| 1 | 1 | | 89R5791 BCH-D |
|---|
| 2 | 2 | | By: Menéndez S.B. No. 1686 |
|---|
| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | |
|---|
| 6 | 6 | | |
|---|
| 7 | 7 | | A BILL TO BE ENTITLED |
|---|
| 8 | 8 | | AN ACT |
|---|
| 9 | 9 | | relating to requiring the cybersecurity council to conduct a study |
|---|
| 10 | 10 | | concerning the cybersecurity of school districts. |
|---|
| 11 | 11 | | BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|---|
| 12 | 12 | | SECTION 1. DEFINITION. In this Act, "council" means the |
|---|
| 13 | 13 | | cybersecurity council established under Section 2054.512, |
|---|
| 14 | 14 | | Government Code. |
|---|
| 15 | 15 | | SECTION 2. STUDY CONCERNING CYBERSECURITY OF SCHOOL |
|---|
| 16 | 16 | | DISTRICTS. (a) The council shall conduct a study to determine: |
|---|
| 17 | 17 | | (1) how school districts can improve their ability to |
|---|
| 18 | 18 | | protect against cybersecurity risks and threats; and |
|---|
| 19 | 19 | | (2) how school districts can address rising |
|---|
| 20 | 20 | | cybersecurity costs. |
|---|
| 21 | 21 | | (b) The council may, if necessary and as appropriate, |
|---|
| 22 | 22 | | partner with a nonprofit entity or institution of higher education, |
|---|
| 23 | 23 | | as defined by Section 61.003, Education Code, to conduct the study. |
|---|
| 24 | 24 | | (c) In conducting the study, the council shall consider: |
|---|
| 25 | 25 | | (1) the current best practices used by school |
|---|
| 26 | 26 | | districts for cybersecurity controls for their information systems |
|---|
| 27 | 27 | | to protect against vulnerabilities and to address rising |
|---|
| 28 | 28 | | cybersecurity costs; |
|---|
| 29 | 29 | | (2) barriers or challenges for school districts in |
|---|
| 30 | 30 | | purchasing or acquiring cybersecurity products or services; |
|---|
| 31 | 31 | | (3) the availability of resources school districts |
|---|
| 32 | 32 | | need to respond to and recover from a cybersecurity event; |
|---|
| 33 | 33 | | (4) the impact of cybersecurity incidents that have |
|---|
| 34 | 34 | | affected school districts, including the resulting costs to school |
|---|
| 35 | 35 | | districts; |
|---|
| 36 | 36 | | (5) to the extent possible, any emerging cybersecurity |
|---|
| 37 | 37 | | risks and threats to school districts resulting from the deployment |
|---|
| 38 | 38 | | of new technologies; and |
|---|
| 39 | 39 | | (6) any other issues the council determines would have |
|---|
| 40 | 40 | | a future impact on cybersecurity for school districts. |
|---|
| 41 | 41 | | SECTION 3. REPORT. Not later than September 1, 2026, the |
|---|
| 42 | 42 | | council shall prepare and submit to the governor, the lieutenant |
|---|
| 43 | 43 | | governor, the speaker of the house of representatives, and the |
|---|
| 44 | 44 | | legislature a written report that contains: |
|---|
| 45 | 45 | | (1) the results of the study conducted under Section 2 |
|---|
| 46 | 46 | | of this Act, including the amount of money school districts are |
|---|
| 47 | 47 | | paying for cybersecurity insurance in this state; and |
|---|
| 48 | 48 | | (2) recommendations for best practices and controls |
|---|
| 49 | 49 | | for school districts to implement in order to: |
|---|
| 50 | 50 | | (A) update and protect their information systems |
|---|
| 51 | 51 | | against cybersecurity risks and threats; and |
|---|
| 52 | 52 | | (B) address rising cybersecurity costs. |
|---|
| 53 | 53 | | SECTION 4. EXPIRATION OF ACT. This Act expires September 1, |
|---|
| 54 | 54 | | 2027. |
|---|
| 55 | 55 | | SECTION 5. EFFECTIVE DATE. This Act takes effect |
|---|
| 56 | 56 | | immediately if it receives a vote of two-thirds of all the members |
|---|
| 57 | 57 | | elected to each house, as provided by Section 39, Article III, Texas |
|---|
| 58 | 58 | | Constitution. If this Act does not receive the vote necessary for |
|---|
| 59 | 59 | | immediate effect, this Act takes effect September 1, 2025. |
|---|