Texas 2009 - 81st Regular

Texas House Bill HB1830 Compare Versions

The same version is selected twice. Please select two different versions to compare.

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	H.B. No. 1830
2	2
3	3
4	4	AN ACT
5	5	relating to information technology security practices of state
6	6	agencies.
7	7	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
8	8	SECTION 1. Section 411.081(i), Government Code, is amended
9	9	to read as follows:
10	10	(i) A criminal justice agency may disclose criminal history
11	11	record information that is the subject of an order of nondisclosure
12	12	to the following noncriminal justice agencies or entities only:
13	13	(1) the State Board for Educator Certification;
14	14	(2) a school district, charter school, private school,
15	15	regional education service center, commercial transportation
16	16	company, or education shared service arrangement;
17	17	(3) the Texas Medical Board;
18	18	(4) the Texas School for the Blind and Visually
19	19	Impaired;
20	20	(5) the Board of Law Examiners;
21	21	(6) the State Bar of Texas;
22	22	(7) a district court regarding a petition for name
23	23	change under Subchapter B, Chapter 45, Family Code;
24	24	(8) the Texas School for the Deaf;
25	25	(9) the Department of Family and Protective Services;
26	26	(10) the Texas Youth Commission;
27	27	(11) the Department of Assistive and Rehabilitative
28	28	Services;
29	29	(12) the Department of State Health Services, a local
30	30	mental health service, a local mental retardation authority, or a
31	31	community center providing services to persons with mental illness
32	32	or retardation;
33	33	(13) the Texas Private Security Board;
34	34	(14) a municipal or volunteer fire department;
35	35	(15) the Texas Board of Nursing;
36	36	(16) a safe house providing shelter to children in
37	37	harmful situations;
38	38	(17) a public or nonprofit hospital or hospital
39	39	district;
40	40	(18) the Texas Juvenile Probation Commission;
41	41	(19) the securities commissioner, the banking
42	42	commissioner, the savings and mortgage lending commissioner, or the
43	43	credit union commissioner;
44	44	(20) the Texas State Board of Public Accountancy;
45	45	(21) the Texas Department of Licensing and Regulation;
46	46	(22) the Health and Human Services Commission;
47	47	(23) the Department of Aging and Disability Services;
48	48	[and]
49	49	(24) the Texas Education Agency; and
50	50	(25) the Department of Information Resources but only
51	51	regarding an employee, applicant for employment, contractor,
52	52	subcontractor, intern, or volunteer who provides network security
53	53	services under Chapter 2059 to:
54	54	(A) the Department of Information Resources; or
55	55	(B) a contractor or subcontractor of the
56	56	Department of Information Resources.
57	57	SECTION 2. Subchapter F, Chapter 411, Government Code, is
58	58	amended by adding Section 411.1404 to read as follows:
59	59	Sec. 411.1404. ACCESS TO CRIMINAL HISTORY RECORD
60	60	INFORMATION: DEPARTMENT OF INFORMATION RESOURCES. (a) The
61	61	Department of Information Resources is entitled to obtain from the
62	62	department or the identification division of the Federal Bureau of
63	63	Investigation the criminal history record information maintained
64	64	by the department or division that relates to a person who is an
65	65	employee, applicant for employment, contractor, subcontractor,
66	66	intern, or other volunteer with the Department of Information
67	67	Resources or with a contractor or subcontractor for the Department
68	68	of Information Resources.
69	69	(b) Criminal history record information obtained by the
70	70	Department of Information Resources under this section may not be
71	71	released or disclosed except:
72	72	(1) by court order; or
73	73	(2) with the consent of the person who is the subject
74	74	of the information.
75	75	(c) The Department of Information Resources shall destroy
76	76	criminal history record information obtained under this section
77	77	that relates to a person after the information is used to make an
78	78	employment decision or to take a personnel action relating to the
79	79	person who is the subject of the information.
80	80	(d) The Department of Information Resources may not obtain
81	81	criminal history record information under this section unless the
82	82	Department of Information Resources first adopts policies and
83	83	procedures that provide that evidence of a criminal conviction or
84	84	other relevant information obtained from the criminal history
85	85	record information does not automatically disqualify an individual
86	86	from employment. The policies and procedures adopted under this
87	87	subsection must provide that the hiring official will determine, on
88	88	a case-by-case basis, whether the individual is qualified for
89	89	employment based on factors that include:
90	90	(1) the specific duties of the position;
91	91	(2) the number of offenses committed by the
92	92	individual;
93	93	(3) the nature and seriousness of each offense;
94	94	(4) the length of time between the offense and the
95	95	employment decision;
96	96	(5) the efforts by the individual at rehabilitation;
97	97	and
98	98	(6) the accuracy of the information on the
99	99	individual's employment application.
100	100	SECTION 3. Subchapter D, Chapter 551, Government Code, is
101	101	amended by adding Section 551.089 to read as follows:
102	102	Sec. 551.089. DEPARTMENT OF INFORMATION RESOURCES. This
103	103	chapter does not require the governing board of the Department of
104	104	Information Resources to conduct an open meeting to deliberate:
105	105	(1) security assessments or deployments relating to
106	106	information resources technology;
107	107	(2) network security information as described by
108	108	Section 2059.055(b); or
109	109	(3) the deployment, or specific occasions for
110	110	implementation, of security personnel, critical infrastructure, or
111	111	security devices.
112	112	SECTION 4. Section 552.139, Government Code, is amended to
113	113	read as follows:
114	114	Sec. 552.139. EXCEPTION: GOVERNMENT INFORMATION RELATED TO
115	115	SECURITY OR INFRASTRUCTURE ISSUES FOR COMPUTERS. (a) Information
116	116	is excepted from the requirements of Section 552.021 if it is
117	117	information that relates to computer network security, to
118	118	restricted information under Section 2059.055, or to the design,
119	119	operation, or defense of a computer network.
120	120	(b) The following information is confidential:
121	121	(1) a computer network vulnerability report; and
122	122	(2) any other assessment of the extent to which data
123	123	processing operations, a computer, [or] a computer program,
124	124	network, system, or system interface, or software of a governmental
125	125	body or of a contractor of a governmental body is vulnerable to
126	126	unauthorized access or harm, including an assessment of the extent
127	127	to which the governmental body's or contractor's electronically
128	128	stored information containing sensitive or critical information is
129	129	vulnerable to alteration, damage, [or] erasure, or inappropriate
130	130	use.
131	131	(c) Notwithstanding the confidential nature of the
132	132	information described in this section, the information may be
133	133	disclosed to a bidder if the governmental body determines that
134	134	providing the information is necessary for the bidder to provide an
135	135	accurate bid. A disclosure under this subsection is not a voluntary
136	136	disclosure for purposes of Section 552.007.
137	137	SECTION 5. Sections 2054.077(b), (d), and (e), Government
138	138	Code, are amended to read as follows:
139	139	(b) The information resources manager of a state agency may
140	140	prepare or have prepared a report, including an executive summary
141	141	of the findings of the report, assessing the extent to which a
142	142	computer, a computer program, a computer network, a computer
143	143	system, an interface to a computer system, computer software, or
144	144	data processing of the agency or of a contractor of the agency is
145	145	vulnerable to unauthorized access or harm, including the extent to
146	146	which the agency's or contractor's electronically stored
147	147	information is vulnerable to alteration, damage, [or] erasure, or
148	148	inappropriate use.
149	149	(d) The [On request, the] information resources manager
150	150	shall provide an electronic [a] copy of the vulnerability report on
151	151	its completion to:
152	152	(1) the department;
153	153	(2) the state auditor; [and]
154	154	(3) the agency's executive director; and
155	155	(4) any other information technology security
156	156	oversight group specifically authorized by the legislature to
157	157	receive the report.
158	158	(e) Separate from the executive summary described by
159	159	Subsection (b), a [A] state agency whose information resources
160	160	manager has prepared or has had prepared a vulnerability report
161	161	shall prepare a summary of the report that does not contain any
162	162	information the release of which might compromise the security of
163	163	the state agency's or state agency contractor's computers, computer
164	164	programs, computer networks, computer systems, computer software,
165	165	data processing, or electronically stored information. The summary
166	166	is available to the public on request.
167	167	SECTION 6. Section 2054.100(b), Government Code, is amended
168	168	to read as follows:
169	169	(b) The plan must describe the agency's current and proposed
170	170	projects for the biennium, including how the projects will:
171	171	(1) benefit individuals in this state and benefit the
172	172	state as a whole;
173	173	(2) use, to the fullest extent, technology owned or
174	174	adapted by other state agencies;
175	175	(3) employ, to the fullest extent, the department's
176	176	information technology standards, including Internet-based
177	177	technology standards;
178	178	(4) expand, to the fullest extent, to serve residents
179	179	of this state or to serve other state agencies;
180	180	(5) develop on time and on budget;
181	181	(6) produce quantifiable returns on investment; and
182	182	(7) meet any other criteria developed by the
183	183	department or the quality assurance team.
184	184	SECTION 7. Subchapter B, Chapter 2059, Government Code, is
185	185	amended by adding Section 2059.060 to read as follows:
186	186	Sec. 2059.060. VULNERABILITY TESTING OF NETWORK HARDWARE
187	187	AND SOFTWARE. (a) The department shall adopt rules requiring, in
188	188	state agency contracts for network hardware and software, a
189	189	statement by the vendor certifying that the network hardware or
190	190	software, as applicable, has undergone independent certification
191	191	testing for known and relevant vulnerabilities.
192	192	(b) Rules adopted under Subsection (a) may:
193	193	(1) provide for vendor exemptions; and
194	194	(2) establish certification standards for testing
195	195	network hardware and software for known and relevant
196	196	vulnerabilities.
197	197	(c) Unless otherwise provided by rule, the required
198	198	certification testing must be conducted under maximum load
199	199	conditions in accordance with published performance claims of a
200	200	hardware or software manufacturer, as applicable.
201	201	SECTION 8. (a) The Department of Information Resources
202	202	shall adopt the rules required by Section 2059.060, Government
203	203	Code, as added by this Act, not later than September 1, 2010.
204	204	(b) The change in law made by Section 2059.060, Government
205	205	Code, as added by this Act, applies only to a contract entered into
206	206	on or after December 1, 2010.
207	207	SECTION 9. This Act takes effect September 1, 2009.
208	208	______________________________ ______________________________
209	209	President of the Senate Speaker of the House
210	210	I certify that H.B. No. 1830 was passed by the House on April
211	211	2, 2009, by the following vote: Yeas 144, Nays 0, 1 present, not
212	212	voting; and that the House concurred in Senate amendments to H.B.
213	213	No. 1830 on May 14, 2009, by the following vote: Yeas 142, Nays 0,
214	214	1 present, not voting.
215	215	______________________________
216	216	Chief Clerk of the House
217	217	I certify that H.B. No. 1830 was passed by the Senate, with
218	218	amendments, on May 7, 2009, by the following vote: Yeas 31, Nays 0.
219	219	______________________________
220	220	Secretary of the Senate
221	221	APPROVED: __________________
222	222	Date
223	223	__________________
224	224	Governor