88R9921 JXC-F
By: Schwertner, King S.B. No. 2013
A BILL TO BE ENTITLED
AN ACT
relating to access to and the security of certain critical
infrastructure.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Section 113.001, Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021, is amended by adding Subdivision (5) to read
as follows:
(5) "Affiliate," with respect to a company entering
into an agreement in which the critical infrastructure is electric
grid equipment, has the meaning assigned by the February 1, 2023,
version of the ERCOT Nodal Protocols.
SECTION 2. Section 113.002, Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021, is amended by adding Subsection (c) to read
as follows:
(c) Notwithstanding Subsection (a), a business entity may
enter into an agreement described by Subsection (a)(1) in which the
critical infrastructure is electric grid equipment if the business
entity takes reasonable and necessary actions to ensure that remote
access or control by the company is mitigated.
SECTION 3. Subchapter F, Chapter 411, Government Code, is
amended by adding Section 411.1183 to read as follows:
Sec. 411.1183. ACCESS TO CRIMINAL HISTORY RECORD
INFORMATION: INDEPENDENT ORGANIZATION CERTIFIED UNDER UTILITIES
CODE. (a) An independent organization certified under Section
39.151, Utilities Code, for security reasons is entitled to obtain
from the department criminal history record information maintained
by the department that relates to a person who has or is seeking
employment at or access to the independent organization's systems
that affect the security of the electric grid.
(b) Criminal history information obtained from the
department may not be released or disclosed except:
(1) as needed in protecting the security of the
electric grid;
(2) as authorized by a court order or a federal or
state law or order; or
(3) with the consent of the person who is the subject
of the criminal history record information.
SECTION 4. Section 2274.0101, Government Code, as added by
Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
Session, 2021, is amended by amending Subdivision (5) and adding
Subdivision (6) to read as follows:
(5) "Governmental entity" means a state agency, a [or]
political subdivision, or an independent organization certified
under Section 39.151, Utilities Code, to perform a function
described by Section 39.151(a), Utilities Code [of this state].
(6) "Affiliate," with respect to a company entering
into an agreement in which the critical infrastructure is electric
grid equipment, has the meaning assigned by the February 1, 2023,
version of the ERCOT Nodal Protocols.
SECTION 5. Section 39.151, Utilities Code, is amended by
adding Subsection (g-7) to read as follows:
(g-7) To maintain certification as an independent
organization under this section, the organization must:
(1) identify all employee positions in the
organization that are critical to the security of the electric
grid; and
(2) before hiring a person for a position described by
Subdivision (1), obtain from the Department of Public Safety or a
private vendor all criminal history record information relating to
the prospective employee.
SECTION 6. Subchapter H, Chapter 39, Utilities Code, is
amended by adding Section 39.360 to read as follows:
Sec. 39.360. TRANSACTIONS WITH CERTAIN FOREIGN-OWNED
COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE. (a) In this
section, "company" and "critical infrastructure" have the meanings
assigned by Section 113.001, Business & Commerce Code, as added by
Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
Session, 2021.
(b) An independent organization certified under Section
39.151 may not register a business entity to operate in the power
region for which the independent organization is certified unless
the business entity:
(1) attests that the entity complies with Chapter 113,
Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts
of the 87th Legislature, Regular Session, 2021, including by taking
reasonable and necessary actions to mitigate remote access to or
control of the entity's electric grid equipment by a company
described by Section 113.002(a)(2), Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021;
(2) takes reasonable and necessary actions to mitigate
remote access to or control of the entity's electric grid equipment
by a country designated under Section 113.003, Business & Commerce
Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
Legislature, Regular Session, 2021; and
(3) attests that the entity complies with Subdivision
(2).
(c) An independent organization certified under Section
39.151 shall require as a condition of operating in the region that
a business entity:
(1) report to the independent organization the
purchase of any critical electric grid equipment from a company
described by Section 113.002(a)(2), Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021; and
(2) take reasonable and necessary actions to mitigate
access to or control of the purchased critical electric grid
equipment by a company described by Section 113.002(a)(2), Business &
Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the
87th Legislature, Regular Session, 2021.
(d) Notwithstanding any other law, an independent
organization certified under Section 39.151 may immediately
suspend or terminate a company's registration or access to any of
the independent organization's systems if the independent
organization has a reasonable suspicion that the company meets any
of the criteria described by Section 2274.0102(a)(2), Government
Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
Legislature, Regular Session, 2021.
(e) A contractual provision that limits or contradicts
Subsection (d) is contrary to public policy and is unenforceable
and void.
(f) An independent organization certified under Section
39.151 may adopt guidelines or procedures relating to the
suspension or termination of a company's registration or access to
any of the independent organization's systems.
(g) The commission shall:
(1) adopt any rules necessary to administer this
section or authorize an independent organization to carry out a
duty imposed by this section; and
(2) by rule establish a process to allow a company that
has been adversely affected by a suspension or termination under
Subsection (d) to request that the commission review and approve or
deny the suspension or termination.
SECTION 7. The changes made to Chapter 113, Business &
Commerce Code, and Chapter 2274, Government Code, apply only to a
contract or agreement entered into on or after the effective date of
this Act.
SECTION 8. It is the intent of the 88th Legislature, Regular
Session, 2023, that the amendments made by this Act be harmonized
with another Act of the 88th Legislature, Regular Session, 2023,
relating to nonsubstantive additions to and corrections in enacted
codes.
SECTION 9. This Act takes effect immediately if it receives
a vote of two-thirds of all the members elected to each house, as
provided by Section 39, Article III, Texas Constitution. If this
Act does not receive the vote necessary for immediate effect, this
Act takes effect September 1, 2023.