1. I. The commissioner of the department of information technology shall be appointed by the governor, with the advice and consent of the council, and shall serve for a term of 4 years. The commissioner shall be academically and technically qualified to hold the position, and shall be known as the chief information officer. A vacancy shall be filled for the remainder of the unexpired term in the same manner as the original appointment.

   I-a. The commissioner of the department of information technology shall nominate for appointment by the governor, with the consent of the executive council, a deputy commissioner of the department of information technology, who shall serve for a term of 4 years and shall be qualified to hold that position by reason of education and experience. The deputy commissioner shall perform such duties as may be assigned by the commissioner, which may include, but not be limited to, the authority and power with approval of the commissioner to direct and supervise the operation and administration of any division of the department.

   I-b. The commissioner shall appoint a chief information security officer, who shall be qualified to hold that position by reason of education and experience. The chief information security officer shall perform such duties described in RSA 21-R:4-a and as may be assigned by the commissioner, which may include, but not be limited to, the authority and power with approval of the commissioner to direct the formulation and implementation of cybersecurity and information security strategy, direction, policy, procedures, and standards across the executive branch of the state government.

2. II. The department shall consist of 4 divisions, which shall be under the direction of the commissioner. The commissioner shall nominate 4 division directors, who shall be appointed by the governor, with the consent of the council. Division directors shall serve for a term of 4 years; provided that a division director serving on the effective date of this paragraph may continue to serve in such capacity until appointed or replaced. The division directors shall be qualified to hold their respective positions by reason of education and relevant experience.
3. III. The salaries of the commissioner, deputy commissioner, chief information security officer, and division directors shall be as specified in RSA 94:1-a.
4. IV. The unclassified position of chief privacy officer is hereby established in the department of information technology. A person shall be qualified for the position by reason of education and experience, be appointed by the commissioner of the department of information technology, and serve at the pleasure of the commissioner. The salary of chief privacy officer shall be determined after assessment and review of the appropriate letter grade allocation in RSA 94:1-a, for positions which shall be conducted pursuant to RSA 94:1-d and RSA 14:14-c.

Source. 2008, 335:1, eff. Sept. 5, 2008. 2014, 327:77, eff. Jan. 1, 2018. 2018, 81:1, eff. May 25, 2018. 2023, 135:1, 2, eff. Aug. 29, 2023. 2025, 141:323, eff. July 1, 2025.