(1) Before an agency shares with a contractor category 3 or higher data, as defined in policy established in accordance with RCW
43.105.054, a written data-sharing agreement must be in place. Such agreements shall conform to the policies for data sharing specified by the office of cybersecurity under the authority of RCW
43.105.054.