By: Capriglione H.B. No. 3834

A BILL TO BE ENTITLED

AN ACT

relating to the requirement that certain state and local government employees and state contractors complete a cybersecurity training program certified by the Department of Information Resources.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. The heading to Subchapter N-1, Chapter 2054, Government Code, is amended to read as follows:

SUBCHAPTER N-1. [STATE] CYBERSECURITY

SECTION 2. Section 2054.518(a), Government Code, is amended to read as follows:

(a) The department shall develop a plan to address cybersecurity risks and incidents in this state. The department may enter into an agreement with a national organization, including the National Cybersecurity Preparedness Consortium, to support the department's efforts in implementing the components of the plan for which the department lacks resources to address internally. The agreement may include provisions for:

(1) [providing fee reimbursement for appropriate industry-recognized certification examinations for and training to state agencies preparing for and responding to cybersecurity risks and incidents;

[(2) developing and maintaining a cybersecurity risks and incidents curriculum using existing programs and models for training state agencies;

[(3) delivering to state agency personnel with access to state agency networks routine training related to appropriately protecting and maintaining information technology systems and devices, implementing cybersecurity best practices, and mitigating cybersecurity risks and vulnerabilities;

[(4)] providing technical assistance services to support preparedness for and response to cybersecurity risks and incidents;

(2) [(5)] conducting cybersecurity [training and] simulation exercises for state agencies to encourage coordination in defending against and responding to cybersecurity risks and incidents;

(3) [(6)] assisting state agencies in developing cybersecurity information-sharing programs to disseminate information related to cybersecurity risks and incidents; and

(4) [(7)] incorporating cybersecurity risk and incident prevention and response methods into existing state emergency plans, including continuity of operation plans and incident response plans.

SECTION 3. Subchapter N-1, Chapter 2054, Government Code, is amended by adding Sections 2054.519, 2054.5191, and 2054.5192 to read as follows:

Sec. 2054.519. STATE CERTIFIED CYBERSECURITY TRAINING PROGRAMS. (a) The department, in consultation with the cybersecurity council established under Section 2054.512 and industry stakeholders, shall annually:

(1) certify at least five cybersecurity training programs for state and local government employees; and

(2) update standards for maintenance of certification by the cybersecurity training programs under this section.

(b) To be certified under Subsection (a), a cybersecurity training program must include activities, case studies, hypothetical situations, and other methods that:

(1) focus on forming information security habits and procedures that protect information resources; and

(2) teach best practices for detecting, assessing, reporting, and addressing information security threats.

(c) The department may contract with an independent third party to certify cybersecurity training programs under this section.

(d) The department shall annually publish on the department's Internet website the list of cybersecurity training programs certified under this section.

(e) Notwithstanding Subsection (a), a local government that employs a dedicated information resources cybersecurity officer may offer to its employees a cybersecurity training program that satisfies the requirements described by Subsection (b).

Sec. 2054.5191. CYBERSECURITY TRAINING REQUIRED: CERTAIN EMPLOYEES. (a) At least once each year, a state employee that uses a computer to complete at least 25 percent of the employee's required duties shall complete a cybersecurity training program certified under Section 2054.519.

(a-1) At least once each year, a local government employee that uses a computer to complete at least 25 percent of the employee's required duties shall complete a cybersecurity training program certified under Section 2054.519 or offered under Section 2054.519(e).

(b) The governing body of a local government may select the most appropriate cybersecurity training program certified under Section 2054.519 or offered under Section 2054.519(e) for employees of the local government to complete. The governing body shall:

(1) verify and report on the completion of a cybersecurity training program by employees of the local government to the department; and

(2) require periodic audits to ensure compliance with this section.

(c) A state agency may select the most appropriate cybersecurity training program certified under Section 2054.519 for employees of the state agency. The executive head of each state agency shall verify completion of a cybersecurity training program by employees of the state agency in a manner specified by the department.

(d) The executive head of each state agency shall periodically audit the agency to ensure compliance with this section and send the results to the department.

Sec. 2054.5192. CYBERSECURITY TRAINING REQUIRED: CERTAIN STATE CONTRACTORS. (a) In this section, "contractor" includes a subcontractor, officer, or employee of the contractor.

(b) A state agency shall require any contractor who has access to a state computer system or database to complete a cybersecurity training program certified under Section 2054.519 as selected by the agency.

(c) The cybersecurity training program must be completed by a contractor during the term of the contract and during any renewal period.

(d) Required completion of a cybersecurity training program must be included in the terms of a contract awarded by a state agency to a contractor.

(e) A contractor required to complete a cybersecurity training program under this section shall verify completion of the program to the contracting state agency. The agency's contract manager shall:

(1) report the contractor's completion to the department; and

(2) conduct periodic audits to ensure compliance with this section.

SECTION 4. Section 2054.518(c), Government Code, is repealed.

SECTION 5. The changes in law made by this Act apply to a contract entered into or renewed on or after the effective date of this Act. A contract entered into or renewed before the effective date of this Act is governed by the law in effect on the date the contract was entered into or renewed, and the former law is continued in effect for that purpose.

SECTION 6. This Act takes effect immediately if it receives a vote of two-thirds of all the members elected to each house, as provided by Section 39, Article III, Texas Constitution. If this Act does not receive the vote necessary for immediate effect, this Act takes effect September 1, 2019.