Texas 2009 - 81st Regular

Texas Senate Bill SB2164 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	By: Ellis S.B. No. 2164
2	2
3	3
4	4	A BILL TO BE ENTITLED
5	5	AN ACT
6	6	relating to information technology security practices of state
7	7	agencies.
8	8	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
9	9	SECTION 1. Section 411.081(i), Government Code, is amended
10	10	to read as follows:
11	11	(i) A criminal justice agency may disclose criminal history
12	12	record information that is the subject of an order of nondisclosure
13	13	to the following noncriminal justice agencies or entities only:
14	14	(1) the State Board for Educator Certification;
15	15	(2) a school district, charter school, private school,
16	16	regional education service center, commercial transportation
17	17	company, or education shared service arrangement;
18	18	(3) the Texas Medical Board;
19	19	(4) the Texas School for the Blind and Visually
20	20	Impaired;
21	21	(5) the Board of Law Examiners;
22	22	(6) the State Bar of Texas;
23	23	(7) a district court regarding a petition for name
24	24	change under Subchapter B, Chapter 45, Family Code;
25	25	(8) the Texas School for the Deaf;
26	26	(9) the Department of Family and Protective Services;
27	27	(10) the Texas Youth Commission;
28	28	(11) the Department of Assistive and Rehabilitative
29	29	Services;
30	30	(12) the Department of State Health Services, a local
31	31	mental health service, a local mental retardation authority, or a
32	32	community center providing services to persons with mental illness
33	33	or retardation;
34	34	(13) the Texas Private Security Board;
35	35	(14) a municipal or volunteer fire department;
36	36	(15) the Texas Board of Nursing;
37	37	(16) a safe house providing shelter to children in
38	38	harmful situations;
39	39	(17) a public or nonprofit hospital or hospital
40	40	district;
41	41	(18) the Texas Juvenile Probation Commission;
42	42	(19) the securities commissioner, the banking
43	43	commissioner, the savings and mortgage lending commissioner, or the
44	44	credit union commissioner;
45	45	(20) the Texas State Board of Public Accountancy;
46	46	(21) the Texas Department of Licensing and Regulation;
47	47	(22) the Health and Human Services Commission;
48	48	(23) the Department of Aging and Disability Services;
49	49	[and]
50	50	(24) the Texas Education Agency; and
51	51	(25) the Texas Department of Information Resources
52	52	regarding an employee, applicant for employment, contractor,
53	53	subcontractor, intern, or volunteer that provides network security
54	54	services under Chapter 2059, Government Code, to:
55	55	(A) the Department of Information Resources; or
56	56	(B) a contractor or subcontractor of the
57	57	Department of Information Resources.
58	58	SECTION 2. Subchapter F, Chapter 411, Government Code, is
59	59	amended by adding Section 411.1404 to read as follows:
60	60	Sec. 411.1404. ACCESS TO CRIMINAL HISTORY RECORD
61	61	INFORMATION: DEPARTMENT OF INFORMATION RESOURCES. (a) The
62	62	Department of Information Resources is entitled to obtain from the
63	63	department or the Federal Bureau of Investigation identification
64	64	division the criminal history record information maintained by the
65	65	department that relates to a person who is an employee, applicant
66	66	for employment, contractor, subcontractor, intern, or volunteer of
67	67	the Department of Information Resources or a contractor or
68	68	subcontractor that provides services to the Department of
69	69	Information Resources.
70	70	(b) Criminal history record information obtained by the
71	71	Department of Information Resources under this section may not be
72	72	released or disclosed except by court order or with the consent of
73	73	the person who is the subject of the information.
74	74	(c) The Department of Information Resources shall destroy
75	75	criminal history record information obtained under this section
76	76	that relates to a person after the information is used to make an
77	77	employment decision or to take a personnel action relating to the
78	78	person who is the subject of the information.
79	79	(d) The Department of Information Resources may not obtain
80	80	criminal history record information under this section unless the
81	81	Department of Information Resources first adopts policies and
82	82	procedures that provide that evidence of a criminal conviction or
83	83	other relevant information obtained from the criminal history
84	84	record information does not automatically disqualify an individual
85	85	from employment. The policies and procedures adopted under this
86	86	subsection must provide that the hiring official will determine, on
87	87	a case-by-case basis, whether the individual is qualified for
88	88	employment based on factors that include:
89	89	(1) the specific duties of the position;
90	90	(2) the number of offenses committed by the
91	91	individual;
92	92	(3) the nature and seriousness of each offense;
93	93	(4) the length of time between the offense and the
94	94	employment decision;
95	95	(5) the efforts by the individual at rehabilitation;
96	96	and
97	97	(6) the accuracy of the information on the
98	98	individual's employment application.
99	99	SECTION 3. Subchapter D, Chapter 551, Government Code, is
100	100	amended by adding Section 551.089 to read as follows:
101	101	Sec. 551.089. DEPARTMENT OF INFORMATION RESOURCES. This
102	102	chapter does not require the governing board of the Department of
103	103	Information Resources to conduct an open meeting to deliberate:
104	104	(1) security assessments or deployments relating to
105	105	information resources technology;
106	106	(2) network security information as described by
107	107	Section 2059.055(b); or
108	108	(3) the deployment, or specific occasions for
109	109	implementation, of security personnel, critical infrastructure, or
110	110	security devices.
111	111	SECTION 4. Section 552.139, Government Code, is amended to
112	112	read as follows:
113	113	Sec. 552.139. EXCEPTION: GOVERNMENT INFORMATION RELATED TO
114	114	SECURITY OR INFRASTRUCTURE ISSUES FOR COMPUTERS. (a) Information
115	115	is excepted from the requirements of Section 552.021 if it is
116	116	information that relates to computer network security, to
117	117	restricted information under Section 2059.055, or to the design,
118	118	operation, or defense of a computer network.
119	119	(b) The following information is confidential:
120	120	(1) a computer network vulnerability report; and
121	121	(2) any other assessment of the extent to which data
122	122	processing operations, a computer, [or] a computer program,
123	123	network, system, or system interface, or software of a governmental
124	124	body or of a contractor of a governmental body is vulnerable to
125	125	unauthorized access or harm, including an assessment of the extent
126	126	to which the governmental body's or contractor's electronically
127	127	stored information containing sensitive or critical information is
128	128	vulnerable to alteration, damage, [or] erasure, or inappropriate
129	129	use.
130	130	(c) Notwithstanding the confidential nature of the
131	131	information described in this section, the information may be
132	132	disclosed to a bidder if the governmental body determines that
133	133	providing the information is necessary for the bidder to provide an
134	134	accurate bid. A disclosure under this subsection is not a voluntary
135	135	disclosure for purposes of Section 552.007.
136	136	SECTION 5. Sections 2054.077(b), (d), and (e), Government
137	137	Code, are amended to read as follows:
138	138	(b) The information resources manager of a state agency may
139	139	prepare or have prepared a report, including an executive summary
140	140	of the findings of the report, assessing the extent to which a
141	141	computer, a computer program, a computer network, a computer
142	142	system, an interface to a computer system, computer software, or
143	143	data processing of the agency or of a contractor of the agency is
144	144	vulnerable to unauthorized access or harm, including the extent to
145	145	which the agency's or contractor's electronically stored
146	146	information is vulnerable to alteration, damage, [or] erasure, or
147	147	inappropriate use.
148	148	(d) The [On request, the] information resources manager
149	149	shall provide an electronic [a] copy of the vulnerability report on
150	150	its completion to:
151	151	(1) the department;
152	152	(2) the state auditor; [and]
153	153	(3) the agency's executive director; and
154	154	(4) any other information technology security
155	155	oversight group specifically authorized by the legislature to
156	156	receive the report.
157	157	(e) Separate from the executive summary described by
158	158	Subsection (b), a [A] state agency whose information resources
159	159	manager has prepared or has had prepared a vulnerability report
160	160	shall prepare a summary of the report that does not contain any
161	161	information the release of which might compromise the security of
162	162	the state agency's or state agency contractor's computers, computer
163	163	programs, computer networks, computer systems, computer software,
164	164	data processing, or electronically stored information. The summary
165	165	is available to the public on request.
166	166	SECTION 6. This Act takes effect September 1, 2009.