88R30349 JXC-F

By: Schwertner, et al. S.B. No. 2013

(Hunter)

Substitute the following for S.B. No. 2013: No.

A BILL TO BE ENTITLED

AN ACT

relating to access to and the security of certain critical infrastructure.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 113.001, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, is amended by adding Subdivision (5) to read as follows:

(5) "Affiliate," with respect to a company entering into an agreement in which the critical infrastructure is electric grid equipment, has the meaning assigned by the protocols of the independent organization certified under Section 39.151, Utilities Code, for the ERCOT power region.

SECTION 2. Subchapter F, Chapter 411, Government Code, is amended by adding Section 411.1183 to read as follows:

Sec. 411.1183. ACCESS TO CRIMINAL HISTORY RECORD INFORMATION: INDEPENDENT ORGANIZATION CERTIFIED UNDER UTILITIES CODE. (a) An independent organization certified under Section 39.151, Utilities Code, for security reasons is entitled to obtain from the department criminal history record information maintained by the department that relates to a person who has or is seeking employment at or access to the independent organization's systems that affect the security of the electric grid or any other background information maintained by the department that relates to the person that is considered necessary by the independent organization or required by the Public Utility Commission.

(b) Information obtained from the department under this section may not be released or disclosed except:

(1) as needed in protecting the security of the electric grid;

(2) as authorized by a court order or a federal or state law or order; or

(3) with the consent of the person who is the subject of the criminal history record information.

SECTION 3. Section 2274.0101, Government Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, is amended by amending Subdivision (5) and adding Subdivision (6) to read as follows:

(5) "Governmental entity" means a state agency, a [or] political subdivision, or an independent organization certified under Section 39.151, Utilities Code, to perform a function described by Section 39.151(a), Utilities Code [of this state].

(6) "Affiliate," with respect to a company entering into an agreement in which the critical infrastructure is electric grid equipment, has the meaning assigned by the protocols of the independent organization certified under Section 39.151, Utilities Code, for the ERCOT power region.

SECTION 4. Section 39.151, Utilities Code, is amended by adding Subsection (g-7) to read as follows:

(g-7) To maintain certification as an independent organization under this section, the organization must:

(1) identify all employee positions in the organization that are critical to the security of the electric grid; and

(2) before hiring a person for a position described by Subdivision (1), obtain from the Department of Public Safety or a private vendor criminal history record information relating to the prospective employee and any other background information considered necessary by the independent organization or required by the commission.

SECTION 5. Subchapter H, Chapter 39, Utilities Code, is amended by adding Section 39.360 to read as follows:

Sec. 39.360. TRANSACTIONS WITH CERTAIN FOREIGN-OWNED COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE. (a) In this section, "company" and "critical infrastructure" have the meanings assigned by Section 113.001, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(b) An independent organization certified under Section 39.151 may not register a business entity or maintain the registration of a business entity to operate in the power region for which the independent organization is certified unless the business entity attests that the entity complies with Chapter 113, Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(c) An independent organization certified under Section 39.151 shall require as a condition of operating in the power region for which the independent organization is certified that a business entity report to the independent organization the purchase of any critical electric grid equipment or service from a company described by Section 113.002(a)(2), Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(d) For each purchase reported by a business entity under Subsection (c), the business entity shall submit an attestation to the independent organization that the purchase will not result in access to or control of its critical electric grid equipment by a company described by Section 113.002(a)(2), Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, excluding access specifically allowed by the business entity for product warranty and support purposes.

(e) Notwithstanding any other law, an independent organization certified under Section 39.151 may immediately suspend or terminate a company's registration or access to any of the independent organization's systems if the independent organization has a reasonable suspicion that the company meets any of the criteria described by Section 2274.0102(a)(2), Government Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021.

(f) A contractual provision that limits or contradicts Subsection (e) is contrary to public policy and is unenforceable and void.

(g) An independent organization certified under Section 39.151 may adopt guidelines or procedures relating to the requirements in this section, including the qualification of electric grid equipment or services as critical.

(h) The commission shall adopt any rules necessary to administer this section or authorize an independent organization to carry out a duty imposed by this section.

(i) The attorney general may conduct periodic audits of the attestations required by Subsection (d) and may prioritize the audits as necessary to protect critical infrastructure.

SECTION 6. The changes made by this Act to Chapter 113, Business & Commerce Code, and Chapter 2274, Government Code, apply only to a contract or agreement entered into on or after the effective date of this Act.

SECTION 7. (a) For the purposes of Section 39.360(c), Utilities Code, as added by this Act, a business entity operating in a power region on the effective date of this Act shall report to the independent organization certified for that power region under Section 39.151, Utilities Code, any purchase made within the five years preceding the effective date of this Act.

(b) For any past purchase reported by a business entity as described by Subsection (a) of this section, the business entity shall take reasonable and necessary actions to mitigate access to or control of its critical electric grid equipment by a company described by Section 113.002(a)(2), Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular Session, 2021, excluding access specifically allowed by the business entity for product warranty and support purposes, and report those actions to the independent organization.

SECTION 8. It is the intent of the 88th Legislature, Regular Session, 2023, that the amendments made by this Act be harmonized with another Act of the 88th Legislature, Regular Session, 2023, relating to nonsubstantive additions to and corrections in enacted codes.

SECTION 9. This Act takes effect immediately if it receives a vote of two-thirds of all the members elected to each house, as provided by Section 39, Article III, Texas Constitution. If this Act does not receive the vote necessary for immediate effect, this Act takes effect September 1, 2023.