Texas 2019 - 86th Regular

Texas Senate Bill SB1779 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1		By: Paxton S.B. No. 1779
2		-	(Parker)
3	2
4	3
5	4		A BILL TO BE ENTITLED
6	5		AN ACT
7	6		relating to security for state agency information and information
8	7		technologies.
9	8		BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
10	9		SECTION 1. Subtitle B, Title 10, Government Code, is
11	10		amended by adding Chapter 2061, and a heading is added to that
12	11		chapter to read as follows:
13	12		CHAPTER 2061. INFORMATION SECURITY
14	13		SECTION 2. Chapter 2061, Government Code, as added by this
15	14		Act, is amended by adding Subchapter A to read as follows:
16	15		SUBCHAPTER A. GENERAL PROVISIONS
17	16		Sec. 2061.0001. DEFINITIONS. In this chapter:
18	17		(1) "Breach of system security" has the meaning
19	18		assigned by Section 521.053(a), Business & Commerce Code.
20	19		(2) "Computer," "computer network," "computer
21	20		program," "computer system," and "computer software" have the
22	21		meanings assigned by Section 33.01, Penal Code.
23	22		(3) "Confidential information" means information that
24	23		is required to be protected from unauthorized disclosure or public
25	24		release under state or federal law or a legal agreement.
26	25		(4) "Cybersecurity" means the measures taken to
27	26		protect a computer or computer system against unauthorized use or
28	27		access.
29	28		(5) "Data" has the meaning assigned by Section 33.01,
30	29		Penal Code.
31	30		(6) "Department" means the Department of Information
32	31		Resources.
33	32		(7) "Information resources" has the meaning assigned
34	33		by Section 2054.003.
35	34		(8) "Information security" means the protection of
36	35		information and information systems from unauthorized access, use,
37	36		disclosure, disruption, modification, or destruction to maintain
38	37		the confidentiality, integrity, and availability of the
39	38		information.
40	39		(9) "Risk management" means the process of aligning
41	40		information resources risk exposure with the organization's risk
42	41		tolerance by accepting, transferring, or mitigating risk
43	42		exposures.
44	43		(10) "Security incident" means an event that results
45	44		in the accidental or deliberate unauthorized access, loss,
46	45		disclosure, disruption, modification, or destruction of
47	46		information or information resources.
48	47		(11) "Sensitive personal information" has the meaning
49	48		assigned by Section 521.002, Business & Commerce Code.
50	49		(12) "State agency" has the meaning assigned by
51	50		Section 2054.003.
52	51		(13) "Vulnerability" means a weakness in a system,
53	52		application, or network that is subject to exploitation or misuse.
54	53		Sec. 2061.0002. GENERAL POWERS OF DEPARTMENT. (a) The
55	54		department may adopt rules as necessary to implement its
56	55		responsibilities under this chapter.
57	56		(b) The department may require each state agency to report
58	57		to the department:
59	58		(1) each agency's use of information security and
60	59		cybersecurity technologies;
61	60		(2) the effect of those technologies on the duties and
62	61		functions of the agency;
63	62		(3) the costs incurred by the agency in the
64	63		acquisition and use of those technologies;
65	64		(4) the procedures followed in obtaining those
66	65		technologies; and
67	66		(5) other information relating to information
68	67		security and cybersecurity management that in the judgment of the
69	68		department should be reported.
70	69		(c) At the request of a state agency, the department may
71	70		provide technical and managerial assistance relating to
72	71		information security and cybersecurity management and
73	72		technologies.
74	73		(d) The department may report to the governor and to the
75	74		presiding officer of each house of the legislature any factors that
76	75		in the opinion of the department are outside the duties of the
77	76		department but that inhibit or promote effective communication
78	77		about and the use of information security and cybersecurity in
79	78		state government.
80	79		SECTION 3. Chapter 2061, Government Code, as added by this
81	80		Act, is amended by adding Subchapter B, and a heading is added to
82	81		that subchapter to read as follows:
83	82		SUBCHAPTER B. GENERAL DUTIES RELATED TO CYBERSECURITY
84	83		SECTION 4. Sections 2054.059, 2054.0591, 2054.0592, and
85	84		2054.0594, Government Code, are transferred to Subchapter B,
86	85		Chapter 2061, Government Code, as added by this Act, and
87	86		redesignated as Sections 2061.0051, 2061.0052, 2061.0053, and
88	87		2061.0054, Government Code, respectively, and amended to read as
89	88		follows:
90	89		Sec. 2061.0051 [2054.059]. CYBERSECURITY. From available
91	90		funds, the department shall:
92	91		(1) establish and administer a clearinghouse for
93	92		information relating to all aspects of protecting the cybersecurity
94	93		of state agency information;
95	94		(2) develop strategies and a framework for:
96	95		(A) the securing of cyberinfrastructure by state
97	96		agencies, including critical infrastructure; and
98	97		(B) cybersecurity risk assessment and mitigation
99	98		planning;
100	99		(3) develop and provide training to state agencies on
101	100		cybersecurity measures and awareness;
102	101		(4) provide assistance to state agencies on request
103	102		regarding the strategies and framework developed under Subdivision
104	103		(2); and
105	104		(5) promote public awareness of cybersecurity issues.
106	105		Sec. 2061.0052 [2054.0591]. CYBERSECURITY REPORT.
107	106		(a) Not later than November 15 of each even-numbered year, the
108	107		department shall submit to the governor, the lieutenant governor,
109	108		the speaker of the house of representatives, and the standing
110	109		committee of each house of the legislature with primary
111	110		jurisdiction over state government operations a report identifying
112	111		preventive and recovery efforts the state can undertake to improve
113	112		cybersecurity in this state. The report must include:
114	113		(1) an assessment of the resources available to
115	114		address the operational and financial impacts of a cybersecurity
116	115		event;
117	116		(2) a review of existing statutes regarding
118	117		cybersecurity and information resources technologies;
119	118		(3) recommendations for legislative action to
120	119		increase the state's cybersecurity and protect against adverse
121	120		impacts from a cybersecurity event; and
122	121		(4) an evaluation of a program that provides an
123	122		information security officer to assist small state agencies and
124	123		local governments that are unable to justify hiring a full-time
125	124		information security officer [the costs and benefits of
126	125		cybersecurity insurance; and
127	126		[(5) an evaluation of tertiary disaster recovery
128	127		options].
129	128		(b) The department or a recipient of a report under this
130	129		section may redact or withhold information confidential under
131	130		Chapter 552, including Section 552.139, or other state or federal
132	131		law that is contained in the report in response to a request under
133	132		Chapter 552 without the necessity of requesting a decision from the
134	133		attorney general under Subchapter G, Chapter 552.
135	134		Sec. 2061.0053 [2054.0592]. CYBERSECURITY EMERGENCY
136	135		FUNDING. If a cybersecurity event creates a need for emergency
137	136		funding, the department may request that the governor or
138	137		Legislative Budget Board make a proposal under Chapter 317 to
139	138		provide funding to manage the operational and financial impacts
140	139		from the cybersecurity event.
141	140		Sec. 2061.0054 [2054.0594]. INFORMATION SHARING AND
142	141		ANALYSIS ORGANIZATION [CENTER]. (a) The department shall
143	142		establish an information sharing and analysis organization
144	143		[center] to provide a forum for state agencies, local governments,
145	144		public and private institutions of higher education, and the
146	145		private sector to share information regarding cybersecurity
147	146		threats, best practices, and remediation strategies.
148	147		(b) [The department shall appoint persons from appropriate
149	148		state agencies to serve as representatives to the information
150	149		sharing and analysis center.
151	150		[(c)] The department[, using funds other than funds
152	151		appropriated to the department in a general appropriations act,]
153	152		shall provide administrative support to the information sharing and
154	153		analysis organization [center].
155	154		(c) A participant in the information sharing and analysis
156	155		organization shall assert any exception available under state or
157	156		federal law, including Section 552.139, in response to a request
158	157		for public disclosure of information shared through the
159	158		organization.
160	159		(d) A participant described by Subsection (c) may not make a
161	160		voluntary disclosure under Section 552.007.
162	161		SECTION 5. Chapter 2061, Government Code, as added by this
163	162		Act, is amended by adding Subchapter C, and a heading is added to
164	163		that subchapter to read as follows:
165	164		SUBCHAPTER C. INFORMATION SECURITY OFFICER; INFORMATION SECURITY
166	165		TRAINING AND REPORTS
167	166		SECTION 6. Section 2054.136, Government Code, is
168	167		transferred to Subchapter C, Chapter 2061, Government Code, as
169	168		added by this Act, redesignated as Section 2061.0101, Government
170	169		Code, and amended to read as follows:
171	170		Sec. 2061.0101 [2054.136]. DESIGNATION OF [DESIGNATED]
172	171		INFORMATION SECURITY OFFICER. (a) Each state agency shall
173	172		designate an information security officer who:
174	173		(1) reports to the agency's executive-level
175	174		management;
176	175		(2) has authority over information security for the
177	176		entire agency;
178	177		(3) possesses the training and experience required to
179	178		perform the duties required by department rules; and
180	179		(4) to the extent feasible, has information security
181	180		duties as the officer's primary duties.
182	181		(b) On the department's approval, two or more state agencies
183	182		may jointly designate an information security officer under
184	183		Subsection (a) to serve as the information security officer for
185	184		each agency.
186	185		SECTION 7. Subchapter C, Chapter 2061, Government Code, as
187	186		added by this Act, is amended by adding Section 2061.0102 to read as
188	187		follows:
189	188		Sec. 2061.0102. INFORMATION SECURITY TRAINING. The
190	189		department may provide information security training for appointed
191	190		board members, agency heads, and executive management of state
192	191		agencies that is consistent with the cybersecurity awareness
193	192		training provided in Section 2061.0108.
194	193		SECTION 8. Section 2054.1125, Government Code, is
195	194		transferred to Subchapter C, Chapter 2061, Government Code, as
196	195		added by this Act, redesignated as Section 2061.0103, Government
197	196		Code, and amended to read as follows:
198	197		Sec. 2061.0103 [2054.1125]. SECURITY BREACH NOTIFICATION
199	198		BY STATE AGENCY. (a) The information security officer of a [In
200	199		this section:
201	200		[(1) "Breach of system security" has the meaning
202	201		assigned by Section 521.053, Business & Commerce Code.
203	202		[(2) "Sensitive personal information" has the meaning
204	203		assigned by Section 521.002, Business & Commerce Code.
205	204		[(b) A] state agency that owns, licenses, or maintains
206	205		computerized data that includes sensitive personal information,
207	206		confidential information, or information the disclosure of which is
208	207		regulated by law shall, in the event of a breach or suspected breach
209	208		of system security or an unauthorized exposure of that information:
210	209		(1) comply with the notification requirements of
211	210		Section 521.053, Business & Commerce Code, to the same extent as a
212	211		person who conducts business in this state; and
213	212		(2) not later than 48 hours after the discovery of the
214	213		breach, suspected breach, or unauthorized exposure, notify:
215	214		(A) the department, including the chief
216	215		information security officer [and the state cybersecurity
217	216		coordinator]; or
218	217		(B) if the breach, suspected breach, or
219	218		unauthorized exposure involves election data, the secretary of
220	219		state.
221	220		(b) Not later than the 10th business day after the date of
222	221		the eradication, closure, and recovery from a breach, suspected
223	222		breach, or unauthorized exposure, a state agency shall notify the
224	223		department, including the chief information security officer, of
225	224		the details of the event.
226	225		SECTION 9. Sections 2054.077, 2054.133, and 2054.515,
227	226		Government Code, are transferred to Subchapter C, Chapter 2061,
228	227		Government Code, as added by this Act, redesignated as Sections
229	228		2061.0104, 2061.0105, and 2061.0106, Government Code,
230	229		respectively, and amended to read as follows:
231	230		Sec. 2061.0104 [2054.077]. VULNERABILITY REPORTS.
232	231		(a) [In this section, a term defined by Section 33.01, Penal Code,
233	232		has the meaning assigned by that section.
234	233		[(b)] The information security officer [resources manager]
235	234		of a state agency shall prepare or have prepared a report, including
236	235		an executive summary of the findings of the biennial report, not
237	236		later than October 15 of each even-numbered year, assessing the
238	237		extent to which a computer, a computer program, a computer network,
239	238		a computer system, a printer, an interface to a computer system,
240	239		including mobile and peripheral devices, computer software, or data
241	240		processing of the agency or of a contractor of the agency is
242	241		vulnerable to unauthorized access or harm, including the extent to
243	242		which the agency's or contractor's electronically stored
244	243		information is vulnerable to alteration, damage, erasure, or
245	244		inappropriate use.
246	245		(b) [(c)] Except as provided by this section, a
247	246		vulnerability report and any information or communication prepared
248	247		or maintained for use in the preparation of a vulnerability report
249	248		is confidential and is not subject to disclosure under Chapter 552.
250	249		(c) [(d)] The information security officer of a state
251	250		agency [resources manager] shall provide an electronic copy of the
252	251		vulnerability report on its completion to:
253	252		(1) the department;
254	253		(2) the state auditor;
255	254		(3) the agency's executive director; [and]
256	255		(4) the agency's designated information resources
257	256		manager; and
258	257		(5) any other information technology security
259	258		oversight group specifically authorized by the legislature to
260	259		receive the report.
261	260		(d) [(e)] Separate from the executive summary described by
262	261		Subsection (a) [(b)], the information security officer of a state
263	262		agency shall prepare a summary of the agency's vulnerability report
264	263		that does not contain any information the release of which might
265	264		compromise the security of the state agency's or state agency
266	265		contractor's computers, computer programs, computer networks,
267	266		computer systems, printers, interfaces to computer systems,
268	267		including mobile and peripheral devices, computer software, data
269	268		processing, or electronically stored information. The summary is
270	269		available to the public on request.
271	270		Sec. 2061.0105 [2054.133]. INFORMATION SECURITY PLAN.
272	271		(a) Each state agency shall develop, and periodically update, an
273	272		information security plan for protecting the security of the
274	273		agency's information.
275	274		(b) In developing the plan, the state agency shall:
276	275		(1) consider any vulnerability report prepared under
277	276		Section 2061.0104 [2054.077] for the agency;
278	277		(2) incorporate the network security services
279	278		provided by the department to the agency under Chapter 2059;
280	279		(3) identify and define the responsibilities of agency
281	280		staff who produce, access, use, or serve as custodians of the
282	281		agency's information;
283	282		(4) identify risk management and other measures taken
284	283		to protect the agency's information from unauthorized access,
285	284		disclosure, modification, or destruction;
286	285		(5) include:
287	286		(A) the best practices for information security
288	287		developed by the department; or
289	288		(B) a written explanation of why the best
290	289		practices are not sufficient for the agency's security; and
291	290		(6) omit from any written copies of the plan
292	291		information that could expose vulnerabilities in the agency's
293	292		network or online systems.
294	293		(c) Not later than October 15 of each even-numbered year,
295	294		each state agency shall submit a copy of the agency's information
296	295		security plan to the department. Subject to available resources,
297	296		the department may select a portion of the submitted security plans
298	297		to be assessed by the department in accordance with department
299	298		rules.
300	299		(d) Each state agency's information security plan is
301	300		confidential and exempt from disclosure under Chapter 552.
302	301		(e) Each state agency shall include in the agency's
303	302		information security plan a written document that is signed by
304	303		[acknowledgment that] the [executive director or other] head of the
305	304		agency, the chief financial officer, and each executive manager
306	305		[as] designated by the state agency and that states that those
307	306		persons have been made aware of the risks revealed during the
308	307		preparation of the agency's information security plan.
309	308		(f) Not later than January 13 of each odd-numbered year, the
310	309		department shall submit a written report to the governor, the
311	310		lieutenant governor, and the legislature evaluating information
312	311		security for this state's information resources. In preparing the
313	312		report, the department shall consider the information security
314	313		plans submitted by state agencies under this section, any
315	314		vulnerability reports submitted under Section 2061.0104
316	315		[2054.077], and other available information regarding the security
317	316		of this state's information resources. The department shall omit
318	317		from any written copies of the report information that could expose
319	318		specific vulnerabilities in the security of this state's
320	319		information resources.
321	320		Sec. 2061.0106 [2054.515]. STATE AGENCY INFORMATION
322	321		SECURITY ASSESSMENT AND REPORT. (a) At least once every two
323	322		years, each state agency shall conduct an information security
324	323		assessment of the agency's information resources systems, network
325	324		systems, digital data storage systems, digital data security
326	325		measures, and information resources vulnerabilities.
327	326		(b) Not later than December 1 of the year in which a state
328	327		agency conducts the assessment under Subsection (a), the agency
329	328		shall report the results of the assessment to the department. The[,
330	329		the] governor, the lieutenant governor, and the speaker of the
331	330		house of representatives may obtain the report upon request to the
332	331		department.
333	332		(c) The department by rule shall [may] establish the
334	333		requirements for the information security assessment and report
335	334		required by this section.
336	335		SECTION 10. Section 2054.516, Government Code, as added by
337	336		Chapters 683 (H.B. 8) and 955 (S.B. 1910), Acts of the 85th
338	337		Legislature, Regular Session, 2017, is reenacted, transferred to
339	338		Subchapter C, Chapter 2061, Government Code, as added by this Act,
340	339		redesignated as Section 2061.0107, Government Code, and amended to
341	340		read as follows:
342	341		Sec. 2061.0107 [2054.516]. DATA SECURITY PLAN FOR ONLINE
343	342		AND MOBILE APPLICATIONS OF STATE AGENCIES. (a) Each state
344	343		agency[, other than an institution of higher education subject to
345	344		Section 2054.517,] implementing an Internet website or mobile
346	345		application that processes any sensitive [personal] personally
347	346		identifiable information or confidential information must:
348	347		(1) submit a biennial data security plan to the
349	348		department not later than October 15 of each even-numbered year to
350	349		establish planned beta testing for the website or application; and
351	350		(2) subject the website or application to a
352	351		vulnerability and penetration test and address any vulnerability
353	352		identified in the test.
354	353		(b) The department shall review each data security plan
355	354		submitted under Subsection (a) and make any recommendations for
356	355		changes to the plan to the state agency as soon as practicable after
357	356		the department reviews the plan.
358	357		SECTION 11. Section 2054.135, Government Code, is
359	358		transferred to Subchapter C, Chapter 2061, Government Code, as
360	359		added by this Act, and redesignated as Section 2061.0108,
361	360		Government Code, to read as follows:
362	361		Sec. 2061.0108 [2054.135]. DATA USE AGREEMENT. (a) Each
363	362		state agency shall develop a data use agreement for use by the
364	363		agency that meets the particular needs of the agency and is
365	364		consistent with rules adopted by the department that relate to
366	365		information security standards for state agencies.
367	366		(b) A state agency shall update the data use agreement at
368	367		least biennially, but may update the agreement at any time as
369	368		necessary to accommodate best practices in data management.
370	369		(c) A state agency shall distribute the data use agreement
371	370		developed under this section, and each update to that agreement, to
372	371		employees of the agency who handle sensitive information, including
373	372		financial, medical, personnel, or student data. The employee shall
374	373		sign the data use agreement distributed and each update to the
375	374		agreement.
376	375		(d) To the extent possible, a state agency shall provide
377	376		employees described by Subsection (c) with cybersecurity awareness
378	377		training to coincide with the distribution of:
379	378		(1) the data use agreement required under this
380	379		section; and
381	380		(2) each biennial update to that agreement.
382	381		SECTION 12. Subchapter C, Chapter 2061, Government Code, as
383	382		added by this Act, is amended by adding Section 2061.0109 to read as
384	383		follows:
385	384		Sec. 2061.0109. BIENNIAL INFORMATION SECURITY REPORT. Not
386	385		later than October 15 of each even-numbered year, the information
387	386		security officer of each state agency shall submit an information
388	387		security report for the agency. The report must include:
389	388		(1) the vulnerability report required under Section
390	389		2061.0104;
391	390		(2) the information security plan developed under
392	391		Section 2061.0105;
393	392		(3) the information security assessment developed
394	393		under Section 2061.0106;
395	394		(4) the data security plan for online and mobile
396	395		applications required under Section 2061.0107; and
397	396		(5) the recommendations for cybersecurity and
398	397		information resources and technology security training established
399	398		under Section 2061.0155.
400	399		SECTION 13. Chapter 2061, Government Code, as added by this
401	400		Act, is amended by adding Subchapter D, and a heading is added to
402	401		that subchapter to read as follows:
403	402		SUBCHAPTER D. STATE CYBERSECURITY AND STATE CYBERSECURITY
404	403		COORDINATOR
405	404		SECTION 14. Sections 2054.511 and 2054.518, Government
406	405		Code, are transferred to Subchapter D, Chapter 2061, Government
407	406		Code, as added by this Act, redesignated as Sections 2061.0151 and
408	407		2061.0154, Government Code, respectively, and amended to read as
409	408		follows:
410	409		Sec. 2061.0151 [2054.511]. DESIGNATION OF STATE
411	410		CYBERSECURITY COORDINATOR. The executive director of the
412	411		department shall designate an employee of the department as the
413	412		state cybersecurity coordinator to oversee cybersecurity matters
414	413		for this state.
415	414		Sec. 2061.0154 [2054.518]. CYBERSECURITY RISKS AND
416	415		INCIDENTS. (a) The department shall develop a plan to address
417	416		cybersecurity risks and incidents in this state. The department
418	417		may enter into an agreement with a national organization, including
419	418		the National Cybersecurity Preparedness Consortium, to support the
420	419		department's efforts in implementing the components of the plan for
421	420		which the department lacks resources to address internally. The
422	421		agreement may include provisions for:
423	422		(1) providing fee reimbursement for appropriate
424	423		industry-recognized certification examinations for and training to
425	424		state agency personnel [agencies] preparing for and responding to
426	425		cybersecurity risks and incidents;
427	426		(2) developing and maintaining a cybersecurity risks
428	427		and incidents curriculum using existing programs and models for
429	428		training state agency personnel [agencies];
430	429		(3) delivering to state agency personnel with access
431	430		to state agency networks routine training related to appropriately
432	431		protecting and maintaining information technology systems and
433	432		devices, implementing cybersecurity best practices, and mitigating
434	433		cybersecurity risks and vulnerabilities;
435	434		(4) providing technical assistance services to
436	435		support preparedness for and response to cybersecurity risks and
437	436		incidents;
438	437		(5) conducting cybersecurity training and simulation
439	438		exercises for state agency personnel [agencies] to encourage
440	439		coordination in defending against and responding to cybersecurity
441	440		risks and incidents;
442	441		(6) assisting state agencies in developing
443	442		cybersecurity information-sharing programs to disseminate
444	443		information related to cybersecurity risks and incidents; and
445	444		(7) incorporating cybersecurity risk and incident
446	445		prevention and response methods into existing state emergency
447	446		plans, including continuity of operation plans and incident
448	447		response plans.
449	448		(b) In implementing the provisions of the agreement
450	449		prescribed by Subsection (a), the department shall seek to prevent
451	450		unnecessary duplication of existing programs or efforts of the
452	451		department or another state agency.
453	452		(c) In selecting an organization under Subsection (a), the
454	453		department shall consider the organization's previous experience
455	454		in conducting cybersecurity training and exercises for state
456	455		agencies and political subdivisions.
457	456		(d) The department shall consult with institutions of
458	457		higher education in this state when appropriate based on an
459	458		institution's expertise in addressing specific cybersecurity risks
460	459		and incidents.
461	460		SECTION 15. Sections 2054.512 and 2054.513, Government
462	461		Code, are transferred to Subchapter D, Chapter 2061, Government
463	462		Code, as added by this Act, and redesignated as Sections 2061.0152
464	463		and 2061.0153, Government Code, respectively, to read as follows:
465	464		Sec. 2061.0152 [2054.512]. CYBERSECURITY COUNCIL.
466	465		(a) The state cybersecurity coordinator shall establish and lead a
467	466		cybersecurity council that includes public and private sector
468	467		leaders and cybersecurity practitioners to collaborate on matters
469	468		of cybersecurity concerning this state.
470	469		(b) The cybersecurity council must include:
471	470		(1) one member who is an employee of the office of the
472	471		governor;
473	472		(2) one member of the senate appointed by the
474	473		lieutenant governor;
475	474		(3) one member of the house of representatives
476	475		appointed by the speaker of the house of representatives; and
477	476		(4) additional members appointed by the state
478	477		cybersecurity coordinator, including representatives of
479	478		institutions of higher education and private sector leaders.
480	479		(c) In appointing representatives from institutions of
481	480		higher education to the cybersecurity council, the state
482	481		cybersecurity coordinator shall consider appointing members of the
483	482		Information Technology Council for Higher Education.
484	483		(d) The cybersecurity council shall:
485	484		(1) consider the costs and benefits of establishing a
486	485		computer emergency readiness team to address cyber attacks
487	486		occurring in this state during routine and emergency situations;
488	487		(2) establish criteria and priorities for addressing
489	488		cybersecurity threats to critical state installations;
490	489		(3) consolidate and synthesize best practices to
491	490		assist state agencies in understanding and implementing
492	491		cybersecurity measures that are most beneficial to this state; and
493	492		(4) assess the knowledge, skills, and capabilities of
494	493		the existing information technology and cybersecurity workforce to
495	494		mitigate and respond to cyber threats and develop recommendations
496	495		for addressing immediate workforce deficiencies and ensuring a
497	496		long-term pool of qualified applicants.
498	497		(e) The cybersecurity council shall provide recommendations
499	498		to the legislature on any legislation necessary to implement
500	499		cybersecurity best practices and remediation strategies for this
501	500		state.
502	501		Sec. 2061.0153 [2054.513]. CYBERSECURITY APPROVAL SEAL.
503	502		The state cybersecurity coordinator may establish a voluntary
504	503		program that recognizes private and public entities functioning
505	504		with exemplary cybersecurity practices.
506	505		SECTION 16. Subchapter D, Chapter 2061, Government Code, as
507	506		added by this Act, is amended by adding Section 2061.0155 to read as
508	507		follows:
509	508		Sec. 2061.0155. RECOMMENDATIONS FOR CYBERSECURITY AND
510	509		INFORMATION RESOURCES AND TECHNOLOGY SECURITY TRAINING. The
511	510		department shall develop recommendations for cybersecurity and
512	511		information resources and technology security training for state
513	512		agency personnel and post those recommendations on the department's
514	513		Internet website.
515	514		SECTION 17. Section 815.103, Government Code, is amended by
516	515		adding Subsection (g) to read as follows:
517	516		(g) The retirement system shall comply with cybersecurity
518	517		and information security standards established by the Department of
519	518		Information Resources under Chapter 2061.
520	519		SECTION 18. Section 825.103, Government Code, is amended by
521	520		amending Subsection (e) and adding Subsection (e-1) to read as
522	521		follows:
523	522		(e) Except as provided by Subsection (e-1), Chapters 2054,
524	523		[and] 2055, and 2061 do not apply to the retirement system. The
525	524		board of trustees shall control all aspects of information
526	525		technology and associated resources relating to the retirement
527	526		system, including computer, data management, and telecommunication
528	527		operations, procurement of hardware, software, and middleware, and
529	528		telecommunication equipment and systems, location, operation, and
530	529		replacement of computers, computer systems, and telecommunication
531	530		systems, data processing, security, disaster recovery, and
532	531		storage. The Department of Information Resources shall assist the
533	532		retirement system at the request of the retirement system, and the
534	533		retirement system may use any service that is available through
535	534		that department.
536	535		(e-1) The retirement system shall comply with cybersecurity
537	536		and information security standards established by the Department of
538	537		Information Resources under Chapter 2061.
539	538		SECTION 19. The following provisions of the Government Code
540	539		are repealed:
541	540		(1) Section 2054.076(b-1);
542	541		(2) Section 2054.514;
543	542		(3) Section 2054.517; and
544	543		(4) the heading to Subchapter N-1, Chapter 2054.
545	544		SECTION 20. (a) As soon as practicable after the effective
546	545		date of this Act, but not later than August 31, 2020, the Department
547	546		of Information Resources shall adopt rules necessary to implement
548	547		the changes in law made by this Act.
549	548		(b) A rule adopted by the Department of Information
550	549		Resources under Chapter 2054, Government Code, related to
551	550		information security and cybersecurity continues in effect under
552	551		Chapter 2061, Government Code, as added by this Act.
553	552		SECTION 21. To the extent of any conflict, this Act prevails
554	553		over another Act of the 86th Legislature, Regular Session, 2019,
555	554		relating to nonsubstantive additions to and corrections in enacted
556	555		codes.
557	556		SECTION 22. This Act takes effect September 1, 2019.