R.I. Gen. Laws § 11-49.3-2. Risk-based information security program.