvertently shield foreign actors; Khan said bill language would need to address interstate/international actors and noted the governor's prior veto message raised similar concerns.

On funding, Khan said the ARC grant had been awarded recently, would fund paid fellowships and other start-up costs, and that the pilot would cover about two years; he said he was not aware of an immediate additional funding need but that the team was focusing on launching a successful pilot first. Khan confirmed the ARC grant is federal funding from the Appalachian Regional Commission when asked.

Khan asked the Legislature to consider a safe-harbor statute to strengthen adoption of high-level federal cybersecurity frameworks and to make the center's assistance more valuable for businesses that want legal incentive to implement best practices. He stayed after the meeting to take questions from members in the chamber.