Texas 2021 - 87th Regular

Texas House Bill HB3892 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	By: Capriglione H.B. No. 3892
2	2
3	3
4	4	A BILL TO BE ENTITLED
5	5	AN ACT
6	6	relating to matters concerning governmental entities, including
7	7	cybersecurity, governmental efficiencies, information resources,
8	8	and emergency planning.
9	9	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
10	10	SECTION 1. Section 37.108(b), Education Code, is amended to
11	11	read as follows:
12	12	(b) At least once every three years, each school district or
13	13	public junior college district shall conduct a safety and security
14	14	audit of the district's facilities, including an information
15	15	technology cybersecurity assessment. To the extent possible, a
16	16	district shall follow safety and security audit procedures
17	17	developed by the Texas School Safety Center or a person included in
18	18	the registry established by the Texas School Safety Center under
19	19	Section 37.2091.
20	20	SECTION 2. Subchapter A, Chapter 31, Election Code, is
21	21	amended by adding Section 31.017 to read as follows:
22	22	Sec. 31.017. STUDY ON USE OF ARTIFICIAL INTELLIGENCE FOR
23	23	SIGNATURE VERIFICATION. (a) The secretary of state shall conduct a
24	24	study on the use of artificial intelligence to verify signatures on
25	25	carrier envelope certificates for early voting ballots voted by
26	26	mail. In conducting the study, the secretary of state must consider
27	27	other states' experiences using that method of signature
28	28	verification, as well as other studies published on the subject.
29	29	(b) Not later than September 1, 2022, the secretary of state
30	30	shall prepare and deliver a report on the study's findings to the
31	31	committees of each house of the legislature with primary
32	32	jurisdiction over elections.
33	33	(c) This section expires December 1, 2022.
34	34	SECTION 3. Subchapter B, Chapter 421, Government Code, is
35	35	amended by adding Section 421.027 to read as follows:
36	36	Sec. 421.027. CYBER INCIDENT STUDY AND RESPONSE PLAN. (a)
37	37	In this section:
38	38	(1) "Cyber incident" means an event occurring on or
39	39	conducted through a computer network that actually or imminently
40	40	jeopardizes the integrity, confidentiality, or availability of
41	41	computers, information or communications systems or networks,
42	42	physical or virtual infrastructure controlled by computers or
43	43	information systems, or information on the computers or systems.
44	44	The term includes a vulnerability in implementation or in an
45	45	information system, system security procedure, or internal control
46	46	that could be exploited by a threat source.
47	47	(2) "Significant cyber incident" means a cyber
48	48	incident, or a group of related cyber incidents, likely to result in
49	49	demonstrable harm to state security interests, foreign relations,
50	50	or the economy of this state or to the public confidence, civil
51	51	liberties, or public health and safety of the residents of this
52	52	state.
53	53	(b) The council, in cooperation with the Department of
54	54	Information Resources, shall:
55	55	(1) conduct a study regarding cyber incidents and
56	56	significant cyber incidents affecting state agencies and critical
57	57	infrastructure that is owned, operated, or controlled by agencies;
58	58	and
59	59	(2) develop a comprehensive state response plan to
60	60	provide a format for each state agency to develop an
61	61	agency-specific response plan and to implement the plan into the
62	62	agency's information security plan required under Section 2054.133
63	63	to be implemented by the agency in the event of a cyber incident or
64	64	significant cyber incident affecting the agency or critical
65	65	infrastructure that is owned, operated, or controlled by the
66	66	agency.
67	67	(c) Not later than September 1, 2022, the council shall
68	68	deliver the response plan and a report on the findings of the study
69	69	to:
70	70	(1) the public safety director of the Department of
71	71	Public Safety;
72	72	(2) the governor;
73	73	(3) the lieutenant governor;
74	74	(4) the speaker of the house of representatives;
75	75	(5) the chair of the committee of the senate having
76	76	primary jurisdiction over homeland security matters; and
77	77	(6) the chair of the committee of the house of
78	78	representatives having primary jurisdiction over homeland security
79	79	matters.
80	80	(d) The response plan required by Subsection (b) and the
81	81	report required by Subsection (c) are not public information for
82	82	purposes of Chapter 552.
83	83	(e) This section expires December 1, 2022.
84	84	SECTION 4. Subchapter L, Chapter 441, Government Code, is
85	85	amended by adding Sections 441.1825 and 441.1856 to read as
86	86	follows:
87	87	Sec. 441.1825. STATE INFORMATION GOVERNANCE COORDINATOR.
88	88	(a) The director and librarian shall employ a state information
89	89	governance coordinator in the commission's records management
90	90	division.
91	91	(b) The state information governance coordinator shall:
92	92	(1) ensure records management programs are
93	93	implemented by state agencies for all media types;
94	94	(2) assist state agencies in complying with the
95	95	agencies' records management programs; and
96	96	(3) increase overall awareness and outreach for state
97	97	agency records management programs.
98	98	Sec. 441.1856. TEXAS DIGITAL ARCHIVE. (a) The commission
99	99	shall maintain and operate a digital repository for the
100	100	preservation of and access to permanently valuable archival state
101	101	records, reports, and publications.
102	102	(b) The commission, in collaboration with the Department of
103	103	Information Resources, shall develop a strategy, consistent with
104	104	state records management and archival practices, for state agencies
105	105	to transfer appropriate archival state records that are in
106	106	electronic format to the commission for inclusion in the digital
107	107	repository described by Subsection (a).
108	108	SECTION 5. Section 441.183, Government Code, is amended to
109	109	read as follows:
110	110	Sec. 441.183. RECORDS MANAGEMENT PROGRAMS IN STATE
111	111	AGENCIES. (a) The agency head of each state agency shall:
112	112	(1) establish and maintain a records management
113	113	program on a continuing and active basis;
114	114	(2) create and maintain records containing adequate
115	115	and proper documentation of the organization, functions, policies,
116	116	decisions, procedures, and essential transactions of the agency
117	117	designed to furnish information to protect the financial and legal
118	118	rights of the state and any person affected by the activities of the
119	119	agency;
120	120	(3) make certain that all records of the agency are
121	121	passed to the agency head's successor in the position of agency
122	122	head;
123	123	(4) identify and take adequate steps to protect
124	124	confidential and vital state records;
125	125	(5) cooperate with the commission in the conduct of
126	126	state agency records management surveys; and
127	127	(6) cooperate with the commission, the director and
128	128	librarian, and any other authorized designee of the director and
129	129	librarian in fulfilling their duties under this subchapter.
130	130	(b) This subsection applies only to a state agency that is a
131	131	department, commission, board, office, or other agency in the
132	132	executive branch of state government. This subsection does not
133	133	apply to an institution of higher education, as defined by Section
134	134	61.003, Education Code. As part of a records management program
135	135	established under Subsection (a), the agency head of a state agency
136	136	to which this subsection applies shall require training for agency
137	137	employees, annually and on employment with the agency, regarding
138	138	the records management program, including the agency's approved
139	139	records retention schedule.
140	140	SECTION 6. Subchapter C, Chapter 2054, Government Code, is
141	141	amended by adding Section 2054.0695 to read as follows:
142	142	Sec. 2054.0695. SECURITY PROGRAM FOR INTERNET CONNECTIVITY
143	143	OF CERTAIN OBJECTS. (a) The department, in consultation with
144	144	representatives of the information technology industry and
145	145	voluntary standards organizations and the 10 state agencies that
146	146	received the most state appropriations for that state fiscal year
147	147	as determined by the Legislative Budget Board, shall develop a
148	148	comprehensive risk management program that identifies baseline
149	149	security features for the Internet connectivity of computing
150	150	devices embedded in objects used or purchased by state agencies.
151	151	(b) In developing the program under Subsection (a), the
152	152	department shall identify and use existing international security
153	153	standards and best practices and any known security gaps for a range
154	154	of deployments, including critical systems and consumer usage.
155	155	SECTION 7. Section 2054.512(d), Government Code, is amended
156	156	to read as follows:
157	157	(d) The cybersecurity council shall:
158	158	(1) consider the costs and benefits of establishing a
159	159	computer emergency readiness team to address cyber attacks
160	160	occurring in this state during routine and emergency situations;
161	161	(2) establish criteria and priorities for addressing
162	162	cybersecurity threats to critical state installations;
163	163	(3) consolidate and synthesize best practices to
164	164	assist state agencies in understanding and implementing
165	165	cybersecurity measures that are most beneficial to this state;
166	166	[and]
167	167	(4) assess the knowledge, skills, and capabilities of
168	168	the existing information technology and cybersecurity workforce to
169	169	mitigate and respond to cyber threats and develop recommendations
170	170	for addressing immediate workforce deficiencies and ensuring a
171	171	long-term pool of qualified applicants; and
172	172	(5) ensure all middle and high schools have knowledge
173	173	of and access to:
174	174	(A) free cybersecurity courses and curriculum
175	175	approved by the Texas Education Agency;
176	176	(B) state and regional information sharing and
177	177	analysis centers; and
178	178	(C) contracting benefits, including as provided
179	179	by Section 2054.0565.
180	180	SECTION 8. Subchapter N-1, Chapter 2054, Government Code,
181	181	is amended by adding Sections 2054.517 and 2054.5172 to read as
182	182	follows:
183	183	Sec. 2054.517. VENDOR RESPONSIBILITY FOR CYBERSECURITY. A
184	184	vendor that contracts with this state to provide information
185	185	resources technology for a state agency at a cost to the agency of
186	186	$1 million or more is responsible for addressing known
187	187	cybersecurity risks associated with the technology and is
188	188	responsible for any cost associated with addressing the identified
189	189	cybersecurity risks. For a major information resources project,
190	190	the vendor shall provide to state agency contracting personnel:
191	191	(1) a written attestation that:
192	192	(A) the vendor has a cybersecurity risk
193	193	management program consistent with:
194	194	(i) the cybersecurity framework
195	195	established by the National Institute of Standards and Technology;
196	196	(ii) the 27000 series standards for
197	197	information security published by the International Organization
198	198	for Standardization; or
199	199	(iii) other widely accepted security risk
200	200	management frameworks;
201	201	(B) the vendor's cybersecurity risk management
202	202	program includes appropriate training and certifications for the
203	203	employees performing work under the contract; and
204	204	(C) the vendor has a vulnerability management
205	205	program that addresses vulnerability identification, mitigation,
206	206	and responsible disclosure, as appropriate; and
207	207	(2) an initial summary of any costs associated with
208	208	addressing or remediating the identified technology or
209	209	personnel-related cybersecurity risks as identified in
210	210	collaboration with this state following a risk assessment.
211	211	Sec. 2054.5172. ENCRYPTED SECURE LAYER SERVICES REQUIRED.
212	212	Each state agency that maintains a publicly accessible Internet
213	213	website that requires the submission of sensitive personally
214	214	identifiable information shall use an encrypted secure
215	215	communication protocol, including a secure hypertext transfer
216	216	protocol.
217	217	SECTION 9. Subchapter B, Chapter 2155, Government Code, is
218	218	amended by adding Section 2155.092 to read as follows:
219	219	Sec. 2155.092. VENDOR CERTIFICATION FOR CERTAIN GOODS. (a)
220	220	This section does not apply to a good provided as part of a major
221	221	information resources project as defined by Section 2054.003.
222	222	(b) A vendor offering to sell to the state a good embedded
223	223	with a computing device capable of Internet connectivity must
224	224	include with each bid, offer, proposal, or other expression of
225	225	interest a written certification providing that the good does not
226	226	contain, at the time of submitting the bid, offer, proposal, or
227	227	expression of interest, a hardware, software, or firmware component
228	228	with any known security vulnerability or defect.
229	229	SECTION 10. Section 205.010(b), Local Government Code, is
230	230	amended to read as follows:
231	231	(b) A local government that owns, licenses, or maintains
232	232	computerized data that includes sensitive personal information
233	233	shall comply, in the event of a breach of system security, with the
234	234	notification requirements of:
235	235	(1) Sections 364.0051 and 364.0102 of this code; and
236	236	(2) Section 521.053, Business & Commerce Code, to the
237	237	same extent as a person who conducts business in this state.
238	238	SECTION 11. Subtitle C, Title 11, Local Government Code, is
239	239	amended by adding Chapter 364 to read as follows:
240	240	CHAPTER 364. LOCAL GOVERNMENT CYBERSECURITY AND EMERGENCY PLANNING
241	241	AND RESPONSE
242	242	SUBCHAPTER A. GENERAL PROVISIONS
243	243	Sec. 364.0001. DEFINITIONS. In this chapter:
244	244	(1) "Breach of system security" has the meaning
245	245	assigned by Section 521.053, Business & Commerce Code.
246	246	(2) "Cybersecurity coordinator" means the state
247	247	cybersecurity coordinator designated under Section 2054.511,
248	248	Government Code.
249	249	(3) "Cybersecurity council" means the council
250	250	established by the cybersecurity coordinator under Section
251	251	2054.512, Government Code.
252	252	(4) "Sensitive personal information" has the meaning
253	253	assigned by Section 521.002, Business & Commerce Code.
254	254	SUBCHAPTER B. SECURITY BREACH NOTIFICATION
255	255	Sec. 364.0051. NOTICE TO CYBERSECURITY COORDINATOR. Not
256	256	later than 48 hours after a political subdivision discovers a
257	257	breach or suspected breach of system security or an unauthorized
258	258	exposure of sensitive personal information, the political
259	259	subdivision shall notify the cybersecurity coordinator of the
260	260	breach. The notification must describe the breach, suspected
261	261	breach, or unauthorized exposure.
262	262	Sec. 364.0052. REPORT TO DEPARTMENT OF INFORMATION
263	263	RESOURCES. The cybersecurity coordinator shall report to the
264	264	Department of Information Resources any breach of system security
265	265	reported by a political subdivision in which the person responsible
266	266	for the breach:
267	267	(1) obtained or modified specific critical or
268	268	sensitive personal information;
269	269	(2) established access to the political subdivision's
270	270	information systems or infrastructure; or
271	271	(3) undermined, severely disrupted, or destroyed a
272	272	core service, program, or function of the political subdivision, or
273	273	placed the person in a position to do so in the future.
274	274	Sec. 364.0053. RULEMAKING. The cybersecurity coordinator
275	275	may adopt rules necessary to implement this subchapter.
276	276	SUBCHAPTER C. EMERGENCY PLANNING AND RESPONSE
277	277	Sec. 364.0101. MULTIHAZARD EMERGENCY OPERATIONS PLAN;
278	278	SAFETY AND SECURITY AUDIT. (a) This section applies to a
279	279	municipality or county with a population of more than 100,000.
280	280	(b) Each municipality and county shall adopt and implement a
281	281	multihazard emergency operations plan for use in the municipality's
282	282	and county's facilities. The plan must address mitigation,
283	283	preparedness, response, and recovery as determined by the
284	284	cybersecurity council and the governor's public safety office. The
285	285	plan must provide for:
286	286	(1) municipal or county employee training in
287	287	responding to an emergency;
288	288	(2) measures to ensure coordination with the
289	289	Department of State Health Services, Department of Information
290	290	Resources, local emergency management agencies, law enforcement
291	291	agencies, local health departments, and fire departments in the
292	292	event of an emergency; and
293	293	(3) the implementation of a safety and security audit
294	294	as required by Subsection (c).
295	295	(c) At least once every three years, each municipality and
296	296	county shall conduct a safety and security audit of the
297	297	municipality's or county's information technology infrastructure.
298	298	To the extent possible, a municipality or county shall follow
299	299	safety and security audit procedures developed by the cybersecurity
300	300	council or a comparable public or private entity.
301	301	(d) A municipality or county shall report the results of the
302	302	safety and security audit conducted under Subsection (c):
303	303	(1) to the municipality's or county's governing body;
304	304	and
305	305	(2) in the manner required by the cybersecurity
306	306	council, to the cybersecurity council.
307	307	(e) Except as provided by Subsection (f), any document or
308	308	information collected, developed, or produced during a safety and
309	309	security audit conducted under Subsection (c) is not subject to
310	310	disclosure under Chapter 552, Government Code.
311	311	(f) A document relating to a municipality's or county's
312	312	multihazard emergency operations plan is subject to disclosure if
313	313	the document enables a person to:
314	314	(1) verify that the municipality or county has
315	315	established a plan and determine the agencies involved in the
316	316	development of the plan and the agencies coordinating with the
317	317	municipality or county to respond to an emergency;
318	318	(2) verify that the municipality's or county's plan
319	319	was reviewed within the last 12 months and determine the specific
320	320	review dates;
321	321	(3) verify that the plan addresses the phases of
322	322	emergency management under Subsection (b);
323	323	(4) verify that municipal or county employees have
324	324	been trained to respond to an emergency and determine the types of
325	325	training, the number of employees trained, and the person
326	326	conducting the training;
327	327	(5) verify that the municipality or county has
328	328	completed a safety and security audit under Subsection (c) and
329	329	determine the date the audit was conducted, the person conducting
330	330	the audit, and the date the municipality or county presented the
331	331	results of the audit to the municipality's or county's governing
332	332	body; and
333	333	(6) verify that the municipality or county has
334	334	addressed any recommendations by the municipality's or county's
335	335	governing body for improvement of the plan and determine the
336	336	municipality's or county's progress within the last 12 months.
337	337	Sec. 364.0102. RANSOMWARE PAYMENTS PROHIBITED. (a) In
338	338	this section, "ransomware" has the meaning assigned by Section
339	339	33.023, Penal Code.
340	340	(b) A political subdivision may not make a ransomware
341	341	payment related to a ransomware cyber attack.
342	342	(c) As soon as practicable after discovering a ransomware
343	343	cyber attack, a political subdivision shall report the attack to
344	344	the office of the attorney general and to the information sharing
345	345	and analysis organization established by the Department of
346	346	Information Resources under Sec. 2054.0594, Government Code.
347	347	SECTION 12. Section 2155.092, Government Code, as added by
348	348	this Act, applies only in relation to a contract for which a state
349	349	agency first advertises or otherwise solicits bids, offers,
350	350	proposals, or other expressions of interest on or after the
351	351	effective date of this Act.
352	352	SECTION 13. (a) Except as provided by Subsection (b) of
353	353	this section, this Act takes effect September 1, 2021.
354	354	(b) Section 364.0102, Local Government Code, as added by
355	355	this Act, takes effect September 1, 2022.