88R9921 JXC-F

By: Hunter H.B. No. 4438

A BILL TO BE ENTITLED

AN ACT

relating to access to and the security of certain critical infrastructure.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 113.001, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, is amended by adding Subdivision (5) to read as follows:

(5) "Affiliate," with respect to a company entering into an agreement in which the critical infrastructure is electric grid equipment, has the meaning assigned by the February 1, 2023, version of the ERCOT Nodal Protocols.

SECTION 2. Section 113.002, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, is amended by adding Subsection (c) to read as follows:

(c) Notwithstanding Subsection (a), a business entity may enter into an agreement described by Subsection (a)(1) in which the critical infrastructure is electric grid equipment if the business entity takes reasonable and necessary actions to ensure that remote access or control by the company is mitigated.

SECTION 3. Subchapter F, Chapter 411, Government Code, is amended by adding Section 411.1183 to read as follows:

Sec. 411.1183. ACCESS TO CRIMINAL HISTORY RECORD INFORMATION: INDEPENDENT ORGANIZATION CERTIFIED UNDER UTILITIES CODE. (a) An independent organization certified under Section 39.151, Utilities Code, for security reasons is entitled to obtain from the department criminal history record information maintained by the department that relates to a person who has or is seeking employment at or access to the independent organization's systems that affect the security of the electric grid.

(b) Criminal history information obtained from the department may not be released or disclosed except:

(1) as needed in protecting the security of the electric grid;

(2) as authorized by a court order or a federal or state law or order; or

(3) with the consent of the person who is the subject of the criminal history record information.

SECTION 4. Section 2274.0101, Government Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, is amended by amending Subdivision (5) and adding Subdivision (6) to read as follows:

(5) "Governmental entity" means a state agency, a [or] political subdivision, or an independent organization certified under Section 39.151, Utilities Code, to perform a function described by Section 39.151(a), Utilities Code [of this state].

(6) "Affiliate," with respect to a company entering into an agreement in which the critical infrastructure is electric grid equipment, has the meaning assigned by the February 1, 2023, version of the ERCOT Nodal Protocols.

SECTION 5. Section 39.151, Utilities Code, is amended by adding Subsection (g-7) to read as follows:

(g-7) To maintain certification as an independent organization under this section, the organization must:

(1) identify all employee positions in the organization that are critical to the security of the electric grid; and

(2) before hiring a person for a position described by Subdivision (1), obtain from the Department of Public Safety or a private vendor all criminal history record information relating to the prospective employee.

SECTION 6. Subchapter H, Chapter 39, Utilities Code, is amended by adding Section 39.360 to read as follows:

Sec. 39.360. TRANSACTIONS WITH CERTAIN FOREIGN-OWNED COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE. (a) In this section, "company" and "critical infrastructure" have the meanings assigned by Section 113.001, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(b) An independent organization certified under Section 39.151 may not register a business entity to operate in the power region for which the independent organization is certified unless the business entity:

(1) attests that the entity complies with Chapter 113, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, including by taking reasonable and necessary actions to mitigate remote access to or control of the entity's electric grid equipment by a company described by Section 113.002(a)(2), Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021;

(2) takes reasonable and necessary actions to mitigate remote access to or control of the entity's electric grid equipment by a country designated under Section 113.003, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021; and

(3) attests that the entity complies with Subdivision (2).

(c) An independent organization certified under Section 39.151 shall require as a condition of operating in the region that a business entity:

(1) report to the independent organization the purchase of any critical electric grid equipment from a company described by Section 113.002(a)(2), Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021; and

(2) take reasonable and necessary actions to mitigate access to or control of the purchased critical electric grid equipment by a company described by Section 113.002(a)(2), Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(d) Notwithstanding any other law, an independent organization certified under Section 39.151 may immediately suspend or terminate a company's registration or access to any of the independent organization's systems if the independent organization has a reasonable suspicion that the company meets any of the criteria described by Section 2274.0102(a)(2), Government Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(e) A contractual provision that limits or contradicts Subsection (d) is contrary to public policy and is unenforceable and void.

(f) An independent organization certified under Section 39.151 may adopt guidelines or procedures relating to the suspension or termination of a company's registration or access to any of the independent organization's systems.

(g) The commission shall:

(1) adopt any rules necessary to administer this section or authorize an independent organization to carry out a duty imposed by this section; and

(2) by rule establish a process to allow a company that has been adversely affected by a suspension or termination under Subsection (d) to request that the commission review and approve or deny the suspension or termination.

SECTION 7. The changes made to Chapter 113, Business & Commerce Code, and Chapter 2274, Government Code, apply only to a contract or agreement entered into on or after the effective date of this Act.

SECTION 8. It is the intent of the 88th Legislature, Regular Session, 2023, that the amendments made by this Act be harmonized with another Act of the 88th Legislature, Regular Session, 2023, relating to nonsubstantive additions to and corrections in enacted codes.

SECTION 9. This Act takes effect immediately if it receives a vote of two-thirds of all the members elected to each house, as provided by Section 39, Article III, Texas Constitution. If this Act does not receive the vote necessary for immediate effect, this Act takes effect September 1, 2023.