(a) In this section, “cyber attack” means an attempt to gain illegal access to a computer or computer system for the purpose of causing damage, harm, or disruption.
(b) The department may purchase insurance coverage that the department considers necessary to protect against liability, revenue, and property losses that may result from a data breach or cyber attack.

(c) Insurance purchased under this section may include coverage for business and dependent business interruption loss, breach response, data recovery, cyber extortion or ransomware response, fiduciary liability, media liability, professional liability, or expenses for general incident management, such as investigation, remediation, and notification.