By: Hancock S.B. No. 936

A BILL TO BE ENTITLED

AN ACT

relating to a cybersecurity monitor for certain electric utilities.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Subchapter E, Chapter 36, Utilities Code, is amended by adding Section 36.213 to read as follows:

Sec. 36.213. ADJUSTMENT FOR CYBERSECURITY MONITOR COSTS FOR CERTAIN UTILITIES. (a) This section does not apply to an electric utility that operates solely outside of ERCOT and has not elected to participate in the cybersecurity monitor program under Section 39.1516.

(b) The commission, on its own motion or on the petition of an electric utility, shall allow the electric utility to recover reasonable and necessary costs incurred in connection with activities under Section 39.1516.

SECTION 2. Section 39.002, Utilities Code, is amended to read as follows:

Sec. 39.002. APPLICABILITY. This chapter, other than Sections 39.1516, 39.155, 39.157(e), 39.203, [39.903,] 39.904, 39.9051, 39.9052, and 39.914(e), does not apply to a municipally owned utility or an electric cooperative. Sections 39.157(e), 39.203, and 39.904, however, apply only to a municipally owned utility or an electric cooperative that is offering customer choice. If there is a conflict between the specific provisions of this chapter and any other provisions of this title, except for Chapters 40 and 41, the provisions of this chapter control.

SECTION 3. Subchapter D, Chapter 39, Utilities Code, is amended by adding Section 39.1516 to read as follows:

Sec. 39.1516. CYBERSECURITY MONITOR. (a) In this section, "monitored utility" means:

(1) a transmission and distribution utility;

(2) a corporation described in Section 32.053;

(3) a municipally owned utility or electric cooperative that owns or operates equipment or facilities in the ERCOT power region to transmit electricity at 60 or more kilovolts; or

(4) an electric utility, municipally owned utility, or electric cooperative that operates solely outside the ERCOT power region that has elected to participate under Subsection (d).

(b) The commission and the independent organization certified under Section 39.151 shall contract with an entity selected by the commission to act as the commission's cybersecurity monitor to:

(1) manage a comprehensive cybersecurity outreach program for monitored utilities;

(2) meet regularly with monitored utilities to discuss emerging threats, best business practices, and training opportunities;

(3) review self-assessments by monitored utilities of cybersecurity efforts;

(4) research and develop best business practices regarding cybersecurity; and

(5) report to the commission on monitored utility cybersecurity preparedness.

(c) The independent organization certified under Section 39.151 shall provide to the cybersecurity monitor any access, information, support, and cooperation that the commission determines is necessary for the monitor to perform the functions described by Subsection (b). The independent organization shall use funds from the fee authorized by Section 39.151(e) to pay for the cybersecurity monitor's activities.

(d) An electric utility, municipally owned utility, or electric cooperative that operates solely outside the ERCOT power region may elect to participate in the cybersecurity monitor program or to discontinue participation. The commission shall adopt rules establishing:

(1) procedures for an electric utility, municipally owned utility, or electric cooperative to notify the commission, the independent organization certified under Section 39.151, and the cybersecurity monitor that the utility or cooperative elects to participate or to discontinue participation; and

(2) a mechanism to require an electric utility, municipally owned utility, or electric cooperative that elects to participate to contribute to the costs incurred by the independent organization under this section.

(e) The cybersecurity monitor shall operate under the supervision and oversight of the commission.

(f) The commission shall adopt rules as necessary to implement this section and may enforce the provisions of this section in the manner provided by this title. This section does not grant enforcement authority to the cybersecurity monitor or authorize the commission to delegate the commission's enforcement authority to the cybersecurity monitor. This section does not grant enforcement authority to the commission beyond authority explicitly provided for in this title.

(g) The staff of the cybersecurity monitor may communicate with commission staff about any cybersecurity information without restriction. Commission staff shall maintain the confidentiality of the cybersecurity information. Notwithstanding any other law, commission staff may not disclose information obtained under this section in an open meeting or through a response to a public information request.

(h) Information written, produced, collected, assembled, or maintained under Subsection (b), (c), or (g) is confidential and not subject to disclosure under Chapter 552, Government Code. A governmental body is not required to conduct an open meeting under Chapter 551, Government Code, to deliberate a matter described by Subsection (b), (c), or (g).

SECTION 4. Section 39.402(a), Utilities Code, is amended to read as follows:

(a) Until the date on which an electric utility subject to this subchapter is authorized by the commission to implement customer choice, the rates of the utility shall be regulated under traditional cost of service regulation and the utility is subject to all applicable regulatory authority prescribed by this subtitle and Subtitle A, including Chapters 14, 32, 33, 36, and 37. Until the date on which an electric utility subject to this subchapter implements customer choice, the provisions of this chapter, other than this subchapter, Sections 39.1516, 39.904, and 39.905, and the provisions relating to the duty to obtain a permit from the Texas Commission on Environmental Quality for an electric generating facility and to reduce emissions from an electric generating facility, shall not apply to that utility. That portion of any commission order entered before September 1, 2001, to comply with this subchapter shall be null and void.

SECTION 5. Section 39.452(d), Utilities Code, is amended to read as follows:

(d) Until the date on which an electric utility subject to this subchapter implements customer choice:

(1) the provisions of this chapter do not apply to that electric utility, other than this subchapter, Sections 39.1516, 39.904, and 39.905, the provisions relating to the duty to obtain a permit from the Texas Commission on Environmental Quality for an electric generating facility and to reduce emissions from an electric generating facility, and the provisions of Subchapter G that pertain to the recovery and securitization of hurricane reconstruction costs authorized by Sections 39.458-39.463; and

(2) the electric utility is not subject to a rate freeze and, subject to the limitation provided by Subsection (b), may file for rate changes under Chapter 36 and for approval of one or more of the rate rider mechanisms authorized by Sections 39.454 and 39.455.

SECTION 6. Section 39.502(b), Utilities Code, is amended to read as follows:

(b) Until the date on which an electric utility subject to this subchapter implements customer choice, the provisions of this chapter, other than this subchapter and Sections 39.1516, 39.904, and 39.905, do not apply to that utility.

SECTION 7. Section 39.552(b), Utilities Code, is amended to read as follows:

(b) Until the date on which an electric utility subject to this subchapter implements customer choice, the provisions of this chapter, other than this subchapter and Sections 39.1516, 39.904, and 39.905, do not apply to that utility.

SECTION 8. Section 40.001(b), Utilities Code, is amended to read as follows:

(b) Except as specifically provided in this subsection, Chapter 39 does not apply to a river authority operating a steam generating plant on or before January 1, 1999, or a corporation authorized by Chapter 152, Water Code, or Section 32.053. A river authority operating a steam generating plant on or before January 1, 1999, is subject to Sections 39.051(a)-(c), 39.108, 39.1516, 39.155, 39.157(e), and 39.203.

SECTION 9. Section 40.004, Utilities Code, is amended to read as follows:

Sec. 40.004. JURISDICTION OF COMMISSION. Except as specifically otherwise provided in this chapter, the commission has jurisdiction over municipally owned utilities only for the following purposes:

(1) to regulate wholesale transmission rates and service, including terms of access, to the extent provided by Subchapter A, Chapter 35;

(2) to regulate certification of retail service areas to the extent provided by Chapter 37;

(3) to regulate rates on appeal under Subchapters D and E, Chapter 33, subject to Section 40.051(c);

(4) to establish a code of conduct as provided by Section 39.157(e) applicable to anticompetitive activities and to affiliate activities limited to structurally unbundled affiliates of municipally owned utilities, subject to Section 40.054;

(5) to establish terms and conditions for open access to transmission and distribution facilities for municipally owned utilities providing customer choice, as provided by Section 39.203;

(6) [to require collection of the nonbypassable fee established under Section 39.903(b) and] to administer the renewable energy credits program under Section 39.904(b) and the natural gas energy credits program under Section 39.9044(b); [and]

(7) to require reports of municipally owned utility operations only to the extent necessary to:

(A) enable the commission to determine the aggregate load and energy requirements of the state and the resources available to serve that load; or

(B) enable the commission to determine information relating to market power as provided by Section 39.155; and

(8) to evaluate and monitor the cybersecurity preparedness of a municipally owned utility described by Section 39.1516(a)(3) or (4).

SECTION 10. Section 41.004, Utilities Code, is amended to read as follows:

Sec. 41.004. JURISDICTION OF COMMISSION. Except as specifically provided otherwise in this chapter, the commission has jurisdiction over electric cooperatives only as follows:

(1) to regulate wholesale transmission rates and service, including terms of access, to the extent provided in Subchapter A, Chapter 35;

(2) to regulate certification to the extent provided in Chapter 37;

(3) to establish a code of conduct as provided in Section 39.157(e) subject to Section 41.054;

(4) to establish terms and conditions, but not rates, for open access to distribution facilities for electric cooperatives providing customer choice, as provided in Section 39.203; [and]

(5) to require reports of electric cooperative operations only to the extent necessary to:

(A) ensure the public safety;

(B) enable the commission to satisfy its responsibilities relating to electric cooperatives under this chapter;

(C) enable the commission to determine the aggregate electric load and energy requirements in the state and the resources available to serve that load; or

(D) enable the commission to determine information relating to market power as provided in Section 39.155; and

(6) to evaluate and monitor the cybersecurity preparedness of an electric cooperative described by Section 39.1516(a)(3) or (4).

SECTION 11. To the extent of any conflict, this Act prevails over another Act of the 86th Legislature, Regular Session, 2019, relating to nonsubstantive additions to and corrections in enacted codes.

SECTION 12. This Act takes effect September 1, 2019.