The director of the office of management and budget may pay from the risk management fund costs necessary for notification and remediation following a data breach involving a state entity. The director of the office of management and budget, in consultation with the information technology department and the state entity involved, shall determine what measures are to be taken under this section. Expenditures under this section are limited to two hundred fifty thousand dollars per incident and may be made only to the extent the risk management fund can continue to meet current and future liability obligations and the response and remediation costs are not covered through insurance. The director may purchase insurance and approve the purchase of insurance by state entities to cover data breach response and remediation costs. Each state entity shall contribute the appropriate share of its costs under this section as determined by the director.