Texas 2025 - 89th Regular

Texas House Bill HB150 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1		-	By: Capriglione, Bonnen, Hefner, Lujan, H.B. No. 150
	1	+	89R20783 LRM-F
	2	+	By: Capriglione, Hefner, Lujan, H.B. No. 150
2	3		Lopez of Bexar, et al.
3		-
4		-
	4	+	Substitute the following for H.B. No. 150:
	5	+	By: Troxclair C.S.H.B. No. 150
5	6
6	7
7	8		A BILL TO BE ENTITLED
8	9		AN ACT
9	10		relating to the establishment of the Texas Cyber Command as a
10	11		component institution of The University of Texas System and the
11	12		transfer to it of certain powers and duties of the Department of
12	13		Information Resources.
13	14		BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
14	15		SECTION 1. Subtitle B, Title 10, Government Code, is
15	16		amended by adding Chapter 2063 to read as follows:
16	17		CHAPTER 2063. TEXAS CYBER COMMAND
17	18		SUBCHAPTER A. GENERAL PROVISIONS
18	19		Sec. 2063.001. DEFINITIONS. In this chapter:
19	20		(1) "Chief" means the chief of the Texas Cyber
20	21		Command.
21	22		(2) "Command" means the Texas Cyber Command
22	23		established under this chapter.
23	24		(3) "Covered entity" means a private entity operating
24	25		critical infrastructure or a local government that the command
25	26		contracts with in order to provide cybersecurity services under
26	27		this chapter.
27	28		(4) "Critical infrastructure" means infrastructure in
28	29		this state vital to the security, governance, public health and
29	30		safety, economy, or morale of the state or the nation, including:
30	31		(A) chemical facilities;
31	32		(B) commercial facilities;
32	33		(C) communication facilities;
33	34		(D) manufacturing facilities;
34	35		(E) dams;
35	36		(F) defense industrial bases;
36	37		(G) emergency services systems;
37	38		(H) energy facilities;
38	39		(I) financial services systems;
39	40		(J) food and agriculture facilities;
40	41		(K) government facilities;
41	42		(L) health care and public health facilities;
42	43		(M) information technology and information
43	44		technology systems;
44	45		(N) nuclear reactors, materials, and waste;
45	46		(O) transportation systems; or
46	47		(P) water and wastewater systems.
47	48		(5) "Cybersecurity" means the measures taken for a
48	49		computer, computer network, computer system, or other technology
49	50		infrastructure to protect against, respond to, and recover from
50	51		unauthorized:
51	52		(A) use, access, disruption, modification, or
52	53		destruction; or
53	54		(B) disclosure, modification, or destruction of
54	55		information.
55	56		(6) "Cybersecurity incident" includes:
56	57		(A) a breach or suspected breach of system
57	58		security as defined by Section 521.053, Business & Commerce Code;
58	59		(B) the introduction of ransomware, as defined by
59	60		Section 33.023, Penal Code, into a computer, computer network, or
60	61		computer system; or
61	62		(C) any other cybersecurity-related occurrence
62	63		that jeopardizes information or an information system designated by
63	64		command policy adopted under this chapter.
64	65		(7) "Department" means the Department of Information
65	66		Resources.
66		-	(8) "Governmental entity" means a state agency.
	67	+	(8) "Governmental entity" means this state, a state
	68	+	agency, or a local government.
67	69		(9) "Information resources" has the meaning assigned
68	70		by Section 2054.003, Government Code.
69	71		(10) "Information resources technologies" has the
70	72		meaning assigned by Section 2054.003.
71	73		(11) "Local government" has the meaning assigned by
72	74		Section 2054.003.
73	75		(12) "Sensitive personal information" has the meaning
74	76		assigned by Section 521.002, Business & Commerce Code.
75	77		(13) "State agency" means:
76	78		(A) a department, commission, board, office, or
77	79		other agency that is in the executive branch of state government and
78	80		that was created by the constitution or a statute;
79	81		(B) the supreme court, the court of criminal
80	82		appeals, a court of appeals, a district court, or the Texas Judicial
81	83		Council or another agency in the judicial branch of state
82	84		government; or
83	85		(C) a university system or an institution of
84	86		higher education as defined by Section 61.003, Education Code.
85	87		Sec. 2063.002. ORGANIZATION. (a) The Texas Cyber Command
86	88		is a component of The University of Texas System and
87	89		administratively attached to The University of Texas at San
88	90		Antonio.
89	91		(b) The command is managed by a chief appointed by the
90	92		governor and confirmed with the advice and consent of the senate.
91	93		The chief serves at the pleasure of the governor and must possess
92	94		professional training and knowledge relevant to the functions and
93	95		duties of the command.
94	96		(c) The command shall employ other coordinating and
95	97		planning officers and other personnel necessary to the performance
96	98		of its functions.
97	99		(d) Under an agreement with the command, The University of
98	100		Texas at San Antonio shall provide administrative support services
99	101		for the command as necessary to carry out the purposes of this
100	102		chapter.
101	103		Sec. 2063.003. ESTABLISHMENT AND PURPOSE. (a) The command
102	104		is established to prevent and respond to cybersecurity incidents
103	105		that affect governmental entities and critical infrastructure in
104	106		this state.
105	107		(b) The command is responsible for cybersecurity for this
106	108		state, including:
107	109		(1) developing tools to enhance cybersecurity
108	110		defenses;
109	111		(2) facilitating education and training of a
110	112		cybersecurity workforce;
111	113		(3) developing cyber threat intelligence, monitoring
112	114		information systems to detect and warn entities of cyber attacks,
113	115		proactively searching for cyber threats to critical infrastructure
114	116		and state systems, developing and executing cybersecurity incident
115	117		responses, and conducting digital forensics of cybersecurity
116	118		incidents to support law enforcement and attribute the incidents;
117	119		(4) creating partnerships needed to effectively carry
118	120		out the command's functions; and
119	121		(5) receiving all cybersecurity incident reports from
120	122		state agencies and covered entities.
121	123		Sec. 2063.004. GENERAL POWERS AND DUTIES. (a) The command
122	124		shall:
123	125		(1) promote public awareness of cybersecurity issues;
124	126		(2) develop cybersecurity best practices and minimum
125	127		standards for governmental entities;
126	128		(3) develop and provide training to state agencies and
127	129		covered entities on cybersecurity measures and awareness;
128	130		(4) administer the cybersecurity threat intelligence
129	131		center under Section 2063.201;
130	132		(5) provide support to state agencies and covered
131	133		entities experiencing a cybersecurity incident and respond to
132	134		cybersecurity reports received under Subchapter D and other reports
133	135		as appropriate;
134	136		(6) administer the digital forensics laboratory under
135	137		Section 2063.203;
136	138		(7) administer a statewide portal for enterprise
137	139		cybersecurity threat, risk, and incident management, and operate a
138	140		cybersecurity hotline available for state agencies and covered
139	141		entities 24 hours a day, seven days a week;
140	142		(8) collaborate with law enforcement agencies to
141	143		provide training and support related to cybersecurity incidents;
142	144		(9) serve as a clearinghouse for information relating
143	145		to all aspects of protecting the cybersecurity of governmental
144	146		entities, including sharing appropriate intelligence and
145	147		information with governmental entities, federal agencies, and
146	148		covered entities;
147	149		(10) collaborate with the department to ensure
148	150		information resources and information resources technologies
149	151		obtained by the department meet the cybersecurity standards and
150	152		requirements established under this chapter;
151	153		(11) offer cybersecurity resources to state agencies
152	154		and covered entities as determined by the command;
153	155		(12) adopt policies to ensure state agencies implement
154	156		sufficient cybersecurity measures to defend information resources,
155	157		information resources technologies, and sensitive personal
156	158		information maintained by the agencies; and
157	159		(13) collaborate with federal agencies to protect
158	160		against, respond to, and recover from cybersecurity incidents.
159	161		(b) The command may:
160	162		(1) adopt and enforce rules necessary to carry out
161	163		this chapter;
162	164		(2) adopt and use an official seal;
163	165		(3) establish ad hoc advisory committees as necessary
164	166		to carry out the command's duties under this chapter;
165	167		(4) acquire and convey property or an interest in
166	168		property;
167	169		(5) procure insurance and pay premiums on insurance of
168	170		any type, in accounts, and from insurers as the command considers
169	171		necessary and advisable to accomplish any of the command's duties;
170	172		(6) hold patents, copyrights, trademarks, or other
171	173		evidence of protection or exclusivity issued under the laws of the
172	174		United States, any state, or any nation and may enter into license
173	175		agreements with any third parties for the receipt of fees,
174	176		royalties, or other monetary or nonmonetary value; and
175	177		(7) solicit and accept gifts, grants, donations, or
176	178		loans from and contract with any entity to accomplish the command's
177	179		duties.
178	180		(c) Except as otherwise provided by this chapter, the
179	181		command shall deposit money paid to the command under this chapter
180	182		in the state treasury to the credit of the general revenue fund.
181	183		Sec. 2063.005. COST RECOVERY. The command shall recover
182	184		the cost of providing direct technical assistance, training
183	185		services, and other services to covered entities when reasonable
184	186		and practical.
185	187		Sec. 2063.007. EMERGENCY PURCHASING. In the event the
186	188		emergency response to a cybersecurity incident requires the command
187	189		to purchase an item, the command is exempt from the requirements of
188	190		Sections 2155.0755, 2155.083, and 2155.132(c) in making the
189	191		purchase.
190	192		Sec. 2063.008. RULES. The chief may adopt rules necessary
191	193		for carrying out the purposes of this chapter.
192	194		Sec. 2063.009. APPLICATION OF SUNSET ACT. The command is
193	195		subject to Chapter 325 (Texas Sunset Act). Unless continued in
194	196		existence as provided by that chapter, the command is abolished
195	197		September 1, 2031.
196	198		SUBCHAPTER B. MINIMUM STANDARDS AND TRAINING
197	199		Sec. 2063.101. BEST PRACTICES AND MINIMUM STANDARDS FOR
198	200		CYBERSECURITY AND TRAINING. (a) The command shall develop and
199	201		annually assess best practices and minimum standards for use by
200	202		governmental entities to enhance the security of information
201	203		resources in this state.
202	204		(b) The command shall establish and periodically assess
203	205		mandatory cybersecurity training that must be completed by all
204	206		information resources employees of state agencies. The command
205	207		shall consult with the Information Technology Council for Higher
206	208		Education established under Section 2054.121 regarding applying
207	209		the training requirements to employees of institutions of higher
208	210		education.
209		-	(c) Except as otherwise provided by this subsection, the
210		-	command shall adopt policies to ensure governmental entities are
211		-	complying with the requirements of this section. The command shall
212		-	adopt policies that ensure that a person who is not a citizen of the
213		-	United States may not be a member, employee, contractor, volunteer,
214		-	or otherwise affiliated with the command or any entity or
215		-	organization established or operated by the command under this
216		-	chapter.
	211	+	(c) The command shall adopt policies to ensure governmental
	212	+	entities are complying with the requirements of this section.
217	213		SUBCHAPTER C. CYBERSECURITY PREVENTION, RESPONSE, AND RECOVERY
218	214		Sec. 2063.201. CYBERSECURITY THREAT INTELLIGENCE CENTER.
219	215		(a) In this section, "center" means the cybersecurity threat
220	216		intelligence center established under this section.
221	217		(b) The command shall establish a cybersecurity threat
222	218		intelligence center. The center shall collaborate with federal
223	219		cybersecurity intelligence and law enforcement agencies to achieve
224	220		the purposes of this section.
225	221		(c) The center, in coordination with the digital forensics
226	222		laboratory under Section 2063.203, shall:
227	223		(1) operate the information sharing and analysis
228	224		organization established under Section 2063.204; and
229	225		(2) provide strategic guidance to regional security
230	226		operations centers established under Subchapter G and the
231	227		cybersecurity incident response unit under Section 2063.202 to
232	228		assist governmental entities in responding to a cybersecurity
233	229		incident.
234	230		(d) The chief shall employ a director for the center.
235	231		Sec. 2063.202. CYBERSECURITY INCIDENT RESPONSE UNIT. (a)
236	232		The command shall establish a dedicated cybersecurity incident
237	233		response unit to:
238	234		(1) detect and contain cybersecurity incidents in
239	235		collaboration with the cybersecurity threat intelligence center
240	236		under Section 2063.201;
241	237		(2) engage in threat neutralization as necessary and
242	238		appropriate, including removing malware, disallowing unauthorized
243	239		access, and patching vulnerabilities in information resources
244	240		technologies;
245	241		(3) in collaboration with the digital forensics
246	242		laboratory under Section 2063.203, undertake mitigation efforts if
247	243		sensitive personal information is breached during a cybersecurity
248	244		incident;
249	245		(4) loan resources to state agencies and covered
250	246		entities to promote continuity of operations while the agency or
251	247		entity restores the systems affected by a cybersecurity incident;
252	248		(5) assist in the restoration of information resources
253	249		and information resources technologies after a cybersecurity
254	250		incident and conduct post-incident monitoring;
255	251		(6) in collaboration with the cybersecurity threat
256	252		intelligence center under Section 2063.201 and digital forensics
257	253		laboratory under Section 2063.203, identify weaknesses, establish
258	254		risk mitigation options and effective vulnerability-reduction
259	255		strategies, and make recommendations to state agencies and covered
260	256		entities that have been the target of a cybersecurity attack or have
261	257		experienced a cybersecurity incident in order to remediate
262	258		identified cybersecurity vulnerabilities;
263	259		(7) in collaboration with the cybersecurity threat
264	260		intelligence center under Section 2063.201, the digital forensics
265	261		laboratory under Section 2063.203, the Texas Division of Emergency
266	262		Management, and other state agencies, conduct, support, and
267	263		participate in cyber-related exercises; and
268	264		(8) undertake any other activities necessary to carry
269	265		out the duties described by this subsection.
270	266		(b) The chief shall employ a director for the cybersecurity
271	267		incident response unit.
272	268		Sec. 2063.203. DIGITAL FORENSICS LABORATORY. (a) The
273	269		command shall establish a digital forensics laboratory to:
274	270		(1) in collaboration with the cybersecurity incident
275	271		response unit under Section 2063.202, develop procedures to:
276	272		(A) preserve evidence of a cybersecurity
277	273		incident, including logs and communication;
278	274		(B) document chains of custody; and
279	275		(C) timely notify and maintain contact with the
280	276		appropriate law enforcement agencies investigating a cybersecurity
281	277		incident;
282	278		(2) develop and share with relevant state agencies and
283	279		covered entities cyber threat hunting tools and procedures to
284	280		assist in identifying indicators of a compromise in the
285	281		cybersecurity of state information systems and non-state
286	282		information systems, as appropriate, for proactive discovery of
287	283		latent intrusions;
288	284		(3) conduct analyses of causes of cybersecurity
289	285		incidents and of remediation options;
290	286		(4) conduct assessments of the scope of harm caused by
291	287		cybersecurity incidents, including data loss, compromised systems,
292	288		and system disruptions;
293	289		(5) provide information and training to state agencies
294	290		and covered entities on producing reports required by regulatory
295	291		and auditing bodies;
296	292		(6) in collaboration with the Department of Public
297	293		Safety, the Texas Military Department, the office of the attorney
298	294		general, and other state agencies, provide forensic analysis of a
299	295		cybersecurity incident to support an investigation, attribution
300	296		process, or other law enforcement or judicial action; and
301	297		(7) undertake any other activities necessary to carry
302	298		out the duties described by this subsection.
303	299		(b) The chief shall employ a director for the digital
304	300		forensics laboratory.
305	301		Sec. 2063.205. POLICIES. The command shall adopt policies
306	302		and procedures necessary to enable the entities established in this
307	303		subchapter to carry out their respective duties and purposes.
308	304		SUBCHAPTER E. CYBERSECURITY PREPARATION AND PLANNING
309	305		Sec. 2063.404. ONGOING INFORMATION TRANSMISSIONS.
310	306		Information received from state agencies by the department under
311	307		Section 2054.069 shall be transmitted by the department to the
312	308		command on an ongoing basis.
313	309		SECTION 2. Section 2054.510, Government Code, is
314	310		transferred to Subchapter A, Chapter 2063, Government Code, as
315	311		added by this Act, redesignated as Section 2063.0025, Government
316	312		Code, and amended to read as follows:
317	313		Sec. 2063.0025 [2054.510]. COMMAND CHIEF [INFORMATION
318	314		SECURITY OFFICER]. (a) In this section, "state cybersecurity
319	315		[information security] program" means the policies, standards,
320	316		procedures, elements, structure, strategies, objectives, plans,
321	317		metrics, reports, services, and resources that establish the
322	318		cybersecurity [information resources security] function for this
323	319		state.
324	320		(b) The chief directs the day-to-day operations and
325	321		policies of the command and oversees and is responsible for all
326	322		functions and duties of the command. [The executive director,
327	323		using existing funds, shall employ a chief information security
328	324		officer.]
329	325		(c) The chief [information security officer] shall oversee
330	326		cybersecurity matters for this state including:
331	327		(1) implementing the duties described by Section
332	328		2063.004 [2054.059];
333	329		(2) [responding to reports received under Section
334	330		2054.1125;
335	331		[(3)] developing a statewide cybersecurity
336	332		[information security] framework;
337	333		(3) [(4)] overseeing the development of cybersecurity
338	334		[statewide information security] policies and standards;
339	335		(4) [(5)] collaborating with [state agencies, local]
340	336		governmental entities[,] and other entities operating or
341	337		exercising control over state information systems or
342	338		state-controlled data critical to strengthen this state's
343	339		cybersecurity and information security policies, standards, and
344	340		guidelines;
345	341		(5) [(6)] overseeing the implementation of the
346	342		policies, standards, and requirements [guidelines] developed under
347	343		this chapter [Subdivisions (3) and (4)];
348	344		(6) [(7)] providing cybersecurity [information
349	345		security] leadership, strategic direction, and coordination for
350	346		the state cybersecurity [information security] program;
351	347		(7) [(8)] providing strategic direction to:
352	348		(A) the network security center established
353	349		under Section 2059.101; and
354	350		(B) regional security operations [statewide
355	351		technology] centers operated under Subchapter G [L]; and
356	352		(8) [(9)] overseeing the preparation and submission
357	353		of the report described by Section 2063.301 [2054.0591].
358	354		SECTION 3. Section 2054.0592, Government Code, is
359	355		transferred to Subchapter A, Chapter 2063, Government Code, as
360	356		added by this Act, redesignated as Section 2063.006, Government
361	357		Code, and amended to read as follows:
362	358		Sec. 2063.006 [2054.0592]. CYBERSECURITY EMERGENCY
363	359		FUNDING. If a cybersecurity event creates a need for emergency
364	360		funding, the command [department] may request that the governor or
365	361		Legislative Budget Board make a proposal under Chapter 317 to
366	362		provide funding to manage the operational and financial impacts
367	363		from the cybersecurity event.
368	364		SECTION 4. Section 2054.519, Government Code, is
369	365		transferred to Subchapter B, Chapter 2063, Government Code, as
370	366		added by this Act, redesignated as Section 2063.102, Government
371	367		Code, and amended to read as follows:
372	368		Sec. 2063.102 [2054.519]. STATE CERTIFIED CYBERSECURITY
373	369		TRAINING PROGRAMS. (a) The command [department], in consultation
374	370		with the cybersecurity council established under Section 2063.406
375	371		[2054.512] and industry stakeholders, shall annually:
376	372		(1) certify at least five cybersecurity training
377	373		programs for state and local government employees; and
378	374		(2) update standards for maintenance of certification
379	375		by the cybersecurity training programs under this section.
380	376		(b) To be certified under Subsection (a), a cybersecurity
381	377		training program must:
382	378		(1) focus on forming appropriate cybersecurity
383	379		[information security] habits and procedures that protect
384	380		information resources; and
385	381		(2) teach best practices and minimum standards
386	382		established under this subchapter [for detecting, assessing,
387	383		reporting, and addressing information security threats].
388	384		(c) The command [department] may identify and certify under
389	385		Subsection (a) training programs provided by state agencies and
390	386		local governments that satisfy the training requirements described
391	387		by Subsection (b).
392	388		(d) The command [department] may contract with an
393	389		independent third party to certify cybersecurity training programs
394	390		under this section.
395	391		(e) The command [department] shall annually publish on the
396	392		command's [department's] Internet website the list of cybersecurity
397	393		training programs certified under this section.
398	394		SECTION 5. Section 2054.5191, Government Code, is
399	395		transferred to Subchapter B, Chapter 2063, Government Code, as
400	396		added by this Act, redesignated as Section 2063.103, Government
401	397		Code, and amended to read as follows:
402	398		Sec. 2063.103 [2054.5191]. CYBERSECURITY TRAINING REQUIRED
403	399		[: CERTAIN EMPLOYEES AND OFFICIALS]. (a) Each elected or appointed
404	400		official and employee of a governmental entity who has access to the
405	401		entity's information resources or information resources
406	402		technologies [state agency shall identify state employees who use a
407	403		computer to complete at least 25 percent of the employee's required
408	404		duties. At least once each year, an employee identified by the
409	405		state agency and each elected or appointed officer of the agency]
410	406		shall annually complete a cybersecurity training program certified
411	407		under Section 2063.102 [2054.519].
412	408		(b) [(a-1) At least once each year, a local government
413	409		shall:
414	410		[(1) identify local government employees and elected
415	411		and appointed officials who have access to a local government
416	412		computer system or database and use a computer to perform at least
417	413		25 percent of the employee's or official's required duties; and
418	414		[(2) require the employees and officials identified
419	415		under Subdivision (1) to complete a cybersecurity training program
420	416		certified under Section 2054.519.
421	417		[(a-2)] The governing body of a governmental entity [local
422	418		government] or the governing body's designee may deny access to the
423	419		governmental entity's information resources or information
424	420		resources technologies [local government's computer system or
425	421		database] to an employee or official [individual described by
426	422		Subsection (a-1)(1)] who [the governing body or the governing
427	423		body's designee determines] is noncompliant with the requirements
428	424		of Subsection (a) [(a-1)(2)].
429	425		(c) [(b)] The governing body of a local government may
430	426		select the most appropriate cybersecurity training program
431	427		certified under Section 2063.102 [2054.519] for employees and
432	428		officials of the local government to complete. The governing body
433	429		shall:
434	430		(1) verify and report on the completion of a
435	431		cybersecurity training program by employees and officials of the
436	432		local government to the command [department]; and
437	433		(2) require periodic audits to ensure compliance with
438	434		this section.
439	435		(d) [(c)] A state agency may select the most appropriate
440	436		cybersecurity training program certified under Section 2063.102
441	437		[2054.519] for employees and officials of the state agency. The
442	438		executive head of each state agency shall verify completion of a
443	439		cybersecurity training program by employees and officials of the
444	440		state agency in a manner specified by the command [department].
445	441		(e) [(d)] The executive head of each state agency shall
446	442		periodically require an internal review of the agency to ensure
447	443		compliance with this section.
448	444		(f) [(e)] The command [department] shall develop a form for
449	445		use by governmental entities [state agencies and local governments]
450	446		in verifying completion of cybersecurity training program
451	447		requirements under this section. The form must allow the state
452	448		agency and local government to indicate the percentage of employee
453	449		and official completion.
454	450		(g) [(f)] The requirements of Subsection [Subsections] (a)
455	451		[and (a-1)] do not apply to employees and officials who have been:
456	452		(1) granted military leave;
457	453		(2) granted leave under the federal Family and Medical
458	454		Leave Act of 1993 (29 U.S.C. Section 2601 et seq.);
459	455		(3) granted leave related to a sickness or disability
460	456		covered by workers' compensation benefits, if that employee or
461	457		official no longer has access to the governmental entity's
462	458		information resources or information resources technologies [state
463	459		agency's or local government's database and systems];
464	460		(4) granted any other type of extended leave or
465	461		authorization to work from an alternative work site if that
466	462		employee or official no longer has access to the governmental
467	463		entity's information resources or information resources
468	464		technologies [state agency's or local government's database and
469	465		systems]; or
470	466		(5) denied access to a governmental entity's
471	467		information resources or information resources technologies [local
472	468		government's computer system or database by the governing body of
473	469		the local government or the governing body's designee] under
474	470		Subsection (b) [(a-2)] for noncompliance with the requirements of
475	471		Subsection (a) [(a-1)(2)].
476	472		SECTION 6. Section 2054.5192, Government Code, is
477	473		transferred to Subchapter B, Chapter 2063, Government Code, as
478	474		added by this Act, redesignated as Section 2063.104, Government
479	475		Code, and amended to read as follows:
480	476		Sec. 2063.104 [2054.5192]. CYBERSECURITY TRAINING
481	477		REQUIRED: CERTAIN STATE CONTRACTORS. (a) In this section,
482	478		"contractor" includes a subcontractor, officer, or employee of the
483	479		contractor.
484	480		(b) A state agency shall require any contractor who has
485	481		access to a state computer system or database to complete a
486	482		cybersecurity training program certified under Section 2063.102
487	483		[2054.519] as selected by the agency.
488	484		(c) The cybersecurity training program must be completed by
489	485		a contractor during the term of the contract and during any renewal
490	486		period.
491	487		(d) Required completion of a cybersecurity training program
492	488		must be included in the terms of a contract awarded by a state
493	489		agency to a contractor.
494	490		(e) A contractor required to complete a cybersecurity
495	491		training program under this section shall verify completion of the
496	492		program to the contracting state agency. The person who oversees
497	493		contract management for the agency shall:
498	494		(1) not later than August 31 of each year, report the
499	495		contractor's completion to the command [department]; and
500	496		(2) periodically review agency contracts to ensure
501	497		compliance with this section.
502	498		SECTION 7. Section 2054.0594, Government Code, is
503	499		transferred to Subchapter C, Chapter 2063, Government Code, as
504	500		added by this Act, redesignated as Section 2063.204, Government
505	501		Code, and amended to read as follows:
506	502		Sec. 2063.204 [2054.0594]. INFORMATION SHARING AND
507	503		ANALYSIS ORGANIZATION. (a) The command [department] shall
508	504		establish at least one [an] information sharing and analysis
509	505		organization to provide a forum for state agencies, local
510	506		governments, public and private institutions of higher education,
511	507		and the private sector to share information regarding cybersecurity
512	508		threats, best practices, and remediation strategies.
513	509		(b) [The department shall provide administrative support to
514	510		the information sharing and analysis organization.
515	511		[(c)] A participant in the information sharing and analysis
516	512		organization shall assert any exception available under state or
517	513		federal law, including Section 552.139, in response to a request
518	514		for public disclosure of information shared through the
519	515		organization. Section 552.007 does not apply to information
520	516		described by this subsection.
521	517		(c) [(d)] The command [department] shall establish a
522	518		framework for regional cybersecurity task forces [working groups]
523	519		to execute mutual aid agreements that allow state agencies, local
524	520		governments, regional planning commissions, public and private
525	521		institutions of higher education, the private sector, the regional
526	522		security operations centers under Subchapter G, and the
527	523		cybersecurity incident response unit under Section 2063.202 [and
528	524		the incident response team established under Subchapter N-2] to
529	525		assist with responding to a cybersecurity incident [event] in this
530	526		state. A task force [working group] may be established within the
531	527		geographic area of a regional planning commission established under
532	528		Chapter 391, Local Government Code. The task force [working group]
533	529		may establish a list of available cybersecurity experts and share
534	530		resources to assist in responding to the cybersecurity incident
535	531		[event] and recovery from the incident [event].
536	532		SECTION 8. Chapter 2063, Government Code, as added by this
537	533		Act, is amended by adding Subchapter D, and a heading is added to
538	534		that subchapter to read as follows:
539	535		SUBCHAPTER D. REPORTING
540	536		SECTION 9. Sections 2054.0591, 2054.603, and 2054.077,
541	537		Government Code, are transferred to Subchapter D, Chapter 2063,
542	538		Government Code, as added by this Act, redesignated as Sections
543	539		2063.301, 2063.302, and 2063.303, Government Code, respectively,
544	540		and amended to read as follows:
545	541		Sec. 2063.301 [2054.0591]. CYBERSECURITY REPORT. (a) Not
546	542		later than November 15 of each even-numbered year, the command
547	543		[department] shall submit to the governor, the lieutenant governor,
548	544		the speaker of the house of representatives, and the standing
549	545		committee of each house of the legislature with primary
550	546		jurisdiction over state government operations a report identifying
551	547		preventive and recovery efforts the state can undertake to improve
552	548		cybersecurity in this state. The report must include:
553	549		(1) an assessment of the resources available to
554	550		address the operational and financial impacts of a cybersecurity
555	551		event;
556	552		(2) a review of existing statutes regarding
557	553		cybersecurity and information resources technologies; and
558	554		(3) recommendations for legislative action to
559	555		increase the state's cybersecurity and protect against adverse
560	556		impacts from a cybersecurity incident [event; and
561	557		[(4) an evaluation of a program that provides an
562	558		information security officer to assist small state agencies and
563	559		local governments that are unable to justify hiring a full-time
564	560		information security officer].
565	561		(b) Not later than October 1 of each even-numbered year, the
566	562		command shall submit a report to the Legislative Budget Board that
567	563		prioritizes, for the purpose of receiving funding, state agency
568	564		cybersecurity projects. Each state agency shall coordinate with the
569	565		command to implement this subsection.
570	566		(c) [(b)] The command [department] or a recipient of a
571	567		report under this section may redact or withhold information
572	568		confidential under Chapter 552, including Section 552.139, or other
573	569		state or federal law that is contained in the report in response to
574	570		a request under Chapter 552 without the necessity of requesting a
575	571		decision from the attorney general under Subchapter G, Chapter 552.
576	572		The disclosure of information under this section is not a voluntary
577	573		disclosure for purposes of Section 552.007.
578	574		Sec. 2063.302 [2054.603]. CYBERSECURITY [SECURITY]
579	575		INCIDENT NOTIFICATION BY STATE AGENCY OR LOCAL GOVERNMENT. (a) [In
580	576		this section:
581	577		[(1) "Security incident" means:
582	578		[(A) a breach or suspected breach of system
583	579		security as defined by Section 521.053, Business & Commerce Code;
584	580		and
585	581		[(B) the introduction of ransomware, as defined
586	582		by Section 33.023, Penal Code, into a computer, computer network,
587	583		or computer system.
588	584		[(2) "Sensitive personal information" has the meaning
589	585		assigned by Section 521.002, Business & Commerce Code.
590	586		[(b)] A state agency or local government that owns,
591	587		licenses, or maintains computerized data that includes sensitive
592	588		personal information, confidential information, or information the
593	589		disclosure of which is regulated by law shall, in the event of a
594	590		cybersecurity [security] incident:
595	591		(1) comply with the notification requirements of
596	592		Section 521.053, Business & Commerce Code, to the same extent as a
597	593		person who conducts business in this state;
598	594		(2) not later than 48 hours after the discovery of the
599	595		cybersecurity [security] incident, notify:
600	596		(A) the command [department], including the
601	597		chief [information security officer]; or
602	598		(B) if the cybersecurity [security] incident
603	599		involves election data, the secretary of state; and
604	600		(3) comply with all command [department] rules
605	601		relating to reporting cybersecurity [security] incidents as
606	602		required by this section.
607	603		(b) [(c)] Not later than the 10th business day after the
608	604		date of the eradication, closure, and recovery from a cybersecurity
609	605		[security] incident, a state agency or local government shall
610	606		notify the command [department], including the chief [information
611	607		security officer], of the details of the cybersecurity [security]
612	608		incident and include in the notification an analysis of the cause of
613	609		the cybersecurity [security] incident.
614	610		(c) [(d)] This section does not apply to a cybersecurity
615	611		[security] incident that a local government is required to report
616	612		to an independent organization certified by the Public Utility
617	613		Commission of Texas under Section 39.151, Utilities Code.
618	614		Sec. 2063.303 [2054.077]. VULNERABILITY REPORTS. (a) In
619	615		this section, a term defined by Section 33.01, Penal Code, has the
620	616		meaning assigned by that section.
621	617		(b) The information security officer of a state agency shall
622	618		prepare or have prepared a report, including an executive summary
623	619		of the findings of the biennial report, not later than June 1 of
624	620		each even-numbered year, assessing the extent to which a computer,
625	621		a computer program, a computer network, a computer system, a
626	622		printer, an interface to a computer system, including mobile and
627	623		peripheral devices, computer software, or data processing of the
628	624		agency or of a contractor of the agency is vulnerable to
629	625		unauthorized access or harm, including the extent to which the
630	626		agency's or contractor's electronically stored information is
631	627		vulnerable to alteration, damage, erasure, or inappropriate use.
632	628		(c) Except as provided by this section, a vulnerability
633	629		report and any information or communication prepared or maintained
634	630		for use in the preparation of a vulnerability report is
635	631		confidential and is not subject to disclosure under Chapter 552.
636	632		(d) The information security officer shall provide an
637	633		electronic copy of the vulnerability report on its completion to:
638	634		(1) the command [department];
639	635		(2) the state auditor;
640	636		(3) the agency's executive director;
641	637		(4) the agency's designated information resources
642	638		manager; and
643	639		(5) any other information technology security
644	640		oversight group specifically authorized by the legislature to
645	641		receive the report.
646	642		(e) Separate from the executive summary described by
647	643		Subsection (b), a state agency shall prepare a summary of the
648	644		agency's vulnerability report that does not contain any information
649	645		the release of which might compromise the security of the state
650	646		agency's or state agency contractor's computers, computer programs,
651	647		computer networks, computer systems, printers, interfaces to
652	648		computer systems, including mobile and peripheral devices,
653	649		computer software, data processing, or electronically stored
654	650		information. [The summary is available to the public on request.]
655	651		SECTION 10. Section 2054.136, Government Code, is
656	652		transferred to Subchapter E, Chapter 2063, Government Code, as
657	653		added by this Act, redesignated as Section 2063.401, Government
658	654		Code, and amended to read as follows:
659	655		Sec. 2063.401 [2054.136]. DESIGNATED INFORMATION SECURITY
660	656		OFFICER. Each state agency shall designate an information security
661	657		officer who:
662	658		(1) reports to the agency's executive-level
663	659		management;
664	660		(2) has authority over information security for the
665	661		entire agency;
666	662		(3) possesses the training and experience required to
667	663		ensure the agency complies with requirements and policies
668	664		established by the command [perform the duties required by
669	665		department rules]; and
670	666		(4) to the extent feasible, has information security
671	667		duties as the officer's primary duties.
672	668		SECTION 11. Section 2054.518, Government Code, is
673	669		transferred to Subchapter E, Chapter 2063, Government Code, as
674	670		added by this Act, redesignated as Section 2063.402, Government
675	671		Code, and amended to read as follows:
676	672		Sec. 2063.402 [2054.518]. CYBERSECURITY RISKS AND
677	673		INCIDENTS. (a) The command [department] shall develop a plan to
678	674		address cybersecurity risks and incidents in this state. The
679	675		command [department] may enter into an agreement with a national
680	676		organization, including the National Cybersecurity Preparedness
681	677		Consortium, to support the command's [department's] efforts in
682	678		implementing the components of the plan for which the command
683	679		[department] lacks resources to address internally. The agreement
684	680		may include provisions for:
685	681		(1) providing technical assistance services to
686	682		support preparedness for and response to cybersecurity risks and
687	683		incidents;
688	684		(2) conducting cybersecurity simulation exercises for
689	685		state agencies to encourage coordination in defending against and
690	686		responding to cybersecurity risks and incidents;
691	687		(3) assisting state agencies in developing
692	688		cybersecurity information-sharing programs to disseminate
693	689		information related to cybersecurity risks and incidents; and
694	690		(4) incorporating cybersecurity risk and incident
695	691		prevention and response methods into existing state emergency
696	692		plans, including continuity of operation plans and incident
697	693		response plans.
698	694		(b) In implementing the provisions of the agreement
699	695		prescribed by Subsection (a), the command [department] shall seek
700	696		to prevent unnecessary duplication of existing programs or efforts
701	697		of the command [department] or another state agency.
702	698		(c) [(d)] The command [department] shall consult with
703	699		institutions of higher education in this state when appropriate
704	700		based on an institution's expertise in addressing specific
705	701		cybersecurity risks and incidents.
706	702		SECTION 12. Section 2054.133, Government Code, is
707	703		transferred to Subchapter E, Chapter 2063, Government Code, as
708	704		added by this Act, redesignated as Section 2063.403, Government
709	705		Code, and amended to read as follows:
710	706		Sec. 2063.403 [2054.133]. INFORMATION SECURITY PLAN. (a)
711	707		Each state agency shall develop, and periodically update, an
712	708		information security plan for protecting the security of the
713	709		agency's information.
714	710		(b) In developing the plan, the state agency shall:
715	711		(1) consider any vulnerability report prepared under
716	712		Section 2063.303 [2054.077] for the agency;
717	713		(2) incorporate the network security services
718	714		provided by the department to the agency under Chapter 2059;
719	715		(3) identify and define the responsibilities of agency
720	716		staff who produce, access, use, or serve as custodians of the
721	717		agency's information;
722	718		(4) identify risk management and other measures taken
723	719		to protect the agency's information from unauthorized access,
724	720		disclosure, modification, or destruction;
725	721		(5) include:
726	722		(A) the best practices for information security
727	723		developed by the command [department]; or
728	724		(B) if best practices are not applied, a written
729	725		explanation of why the best practices are not sufficient for the
730	726		agency's security; and
731	727		(6) omit from any written copies of the plan
732	728		information that could expose vulnerabilities in the agency's
733	729		network or online systems.
734	730		(c) Not later than June 1 of each even-numbered year, each
735	731		state agency shall submit a copy of the agency's information
736	732		security plan to the command [department]. Subject to available
737	733		resources, the command [department] may select a portion of the
738	734		submitted security plans to be assessed by the command [department]
739	735		in accordance with command policies [department rules].
740	736		(d) Each state agency's information security plan is
741	737		confidential and exempt from disclosure under Chapter 552.
742	738		(e) Each state agency shall include in the agency's
743	739		information security plan a written document that is signed by the
744	740		head of the agency, the chief financial officer, and each executive
745	741		manager designated by the state agency and states that those
746	742		persons have been made aware of the risks revealed during the
747	743		preparation of the agency's information security plan.
748	744		(f) Not later than November 15 of each even-numbered year,
749	745		the command [department] shall submit a written report to the
750	746		governor, the lieutenant governor, the speaker of the house of
751	747		representatives, and each standing committee of the legislature
752	748		with primary jurisdiction over matters related to the command
753	749		[department] evaluating information security for this state's
754	750		information resources. In preparing the report, the command
755	751		[department] shall consider the information security plans
756	752		submitted by state agencies under this section, any vulnerability
757	753		reports submitted under Section 2063.303 [2054.077], and other
758	754		available information regarding the security of this state's
759	755		information resources. The command [department] shall omit from
760	756		any written copies of the report information that could expose
761	757		specific vulnerabilities [in the security of this state's
762	758		information resources].
763	759		SECTION 13. Section 2054.516, Government Code, is
764	760		transferred to Subchapter E, Chapter 2063, Government Code, as
765	761		added by this Act, redesignated as Section 2063.405, Government
766	762		Code, and amended to read as follows:
767	763		Sec. 2063.405 [2054.516]. DATA SECURITY PLAN FOR ONLINE
768	764		AND MOBILE APPLICATIONS. (a) Each state agency implementing an
769	765		Internet website or mobile application that processes any sensitive
770	766		personal or personally identifiable information or confidential
771	767		information must:
772	768		(1) submit a biennial data security plan to the
773	769		command [department] not later than June 1 of each even-numbered
774	770		year to establish planned beta testing for the website or
775	771		application; and
776	772		(2) subject the website or application to a
777	773		vulnerability and penetration test and address any vulnerability
778	774		identified in the test.
779	775		(b) The command [department] shall review each data
780	776		security plan submitted under Subsection (a) and make any
781	777		recommendations for changes to the plan to the state agency as soon
782	778		as practicable after the command [department] reviews the plan.
783	779		SECTION 14. Section 2054.512, Government Code, is
784	780		transferred to Subchapter E, Chapter 2063, Government Code, as
785	781		added by this Act, redesignated as Section 2063.406, Government
786	782		Code, and amended to read as follows:
787	783		Sec. 2063.406 [2054.512]. CYBERSECURITY COUNCIL. (a) The
788	784		chief or the chief's designee [state cybersecurity coordinator]
789	785		shall [establish and] lead a cybersecurity council that includes
790	786		public and private sector leaders and cybersecurity practitioners
791	787		to collaborate on matters of cybersecurity concerning this state.
792	788		(b) The cybersecurity council must include:
793	789		(1) one member who is an employee of the office of the
794	790		governor;
795	791		(2) one member of the senate appointed by the
796	792		lieutenant governor;
797	793		(3) one member of the house of representatives
798	794		appointed by the speaker of the house of representatives;
799		-	(4) the director of [one member who is an employee of]
800		-	the Elections Division of the Office of the Secretary of State;
801		-	[and]
	795	+	(4) one member who is an employee of the Elections
	796	+	Division of the Office of the Secretary of State; [and]
802	797		(5) one member who is an employee of the department;
803	798		and
804	799		(6) additional members appointed by the chief [state
805	800		cybersecurity coordinator], including representatives of
806	801		institutions of higher education and private sector leaders.
807	802		(c) Members of the cybersecurity council serve staggered
808	803		six-year terms, with as near as possible to one-third of the
809	804		members' terms expiring February 1 of each odd-numbered year.
810	805		(d) In appointing representatives from institutions of
811	806		higher education to the cybersecurity council, the chief [state
812	807		cybersecurity coordinator] shall consider appointing members of
813	808		the Information Technology Council for Higher Education.
814	809		(e) [(d)] The cybersecurity council shall:
815	810		(1) consider the costs and benefits of establishing a
816	811		computer emergency readiness team to address cybersecurity
817	812		incidents [cyber attacks] occurring in this state during routine
818	813		and emergency situations;
819	814		(2) establish criteria and priorities for addressing
820	815		cybersecurity threats to critical state installations;
821	816		(3) consolidate and synthesize best practices to
822	817		assist state agencies in understanding and implementing
823	818		cybersecurity measures that are most beneficial to this state; and
824	819		(4) assess the knowledge, skills, and capabilities of
825	820		the existing information technology and cybersecurity workforce to
826	821		mitigate and respond to cyber threats and develop recommendations
827	822		for addressing immediate workforce deficiencies and ensuring a
828	823		long-term pool of qualified applicants.
829	824		(f) [(e)] The chief, in collaboration with the
830	825		cybersecurity council, shall provide recommendations to the
831	826		legislature on any legislation necessary to implement
832	827		cybersecurity best practices and remediation strategies for this
833	828		state.
834	829		SECTION 15. Section 2054.514, Government Code, is
835	830		transferred to Subchapter E, Chapter 2063, Government Code, as
836	831		added by this Act, redesignated as Section 2063.407, Government
837	832		Code, and amended to read as follows:
838	833		Sec. 2063.407 [2054.514]. RECOMMENDATIONS. The chief
839	834		[state cybersecurity coordinator] may implement any portion, or all
840	835		of the recommendations made by the cybersecurity council under
841	836		Section 2063.406 [Cybersecurity, Education, and Economic
842	837		Development Council under Subchapter N].
843	838		SECTION 16. Subchapter N-2, Chapter 2054, Government Code,
844	839		is transferred to Chapter 2063, Government Code, as added by this
845	840		Act, redesignated as Subchapter F, Chapter 2063, Government Code,
846	841		and amended to read as follows:
847	842		SUBCHAPTER F [N-2]. TEXAS VOLUNTEER INCIDENT RESPONSE TEAM
848	843		Sec. 2063.501 [2054.52001]. DEFINITIONS. In this
849	844		subchapter:
850	845		(1) "Incident response team" means the Texas volunteer
851	846		incident response team established under Section 2063.502
852	847		[2054.52002].
853	848		(2) "Participating entity" means a state agency,
854	849		including an institution of higher education, or a local government
855	850		that receives assistance under this subchapter during a
856	851		cybersecurity incident [event].
857	852		(3) "Volunteer" means an individual who provides rapid
858	853		response assistance during a cybersecurity incident [event] under
859	854		this subchapter.
860	855		Sec. 2063.502 [2054.52002]. ESTABLISHMENT OF TEXAS
861	856		VOLUNTEER INCIDENT RESPONSE TEAM. (a) The command [department]
862	857		shall establish the Texas volunteer incident response team to
863	858		provide rapid response assistance to a participating entity under
864	859		the command's [department's] direction during a cybersecurity
865	860		incident [event].
866	861		(b) The command [department] shall prescribe eligibility
867	862		criteria for participation as a volunteer member of the incident
868	863		response team, including a requirement that each volunteer have
869	864		expertise in addressing cybersecurity incidents [events].
870	865		Sec. 2063.503 [2054.52003]. CONTRACT WITH VOLUNTEERS. The
871	866		command [department] shall enter into a contract with each
872	867		volunteer the command [department] approves to provide rapid
873	868		response assistance under this subchapter. The contract must
874	869		require the volunteer to:
875	870		(1) acknowledge the confidentiality of information
876	871		required by Section 2063.510 [2054.52010];
877	872		(2) protect all confidential information from
878	873		disclosure;
879	874		(3) avoid conflicts of interest that might arise in a
880	875		deployment under this subchapter;
881	876		(4) comply with command [department] security
882	877		policies and procedures regarding information resources
883	878		technologies;
884	879		(5) consent to background screening required by the
885	880		command [department]; and
886	881		(6) attest to the volunteer's satisfaction of any
887	882		eligibility criteria established by the command [department].
888	883		Sec. 2063.504 [2054.52004]. VOLUNTEER QUALIFICATION. (a)
889	884		The command [department] shall require criminal history record
890	885		information for each individual who accepts an invitation to become
891	886		a volunteer.
892	887		(b) The command [department] may request other information
893	888		relevant to the individual's qualification and fitness to serve as
894	889		a volunteer.
895	890		(c) The command [department] has sole discretion to
896	891		determine whether an individual is qualified to serve as a
897	892		volunteer.
898	893		Sec. 2063.505 [2054.52005]. DEPLOYMENT. (a) In response
899	894		to a cybersecurity incident [event] that affects multiple
900	895		participating entities or a declaration by the governor of a state
901	896		of disaster caused by a cybersecurity event, the command
902	897		[department] on request of a participating entity may deploy
903	898		volunteers and provide rapid response assistance under the
904	899		command's [department's] direction and the managed security
905	900		services framework established under Section 2063.204(c)
906	901		[2054.0594(d)] to assist with the incident [event].
907	902		(b) A volunteer may only accept a deployment under this
908	903		subchapter in writing. A volunteer may decline to accept a
909	904		deployment for any reason.
910	905		Sec. 2063.506 [2054.52006]. CYBERSECURITY COUNCIL
911	906		DUTIES. The cybersecurity council established under Section
912	907		2063.406 [2054.512] shall review and make recommendations to the
913	908		command [department] regarding the policies and procedures used by
914	909		the command [department] to implement this subchapter. The command
915	910		[department] may consult with the council to implement and
916	911		administer this subchapter.
917	912		Sec. 2063.507 [2054.52007]. COMMAND [DEPARTMENT] POWERS
918	913		AND DUTIES. (a) The command [department] shall:
919	914		(1) approve the incident response tools the incident
920	915		response team may use in responding to a cybersecurity incident
921	916		[event];
922	917		(2) establish the eligibility criteria an individual
923	918		must meet to become a volunteer;
924	919		(3) develop and publish guidelines for operation of
925	920		the incident response team, including the:
926	921		(A) standards and procedures the command
927	922		[department] uses to determine whether an individual is eligible to
928	923		serve as a volunteer;
929	924		(B) process for an individual to apply for and
930	925		accept incident response team membership;
931	926		(C) requirements for a participating entity to
932	927		receive assistance from the incident response team; and
933	928		(D) process for a participating entity to request
934	929		and obtain the assistance of the incident response team; and
935	930		(4) adopt policies [rules] necessary to implement this
936	931		subchapter.
937	932		(b) The command [department] may require a participating
938	933		entity to enter into a contract as a condition for obtaining
939	934		assistance from the incident response team. [The contract must
940	935		comply with the requirements of Chapters 771 and 791.]
941	936		(c) The command [department] may provide appropriate
942	937		training to prospective and approved volunteers.
943	938		(d) In accordance with state law, the command [department]
944	939		may provide compensation for actual and necessary travel and living
945	940		expenses incurred by a volunteer on a deployment using money
946	941		available for that purpose.
947	942		(e) The command [department] may establish a fee schedule
948	943		for participating entities receiving incident response team
949	944		assistance. The amount of fees collected may not exceed the
950	945		command's [department's] costs to operate the incident response
951	946		team.
952	947		Sec. 2063.508 [2054.52008]. STATUS OF VOLUNTEER;
953	948		LIABILITY. (a) A volunteer is not an agent, employee, or
954	949		independent contractor of this state for any purpose and has no
955	950		authority to obligate this state to a third party.
956	951		(b) This state is not liable to a volunteer for personal
957	952		injury or property damage sustained by the volunteer that arises
958	953		from participation in the incident response team.
959	954		Sec. 2063.509 [2054.52009]. CIVIL LIABILITY. A volunteer
960	955		who in good faith provides professional services in response to a
961	956		cybersecurity incident [event] is not liable for civil damages as a
962	957		result of the volunteer's acts or omissions in providing the
963	958		services, except for wilful and wanton misconduct. This immunity
964	959		is limited to services provided during the time of deployment for a
965	960		cybersecurity incident [event].
966	961		Sec. 2063.510 [2054.52010]. CONFIDENTIAL INFORMATION.
967	962		Information written, produced, collected, assembled, or maintained
968	963		by the command [department], a participating entity, the
969	964		cybersecurity council, or a volunteer in the implementation of this
970	965		subchapter is confidential and not subject to disclosure under
971	966		Chapter 552 if the information:
972	967		(1) contains the contact information for a volunteer;
973	968		(2) identifies or provides a means of identifying a
974	969		person who may, as a result of disclosure of the information, become
975	970		a victim of a cybersecurity incident [event];
976	971		(3) consists of a participating entity's cybersecurity
977	972		plans or cybersecurity-related practices; or
978	973		(4) is obtained from a participating entity or from a
979	974		participating entity's computer system in the course of providing
980	975		assistance under this subchapter.
981	976		SECTION 17. Subchapter E, Chapter 2059, Government Code, is
982	977		transferred to Chapter 2063, Government Code, as added by this Act,
983	978		redesignated as Subchapter G, Chapter 2063, Government Code, and
984	979		amended to read as follows:
985	980		SUBCHAPTER G [E]. REGIONAL [NETWORK] SECURITY OPERATIONS CENTERS
986	981		Sec. 2063.601 [2059.201]. ELIGIBLE PARTICIPATING ENTITIES.
987	982		A state agency or an entity listed in Section 2059.058 is eligible
988	983		to participate in cybersecurity support and network security
989	984		provided by a regional [network] security operations center under
990	985		this subchapter.
991	986		Sec. 2063.602 [2059.202]. ESTABLISHMENT OF REGIONAL
992	987		[NETWORK] SECURITY OPERATIONS CENTERS. (a) Subject to Subsection
993	988		(b), the command [department] may establish regional [network]
994	989		security operations centers, under the command's [department's]
995	990		managed security services framework established by Section
996	991		2063.204(c) [2054.0594(d)], to assist in providing cybersecurity
997	992		support and network security to regional offices or locations for
998	993		state agencies and other eligible entities that elect to
999	994		participate in and receive services through the center.
1000	995		(b) The command [department] may establish more than one
1001	996		regional [network] security operations center only if the command
1002	997		[department] determines the first center established by the command
1003	998		[department] successfully provides to state agencies and other
1004	999		eligible entities the services the center has contracted to
1005	1000		provide.
1006	1001		(c) The command [department] shall enter into an
1007	1002		interagency contract in accordance with Chapter 771 or an
1008	1003		interlocal contract in accordance with Chapter 791, as appropriate,
1009	1004		with an eligible participating entity that elects to participate in
1010	1005		and receive services through a regional [network] security
1011	1006		operations center.
1012	1007		Sec. 2063.603 [2059.203]. REGIONAL [NETWORK] SECURITY
1013	1008		OPERATIONS CENTER LOCATIONS AND PHYSICAL SECURITY. (a) In
1014	1009		creating and operating a regional [network] security operations
1015	1010		center, the command may [department shall] partner with another [a]
1016	1011		university system or institution of higher education as defined by
1017	1012		Section 61.003, Education Code, other than a public junior college.
1018	1013		The system or institution shall:
1019	1014		(1) serve as an education partner with the command
1020	1015		[department] for the regional [network] security operations
1021	1016		center; and
1022	1017		(2) enter into an interagency contract with the
1023	1018		command [department] in accordance with Chapter 771.
1024	1019		(b) In selecting the location for a regional [network]
1025	1020		security operations center, the command [department] shall select a
1026	1021		university system or institution of higher education that has
1027	1022		supportive educational capabilities.
1028	1023		(c) A university system or institution of higher education
1029	1024		selected to serve as a regional [network] security operations
1030	1025		center shall control and monitor all entrances to and critical
1031	1026		areas of the center to prevent unauthorized entry. The system or
1032	1027		institution shall restrict access to the center to only authorized
1033	1028		individuals.
1034	1029		(d) A local law enforcement entity or any entity providing
1035	1030		security for a regional [network] security operations center shall
1036	1031		monitor security alarms at the regional [network] security
1037	1032		operations center subject to the availability of that service.
1038	1033		(e) The command [department] and a university system or
1039	1034		institution of higher education selected to serve as a regional
1040	1035		[network] security operations center shall restrict operational
1041	1036		information to only center personnel, except as provided by Chapter
1042	1037		321.
1043	1038		Sec. 2063.604 [2059.204]. REGIONAL [NETWORK] SECURITY
1044	1039		OPERATIONS CENTERS SERVICES AND SUPPORT. The command [department]
1045	1040		may offer the following managed security services through a
1046	1041		regional [network] security operations center:
1047	1042		(1) real-time cybersecurity [network security]
1048	1043		monitoring to detect and respond to cybersecurity incidents
1049	1044		[network security events] that may jeopardize this state and the
1050	1045		residents of this state;
1051	1046		(2) alerts and guidance for defeating cybersecurity
1052	1047		[network security] threats, including firewall configuration,
1053	1048		installation, management, and monitoring, intelligence gathering,
1054	1049		and protocol analysis;
1055	1050		(3) immediate response to counter unauthorized
1056	1051		[network security] activity that exposes this state and the
1057	1052		residents of this state to risk, including complete intrusion
1058	1053		detection system installation, management, and monitoring for
1059	1054		participating entities;
1060	1055		(4) development, coordination, and execution of
1061	1056		statewide cybersecurity operations to isolate, contain, and
1062	1057		mitigate the impact of cybersecurity [network security] incidents
1063	1058		for participating entities; and
1064	1059		(5) cybersecurity educational services.
1065	1060		Sec. 2063.605 [2059.205]. NETWORK SECURITY GUIDELINES AND
1066	1061		STANDARD OPERATING PROCEDURES. (a) The command [department] shall
1067	1062		adopt and provide to each regional [network] security operations
1068	1063		center appropriate network security guidelines and standard
1069	1064		operating procedures to ensure efficient operation of the center
1070	1065		with a maximum return on the state's investment.
1071	1066		(b) The command [department] shall revise the standard
1072	1067		operating procedures as necessary to confirm network security.
1073	1068		(c) Each eligible participating entity that elects to
1074	1069		participate in a regional [network] security operations center
1075	1070		shall comply with the network security guidelines and standard
1076	1071		operating procedures.
1077	1072		SECTION 18. Section 325.011, Government Code, is amended to
1078	1073		read as follows:
1079	1074		Sec. 325.011. CRITERIA FOR REVIEW. The commission and its
1080	1075		staff shall consider the following criteria in determining whether
1081	1076		a public need exists for the continuation of a state agency or its
1082	1077		advisory committees or for the performance of the functions of the
1083	1078		agency or its advisory committees:
1084	1079		(1) the efficiency and effectiveness with which the
1085	1080		agency or the advisory committee operates;
1086	1081		(2)(A) an identification of the mission, goals, and
1087	1082		objectives intended for the agency or advisory committee and of the
1088	1083		problem or need that the agency or advisory committee was intended
1089	1084		to address; and
1090	1085		(B) the extent to which the mission, goals, and
1091	1086		objectives have been achieved and the problem or need has been
1092	1087		addressed;
1093	1088		(3)(A) an identification of any activities of the
1094	1089		agency in addition to those granted by statute and of the authority
1095	1090		for those activities; and
1096	1091		(B) the extent to which those activities are
1097	1092		needed;
1098	1093		(4) an assessment of authority of the agency relating
1099	1094		to fees, inspections, enforcement, and penalties;
1100	1095		(5) whether less restrictive or alternative methods of
1101	1096		performing any function that the agency performs could adequately
1102	1097		protect or provide service to the public;
1103	1098		(6) the extent to which the jurisdiction of the agency
1104	1099		and the programs administered by the agency overlap or duplicate
1105	1100		those of other agencies, the extent to which the agency coordinates
1106	1101		with those agencies, and the extent to which the programs
1107	1102		administered by the agency can be consolidated with the programs of
1108	1103		other state agencies;
1109	1104		(7) the promptness and effectiveness with which the
1110	1105		agency addresses complaints concerning entities or other persons
1111	1106		affected by the agency, including an assessment of the agency's
1112	1107		administrative hearings process;
1113	1108		(8) an assessment of the agency's rulemaking process
1114	1109		and the extent to which the agency has encouraged participation by
1115	1110		the public in making its rules and decisions and the extent to which
1116	1111		the public participation has resulted in rules that benefit the
1117	1112		public;
1118	1113		(9) the extent to which the agency has complied with:
1119	1114		(A) federal and state laws and applicable rules
1120	1115		regarding equality of employment opportunity and the rights and
1121	1116		privacy of individuals; and
1122	1117		(B) state law and applicable rules of any state
1123	1118		agency regarding purchasing guidelines and programs for
1124	1119		historically underutilized businesses;
1125	1120		(10) the extent to which the agency issues and
1126	1121		enforces rules relating to potential conflicts of interest of its
1127	1122		employees;
1128	1123		(11) the extent to which the agency complies with
1129	1124		Chapters 551 and 552 and follows records management practices that
1130	1125		enable the agency to respond efficiently to requests for public
1131	1126		information;
1132	1127		(12) the effect of federal intervention or loss of
1133	1128		federal funds if the agency is abolished;
1134	1129		(13) the extent to which the purpose and effectiveness
1135	1130		of reporting requirements imposed on the agency justifies the
1136	1131		continuation of the requirement; and
1137	1132		(14) an assessment of the agency's cybersecurity
1138	1133		practices using confidential information available from the
1139	1134		Department of Information Resources, the Texas Cyber Command, or
1140	1135		any other appropriate state agency.
1141	1136		SECTION 19. Section 11.175(h-1), Education Code, is amended
1142	1137		to read as follows:
1143	1138		(h-1) Notwithstanding Section 2063.103 [2054.5191],
1144	1139		Government Code, only the district's cybersecurity coordinator is
1145	1140		required to complete the cybersecurity training under that section
1146	1141		on an annual basis. Any other school district employee required to
1147	1142		complete the cybersecurity training shall complete the training as
1148	1143		determined by the district, in consultation with the district's
1149	1144		cybersecurity coordinator.
1150	1145		SECTION 20. Section 38.307(e), Education Code, is amended
1151	1146		to read as follows:
1152	1147		(e) The agency shall maintain the data collected by the task
1153	1148		force and the work product of the task force in accordance with:
1154	1149		(1) the agency's information security plan under
1155	1150		Section 2063.403 [2054.133], Government Code; and
1156	1151		(2) the agency's records retention schedule under
1157	1152		Section 441.185, Government Code.
1158	1153		SECTION 21. Section 61.003(6), Education Code, is amended
1159	1154		to read as follows:
1160	1155		(6) "Other agency of higher education" means The
1161	1156		University of Texas System, System Administration; The University
1162	1157		of Texas at El Paso Museum; Texas Epidemic Public Health Institute
1163	1158		at The University of Texas Health Science Center at Houston; the
1164	1159		Texas Cyber Command; The Texas A&M University System,
1165	1160		Administrative and General Offices; Texas A&M AgriLife Research;
1166	1161		Texas A&M AgriLife Extension Service; Rodent and Predatory Animal
1167	1162		Control Service (a part of the Texas A&M AgriLife Extension
1168	1163		Service); Texas A&M Engineering Experiment Station (including the
1169	1164		Texas A&M Transportation Institute); Texas A&M Engineering
1170	1165		Extension Service; Texas A&M Forest Service; Texas Division of
1171	1166		Emergency Management; Texas Tech University Museum; Texas State
1172	1167		University System, System Administration; Sam Houston Memorial
1173	1168		Museum; Panhandle-Plains Historical Museum; Cotton Research
1174	1169		Committee of Texas; Texas Water Resources Institute; Texas A&M
1175	1170		Veterinary Medical Diagnostic Laboratory; and any other unit,
1176	1171		division, institution, or agency which shall be so designated by
1177	1172		statute or which may be established to operate as a component part
1178	1173		of any public senior college or university, or which may be so
1179	1174		classified as provided in this chapter.
1180	1175		SECTION 22. Section 65.02(a), Education Code, is amended to
1181	1176		read as follows:
1182	1177		(a) The University of Texas System is composed of the
1183	1178		following institutions and entities:
1184	1179		(1) The University of Texas at Arlington;
1185	1180		(2) The University of Texas at Austin;
1186	1181		(3) The University of Texas at Dallas;
1187	1182		(4) The University of Texas at El Paso;
1188	1183		(5) The University of Texas Permian Basin;
1189	1184		(6) The University of Texas at San Antonio;
1190	1185		(7) The University of Texas Southwestern Medical
1191	1186		Center;
1192	1187		(8) The University of Texas Medical Branch at
1193	1188		Galveston;
1194	1189		(9) The University of Texas Health Science Center at
1195	1190		Houston;
1196	1191		(10) The University of Texas Health Science Center at
1197	1192		San Antonio;
1198	1193		(11) The University of Texas M. D. Anderson Cancer
1199	1194		Center;
1200	1195		(12) Stephen F. Austin State University, a member of
1201	1196		The University of Texas System;
1202	1197		(13) The University of Texas at Tyler; [and]
1203	1198		(14) The University of Texas Rio Grande Valley; and
1204	1199		(15) the Texas Cyber Command (Chapter 2063, Government
1205	1200		Code).
1206	1201		SECTION 23. Sections 772.012(b) and (c), Government Code,
1207	1202		are amended to read as follows:
1208	1203		(b) To apply for a grant under this chapter, a local
1209	1204		government must submit with the grant application a written
1210	1205		certification of the local government's compliance with the
1211	1206		cybersecurity training required by Section 2063.103 [2054.5191].
1212	1207		(c) On a determination by the criminal justice division
1213	1208		established under Section 772.006 that a local government awarded a
1214	1209		grant under this chapter has not complied with the cybersecurity
1215	1210		training required by Section 2063.103 [2054.5191], the local
1216	1211		government shall pay to this state an amount equal to the amount of
1217	1212		the grant award. A local government that is the subject of a
1218	1213		determination described by this subsection is ineligible for
1219	1214		another grant under this chapter until the second anniversary of
1220	1215		the date the local government is determined ineligible.
1221	1216		SECTION 24. Section 2054.0701(c), Government Code, is
1222	1217		amended to read as follows:
1223	1218		(c) A program offered under this section must:
1224	1219		(1) be approved by the Texas Higher Education
1225	1220		Coordinating Board in accordance with Section 61.0512, Education
1226	1221		Code;
1227	1222		(2) develop the knowledge and skills necessary for an
1228	1223		entry-level information technology position in a state agency; and
1229	1224		(3) include a one-year apprenticeship with:
1230	1225		(A) the department;
1231	1226		(B) another relevant state agency;
1232	1227		(C) an organization working on a major
1233	1228		information resources project; or
1234	1229		(D) a regional [network] security operations
1235	1230		center established under Section 2063.602 [2059.202].
1236	1231		SECTION 25. Section 2056.002(b), Government Code, is
1237	1232		amended to read as follows:
1238	1233		(b) The Legislative Budget Board and the governor's office
1239	1234		shall determine the elements required to be included in each
1240	1235		agency's strategic plan. Unless modified by the Legislative Budget
1241	1236		Board and the governor's office, and except as provided by
1242	1237		Subsection (c), a plan must include:
1243	1238		(1) a statement of the mission and goals of the state
1244	1239		agency;
1245	1240		(2) a description of the indicators developed under
1246	1241		this chapter and used to measure the output and outcome of the
1247	1242		agency;
1248	1243		(3) identification of the groups of people served by
1249	1244		the agency, including those having service priorities, or other
1250	1245		service measures established by law, and estimates of changes in
1251	1246		those groups expected during the term of the plan;
1252	1247		(4) an analysis of the use of the agency's resources to
1253	1248		meet the agency's needs, including future needs, and an estimate of
1254	1249		additional resources that may be necessary to meet future needs;
1255	1250		(5) an analysis of expected changes in the services
1256	1251		provided by the agency because of changes in state or federal law;
1257	1252		(6) a description of the means and strategies for
1258	1253		meeting the agency's needs, including future needs, and achieving
1259	1254		the goals established under Section 2056.006 for each area of state
1260	1255		government for which the agency provides services;
1261	1256		(7) a description of the capital improvement needs of
1262	1257		the agency during the term of the plan and a statement, if
1263	1258		appropriate, of the priority of those needs;
1264	1259		(8) identification of each geographic region of this
1265	1260		state, including the Texas-Louisiana border region and the
1266	1261		Texas-Mexico border region, served by the agency, and if
1267	1262		appropriate the agency's means and strategies for serving each
1268	1263		region;
1269	1264		(9) a description of the training of the agency's
1270	1265		contract managers under Section 656.052;
1271	1266		(10) an analysis of the agency's expected expenditures
1272	1267		that relate to federally owned or operated military installations
1273	1268		or facilities, or communities where a federally owned or operated
1274	1269		military installation or facility is located;
1275	1270		(11) an analysis of the strategic use of information
1276	1271		resources as provided by the instructions prepared under Section
1277	1272		2054.095;
1278	1273		(12) a written certification of the agency's
1279	1274		compliance with the cybersecurity training required under Sections
1280	1275		2063.103 [2054.5191] and 2063.104 [2054.5192]; and
1281	1276		(13) other information that may be required.
1282		-	SECTION 26. Section 2054.5181, Government Code, is
1283		-	repealed.
1284		-	SECTION 27. (a) In this section, "department" means the
	1277	+	SECTION 26. (a) In this section, "department" means the
1285	1278		Department of Information Resources.
1286	1279		(b) On the effective date of this Act, the Texas Cyber
1287	1280		Command, organized as provided by Section 2063.002, Government
1288	1281		Code, as added by this Act, is created with the powers and duties
1289	1282		assigned by Chapter 2063, Government Code, as added by this Act.
1290	1283		(b-1) As soon as practicable on or after the effective date
1291	1284		of this Act, the governor shall appoint the chief of the Texas Cyber
1292	1285		Command, as described by Section 2063.0025, Government Code, as
1293	1286		added by this Act.
1294	1287		(c) Notwithstanding Subsection (b) of this section, the
1295	1288		department shall continue to perform duties and exercise powers
1296	1289		under Chapter 2054, Government Code, as that law existed
1297	1290		immediately before the effective date of this Act, until the date
1298	1291		provided by the memorandum of understanding entered into under
1299	1292		Subsection (e) of this section.
1300	1293		(d) Not later than December 31, 2026:
1301	1294		(1) all functions and activities performed by the
1302	1295		department that relate to cybersecurity under Chapter 2063,
1303	1296		Government Code, as added by this Act, are transferred to the Texas
1304	1297		Cyber Command;
1305	1298		(2) all employees of the department who primarily
1306	1299		perform duties related to cybersecurity, including employees who
1307	1300		provide administrative support for those services, under Chapter
1308	1301		2063, Government Code, as added by this Act, become employees of the
1309	1302		Texas Cyber Command, but continue to work in the same physical
1310	1303		location unless moved in accordance with the memorandum of
1311	1304		understanding entered into under Subsection (e) of this section;
1312	1305		(3) a rule or form adopted by the department that
1313	1306		relates to cybersecurity under Chapter 2063, Government Code, as
1314	1307		added by this Act, is a rule or form of the Texas Cyber Command and
1315	1308		remains in effect until changed by the command;
1316	1309		(4) a reference in law to the department that relates
1317	1310		to cybersecurity under Chapter 2063, Government Code, as added by
1318	1311		this Act, means the Texas Cyber Command;
1319	1312		(5) a contract negotiation for a contract specified as
1320	1313		provided by Subdivision (7) of this subsection in the memorandum of
1321	1314		understanding entered into under Subsection (e) of this section or
1322	1315		other proceeding involving the department that is related to
1323	1316		cybersecurity under Chapter 2063, Government Code, as added by this
1324	1317		Act, is transferred without change in status to the Texas Cyber
1325	1318		Command, and the Texas Cyber Command assumes, without a change in
1326	1319		status, the position of the department in a negotiation or
1327	1320		proceeding relating to cybersecurity to which the department is a
1328	1321		party;
1329	1322		(6) all money, leases, rights, and obligations of the
1330	1323		department related to cybersecurity under Chapter 2063, Government
1331	1324		Code, as added by this Act, are transferred to the Texas Cyber
1332	1325		Command;
1333	1326		(7) contracts specified as necessary to accomplish the
1334	1327		goals and duties of the Texas Cyber Command, as established by
1335	1328		Chapter 2063, Government Code, as added by this Act, in the
1336	1329		memorandum of understanding entered into under Subsection (e) of
1337	1330		this section are transferred to the Texas Cyber Command;
1338	1331		(8) all property, including records, in the custody of
1339	1332		the department related to cybersecurity under Chapter 2063,
1340	1333		Government Code, as added by this Act, becomes property of the Texas
1341	1334		Cyber Command, but stays in the same physical location unless moved
1342	1335		in accordance with the specific steps and methods created under
1343	1336		Subsection (e) of this section; and
1344	1337		(9) all funds appropriated by the legislature to the
1345	1338		department for purposes related to cybersecurity, including funds
1346	1339		for providing administrative support, under Chapter 2063,
1347	1340		Government Code, as added by this Act, are transferred to the Texas
1348	1341		Cyber Command.
1349	1342		(e) Not later than January 1, 2026, the department, in
1350	1343		collaboration with the chief of the Texas Cyber Command, and the
1351	1344		board of regents of The University of Texas System shall enter into
1352	1345		a memorandum of understanding relating to the transfer of powers
1353	1346		and duties from the department to the Texas Cyber Command as
1354	1347		provided by this Act. The memorandum must include:
1355	1348		(1) a timetable and specific steps and methods for the
1356	1349		transfer of all powers, duties, obligations, rights, contracts,
1357	1350		leases, records, real or personal property, and unspent and
1358	1351		unobligated appropriations and other funds relating to the
1359	1352		administration of the powers and duties as provided by this Act;
1360	1353		(2) measures to ensure against any unnecessary
1361	1354		disruption to cybersecurity operations during the transfer
1362	1355		process; and
1363	1356		(3) a provision that the terms of any memorandum of
1364	1357		understanding entered into related to the transfer remain in effect
1365	1358		until the transfer is completed.
1366		-	SECTION 28. This Act takes effect September 1, 2025.
	1359	+	SECTION 27. This Act takes effect September 1, 2025.