| 4 | 8 | | AN ACT |
|---|
| 5 | 9 | | relating to establishing a system for the sharing of information |
|---|
| 6 | 10 | | regarding cyber attacks or other cybersecurity incidents occurring |
|---|
| 7 | 11 | | in schools in this state. |
|---|
| 8 | 12 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|---|
| 9 | 13 | | SECTION 1. The heading to Section 11.175, Education Code, |
|---|
| 10 | 14 | | is amended to read as follows: |
|---|
| 11 | 15 | | Sec. 11.175. SCHOOL [DISTRICT] CYBERSECURITY. |
|---|
| 12 | 16 | | SECTION 2. Section 11.175, Education Code, is amended by |
|---|
| 13 | 17 | | amending Subsection (e) and adding Subsections (g), (h), and (i) to |
|---|
| 14 | 18 | | read as follows: |
|---|
| 15 | 19 | | (e) A school district or open-enrollment charter school |
|---|
| 16 | 20 | | [The district's cybersecurity coordinator] shall report to the |
|---|
| 17 | 21 | | agency or, if applicable, the entity that administers the system |
|---|
| 18 | 22 | | established under Subsection (g) any cyber attack or other |
|---|
| 19 | 23 | | cybersecurity incident against the school district's or |
|---|
| 20 | 24 | | open-enrollment charter school's [district] cyberinfrastructure |
|---|
| 21 | 25 | | that constitutes a breach of system security as soon as practicable |
|---|
| 22 | 26 | | after the discovery of the attack or incident. |
|---|
| 23 | 27 | | (g) The agency, in coordination with the Department of |
|---|
| 24 | 28 | | Information Resources, shall establish and maintain a system to |
|---|
| 25 | 29 | | coordinate the anonymous sharing of information concerning cyber |
|---|
| 26 | 30 | | attacks or other cybersecurity incidents between participating |
|---|
| 27 | 31 | | schools and the state. The system must: |
|---|
| 28 | 32 | | (1) include each report made under Subsection (e); |
|---|
| 29 | 33 | | (2) provide for reports made under Subsection (e) to |
|---|
| 30 | 34 | | be shared between participating schools in as close to real time as |
|---|
| 31 | 35 | | possible; and |
|---|
| 32 | 36 | | (3) preserve a reporting school's anonymity by |
|---|
| 33 | 37 | | preventing the disclosure through the system of the name of the |
|---|
| 34 | 38 | | school at which an attack or incident occurred. |
|---|
| 35 | 39 | | (h) In establishing the system under Subsection (g), the |
|---|
| 36 | 40 | | agency may contract with a qualified third party to administer the |
|---|
| 37 | 41 | | system. |
|---|
| 38 | 42 | | (i) The commissioner shall adopt rules as necessary to |
|---|
| 39 | 43 | | implement this section. |
|---|
| 40 | 44 | | SECTION 3. This Act takes effect September 1, 2021. |
|---|
| 41 | | - | ______________________________ ______________________________ |
|---|
| 42 | | - | President of the Senate Speaker of the House |
|---|
| 43 | | - | I hereby certify that S.B. No. 1696 passed the Senate on |
|---|
| 44 | | - | April 20, 2021, by the following vote: Yeas 28, Nays 3; and that |
|---|
| 45 | | - | the Senate concurred in House amendment on May 29, 2021, by the |
|---|
| 46 | | - | following vote: Yeas 26, Nays 4. |
|---|
| 47 | | - | ______________________________ |
|---|
| 48 | | - | Secretary of the Senate |
|---|
| 49 | | - | I hereby certify that S.B. No. 1696 passed the House, with |
|---|
| 50 | | - | amendment, on May 26, 2021, by the following vote: Yeas 146, |
|---|
| 51 | | - | Nays 0, one present not voting. |
|---|
| 52 | | - | ______________________________ |
|---|
| 53 | | - | Chief Clerk of the House |
|---|
| 54 | | - | Approved: |
|---|
| 55 | | - | ______________________________ |
|---|
| 56 | | - | Date |
|---|
| 57 | | - | ______________________________ |
|---|
| 58 | | - | Governor |
|---|