By: Paxton S.B. No. 1779

(In the Senate - Filed March 6, 2019; March 18, 2019, read first time and referred to Committee on Business & Commerce; April 24, 2019, reported favorably by the following vote: Yeas 9, Nays 0; April 24, 2019, sent to printer.) Click here to see the committee vote

A BILL TO BE ENTITLED

AN ACT

relating to security for state agency information and information technologies.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Subtitle B, Title 10, Government Code, is amended by adding Chapter 2061, and a heading is added to that chapter to read as follows:

CHAPTER 2061. INFORMATION SECURITY

SECTION 2. Chapter 2061, Government Code, as added by this Act, is amended by adding Subchapter A to read as follows:

SUBCHAPTER A. GENERAL PROVISIONS

Sec. 2061.0001. DEFINITIONS. In this chapter:

(1) "Breach of system security" has the meaning assigned by Section 521.053(a), Business & Commerce Code.

(2) "Computer," "computer network," "computer program," "computer system," and "computer software" have the meanings assigned by Section 33.01, Penal Code.

(3) "Confidential information" means information that is required to be protected from unauthorized disclosure or public release under state or federal law or a legal agreement.

(4) "Cybersecurity" means the measures taken to protect a computer or computer system against unauthorized use or access.

(5) "Data" has the meaning assigned by Section 33.01, Penal Code.

(6) "Department" means the Department of Information Resources.

(7) "Information resources" has the meaning assigned by Section 2054.003.

(8) "Information security" means the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction to maintain the confidentiality, integrity, and availability of the information.

(9) "Risk management" means the process of aligning information resources risk exposure with the organization's risk tolerance by accepting, transferring, or mitigating risk exposures.

(10) "Security incident" means an event that results in the accidental or deliberate unauthorized access, loss, disclosure, disruption, modification, or destruction of information or information resources.

(11) "Sensitive personal information" has the meaning assigned by Section 521.002, Business & Commerce Code.

(12) "State agency" has the meaning assigned by Section 2054.003.

(13) "Vulnerability" means a weakness in a system, application, or network that is subject to exploitation or misuse.

Sec. 2061.0002. GENERAL POWERS OF DEPARTMENT. (a) The department may adopt rules as necessary to implement its responsibilities under this chapter.

(b) The department may require each state agency to report to the department:

(1) each agency's use of information security and cybersecurity technologies;

(2) the effect of those technologies on the duties and functions of the agency;

(3) the costs incurred by the agency in the acquisition and use of those technologies;

(4) the procedures followed in obtaining those technologies; and

(5) other information relating to information security and cybersecurity management that in the judgment of the department should be reported.

(c) At the request of a state agency, the department may provide technical and managerial assistance relating to information security and cybersecurity management and technologies.

(d) The department may report to the governor and to the presiding officer of each house of the legislature any factors that in the opinion of the department are outside the duties of the department but that inhibit or promote effective communication about and the use of information security and cybersecurity in state government.

SECTION 3. Chapter 2061, Government Code, as added by this Act, is amended by adding Subchapter B, and a heading is added to that subchapter to read as follows:

SUBCHAPTER B. GENERAL DUTIES RELATED TO CYBERSECURITY

SECTION 4. Sections 2054.059, 2054.0591, 2054.0592, and 2054.0594, Government Code, are transferred to Subchapter B, Chapter 2061, Government Code, as added by this Act, and redesignated as Sections 2061.0051, 2061.0052, 2061.0053, and 2061.0054, Government Code, respectively, and amended to read as follows:

Sec. 2061.0051 [2054.059]. CYBERSECURITY. From available funds, the department shall:

(1) establish and administer a clearinghouse for information relating to all aspects of protecting the cybersecurity of state agency information;

(2) develop strategies and a framework for:

(A) the securing of cyberinfrastructure by state agencies, including critical infrastructure; and

(B) cybersecurity risk assessment and mitigation planning;

(3) develop and provide training to state agencies on cybersecurity measures and awareness;

(4) provide assistance to state agencies on request regarding the strategies and framework developed under Subdivision (2); and

(5) promote public awareness of cybersecurity issues.

Sec. 2061.0052 [2054.0591]. CYBERSECURITY REPORT. (a) Not later than November 15 of each even-numbered year, the department shall submit to the governor, the lieutenant governor, the speaker of the house of representatives, and the standing committee of each house of the legislature with primary jurisdiction over state government operations a report identifying preventive and recovery efforts the state can undertake to improve cybersecurity in this state. The report must include:

(1) an assessment of the resources available to address the operational and financial impacts of a cybersecurity event;

(2) a review of existing statutes regarding cybersecurity and information resources technologies;

(3) recommendations for legislative action to increase the state's cybersecurity and protect against adverse impacts from a cybersecurity event;

(4) an evaluation of the costs and benefits of cybersecurity insurance; and

(5) an evaluation of tertiary disaster recovery options.

(b) The department or a recipient of a report under this section may redact or withhold information confidential under Chapter 552, including Section 552.139, or other state or federal law that is contained in the report in response to a request under Chapter 552 without the necessity of requesting a decision from the attorney general under Subchapter G, Chapter 552.

Sec. 2061.0053 [2054.0592]. CYBERSECURITY EMERGENCY FUNDING. If a cybersecurity event creates a need for emergency funding, the department may request that the governor or Legislative Budget Board make a proposal under Chapter 317 to provide funding to manage the operational and financial impacts from the cybersecurity event.

Sec. 2061.0054 [2054.0594]. INFORMATION SHARING AND ANALYSIS ORGANIZATION [CENTER]. (a) The department shall establish an information sharing and analysis organization [center] to provide a forum for state agencies, local governments, public and private institutions of higher education, and the private sector to share information regarding cybersecurity threats, best practices, and remediation strategies.

(b) [The department shall appoint persons from appropriate state agencies to serve as representatives to the information sharing and analysis center.

[(c)] The department[, using funds other than funds appropriated to the department in a general appropriations act,] shall provide administrative support to the information sharing and analysis organization [center].

(c) A participant in the information sharing and analysis organization shall assert any exception available under state or federal law, including Section 552.139, in response to a request for public disclosure of information shared through the organization.

(d) A participant described by Subsection (c) may not make a voluntary disclosure under Section 552.007.

SECTION 5. Chapter 2061, Government Code, as added by this Act, is amended by adding Subchapter C, and a heading is added to that subchapter to read as follows:

SUBCHAPTER C. INFORMATION SECURITY OFFICER; INFORMATION SECURITY

TRAINING AND REPORTS

SECTION 6. Section 2054.136, Government Code, is transferred to Subchapter C, Chapter 2061, Government Code, as added by this Act, redesignated as Section 2061.0101, Government Code, and amended to read as follows:

Sec. 2061.0101 [2054.136]. DESIGNATION OF [DESIGNATED] INFORMATION SECURITY OFFICER. (a) Each state agency shall designate an information security officer who:

(1) reports to the agency's executive-level management;

(2) has authority over information security for the entire agency;

(3) possesses the training and experience required to perform the duties required by department rules; and

(4) to the extent feasible, has information security duties as the officer's primary duties.

(b) On the department's approval, two or more state agencies may jointly designate an information security officer under Subsection (a) to serve as the information security officer for each agency.

SECTION 7. Subchapter C, Chapter 2061, Government Code, as added by this Act, is amended by adding Section 2061.0102 to read as follows:

Sec. 2061.0102. INFORMATION SECURITY TRAINING. The department may provide information security training for appointed board members, agency heads, and executive management of state agencies that is consistent with the cybersecurity awareness training provided in Section 2061.0108.

SECTION 8. Section 2054.1125, Government Code, is transferred to Subchapter C, Chapter 2061, Government Code, as added by this Act, redesignated as Section 2061.0103, Government Code, and amended to read as follows:

Sec. 2061.0103 [2054.1125]. SECURITY BREACH NOTIFICATION BY STATE AGENCY. (a) The information security officer of a [In this section:

[(1) "Breach of system security" has the meaning assigned by Section 521.053, Business & Commerce Code.

[(2) "Sensitive personal information" has the meaning assigned by Section 521.002, Business & Commerce Code.

[(b) A] state agency that owns, licenses, or maintains computerized data that includes sensitive personal information, confidential information, or information the disclosure of which is regulated by law shall, in the event of a breach or suspected breach of system security or an unauthorized exposure of that information:

(1) comply with the notification requirements of Section 521.053, Business & Commerce Code, to the same extent as a person who conducts business in this state; and

(2) not later than 48 hours after the discovery of the breach, suspected breach, or unauthorized exposure, notify:

(A) the department, including the chief information security officer [and the state cybersecurity coordinator]; or

(B) if the breach, suspected breach, or unauthorized exposure involves election data, the secretary of state.

(b) Not later than the 10th business day after the date of the eradication, closure, and recovery from a breach, suspected breach, or unauthorized exposure, a state agency shall notify the department, including the chief information security officer, of the details of the event.

SECTION 9. Sections 2054.077, 2054.133, and 2054.515, Government Code, are transferred to Subchapter C, Chapter 2061, Government Code, as added by this Act, redesignated as Sections 2061.0104, 2061.0105, and 2061.0106, Government Code, respectively, and amended to read as follows:

Sec. 2061.0104 [2054.077]. VULNERABILITY REPORTS. (a) [In this section, a term defined by Section 33.01, Penal Code, has the meaning assigned by that section.

[(b)] The information security officer [resources manager] of a state agency shall prepare or have prepared a report, including an executive summary of the findings of the biennial report, not later than October 15 of each even-numbered year, assessing the extent to which a computer, a computer program, a computer network, a computer system, a printer, an interface to a computer system, including mobile and peripheral devices, computer software, or data processing of the agency or of a contractor of the agency is vulnerable to unauthorized access or harm, including the extent to which the agency's or contractor's electronically stored information is vulnerable to alteration, damage, erasure, or inappropriate use.

(b) [(c)] Except as provided by this section, a vulnerability report and any information or communication prepared or maintained for use in the preparation of a vulnerability report is confidential and is not subject to disclosure under Chapter 552.

(c) [(d)] The information security officer of a state agency [resources manager] shall provide an electronic copy of the vulnerability report on its completion to:

(1) the department;

(2) the state auditor;

(3) the agency's executive director; [and]

(4) the agency's designated information resources manager; and

(5) any other information technology security oversight group specifically authorized by the legislature to receive the report.

(d) [(e)] Separate from the executive summary described by Subsection (a) [(b)], the information security officer of a state agency shall prepare a summary of the agency's vulnerability report that does not contain any information the release of which might compromise the security of the state agency's or state agency contractor's computers, computer programs, computer networks, computer systems, printers, interfaces to computer systems, including mobile and peripheral devices, computer software, data processing, or electronically stored information. The summary is available to the public on request.

Sec. 2061.0105 [2054.133]. INFORMATION SECURITY PLAN. (a) Each state agency shall develop, and periodically update, an information security plan for protecting the security of the agency's information.

(b) In developing the plan, the state agency shall:

(1) consider any vulnerability report prepared under Section 2061.0104 [2054.077] for the agency;

(2) incorporate the network security services provided by the department to the agency under Chapter 2059;

(3) identify and define the responsibilities of agency staff who produce, access, use, or serve as custodians of the agency's information;

(4) identify risk management and other measures taken to protect the agency's information from unauthorized access, disclosure, modification, or destruction;

(5) include:

(A) the best practices for information security developed by the department; or

(B) a written explanation of why the best practices are not sufficient for the agency's security; and

(6) omit from any written copies of the plan information that could expose vulnerabilities in the agency's network or online systems.

(c) Not later than October 15 of each even-numbered year, each state agency shall submit a copy of the agency's information security plan to the department. Subject to available resources, the department may select a portion of the submitted security plans to be assessed by the department in accordance with department rules.

(d) Each state agency's information security plan is confidential and exempt from disclosure under Chapter 552.

(e) Each state agency shall include in the agency's information security plan a written document that is signed by [acknowledgment that] the [executive director or other] head of the agency, the chief financial officer, and each executive manager [as] designated by the state agency and that states that those persons have been made aware of the risks revealed during the preparation of the agency's information security plan.

(f) Not later than January 13 of each odd-numbered year, the department shall submit a written report to the governor, the lieutenant governor, and the legislature evaluating information security for this state's information resources. In preparing the report, the department shall consider the information security plans submitted by state agencies under this section, any vulnerability reports submitted under Section 2061.0104 [2054.077], and other available information regarding the security of this state's information resources. The department shall omit from any written copies of the report information that could expose specific vulnerabilities in the security of this state's information resources.

Sec. 2061.0106 [2054.515]. STATE AGENCY INFORMATION SECURITY ASSESSMENT AND REPORT. (a) At least once every two years, each state agency shall conduct an information security assessment of the agency's information resources systems, network systems, digital data storage systems, digital data security measures, and information resources vulnerabilities.

(b) Not later than December 1 of the year in which a state agency conducts the assessment under Subsection (a), the agency shall report the results of the assessment to the department. The[, the] governor, the lieutenant governor, and the speaker of the house of representatives may obtain the report upon request to the department.

(c) The department by rule shall [may] establish the requirements for the information security assessment and report required by this section.

SECTION 10. Section 2054.516, Government Code, as added by Chapters 683 (H.B. 8) and 955 (S.B. 1910), Acts of the 85th Legislature, Regular Session, 2017, is reenacted, transferred to Subchapter C, Chapter 2061, Government Code, as added by this Act, redesignated as Section 2061.0107, Government Code, and amended to read as follows:

Sec. 2061.0107 [2054.516]. DATA SECURITY PLAN FOR ONLINE AND MOBILE APPLICATIONS OF STATE AGENCIES. (a) Each state agency[, other than an institution of higher education subject to Section 2054.517,] implementing an Internet website or mobile application that processes any sensitive [personal] personally identifiable information or confidential information must:

(1) submit a biennial data security plan to the department not later than October 15 of each even-numbered year to establish planned beta testing for the website or application; and

(2) subject the website or application to a vulnerability and penetration test and address any vulnerability identified in the test.

(b) The department shall review each data security plan submitted under Subsection (a) and make any recommendations for changes to the plan to the state agency as soon as practicable after the department reviews the plan.

SECTION 11. Section 2054.135, Government Code, is transferred to Subchapter C, Chapter 2061, Government Code, as added by this Act, and redesignated as Section 2061.0108, Government Code, to read as follows:

Sec. 2061.0108 [2054.135]. DATA USE AGREEMENT. (a) Each state agency shall develop a data use agreement for use by the agency that meets the particular needs of the agency and is consistent with rules adopted by the department that relate to information security standards for state agencies.

(b) A state agency shall update the data use agreement at least biennially, but may update the agreement at any time as necessary to accommodate best practices in data management.

(c) A state agency shall distribute the data use agreement developed under this section, and each update to that agreement, to employees of the agency who handle sensitive information, including financial, medical, personnel, or student data. The employee shall sign the data use agreement distributed and each update to the agreement.

(d) To the extent possible, a state agency shall provide employees described by Subsection (c) with cybersecurity awareness training to coincide with the distribution of:

(1) the data use agreement required under this section; and

(2) each biennial update to that agreement.

SECTION 12. Subchapter C, Chapter 2061, Government Code, as added by this Act, is amended by adding Section 2061.0109 to read as follows:

Sec. 2061.0109. BIENNIAL INFORMATION SECURITY REPORT. Not later than October 15 of each even-numbered year, the information security officer of each state agency shall submit an information security report for the agency. The report must include:

(1) the vulnerability report required under Section 2061.0104;

(2) the information security plan developed under Section 2061.0105;

(3) the information security assessment developed under Section 2061.0106;

(4) the data security plan for online and mobile applications required under Section 2061.0107; and

(5) the recommendations for cybersecurity and information resources and technology security training established under Section 2061.0155.

SECTION 13. Chapter 2061, Government Code, as added by this Act, is amended by adding Subchapter D, and a heading is added to that subchapter to read as follows:

SUBCHAPTER D. STATE CYBERSECURITY AND STATE CYBERSECURITY

COORDINATOR

SECTION 14. Sections 2054.511 and 2054.518, Government Code, are transferred to Subchapter D, Chapter 2061, Government Code, as added by this Act, redesignated as Sections 2061.0151 and 2061.0154, Government Code, respectively, and amended to read as follows:

Sec. 2061.0151 [2054.511]. DESIGNATION OF STATE CYBERSECURITY COORDINATOR. The executive director of the department shall designate an employee of the department as the state cybersecurity coordinator to oversee cybersecurity matters for this state.

Sec. 2061.0154 [2054.518]. CYBERSECURITY RISKS AND INCIDENTS. (a) The department shall develop a plan to address cybersecurity risks and incidents in this state. The department may enter into an agreement with a national organization, including the National Cybersecurity Preparedness Consortium, to support the department's efforts in implementing the components of the plan for which the department lacks resources to address internally. The agreement may include provisions for:

(1) providing fee reimbursement for appropriate industry-recognized certification examinations for and training to state agency personnel [agencies] preparing for and responding to cybersecurity risks and incidents;

(2) developing and maintaining a cybersecurity risks and incidents curriculum using existing programs and models for training state agency personnel [agencies];

(3) delivering to state agency personnel with access to state agency networks routine training related to appropriately protecting and maintaining information technology systems and devices, implementing cybersecurity best practices, and mitigating cybersecurity risks and vulnerabilities;

(4) providing technical assistance services to support preparedness for and response to cybersecurity risks and incidents;

(5) conducting cybersecurity training and simulation exercises for state agency personnel [agencies] to encourage coordination in defending against and responding to cybersecurity risks and incidents;

(6) assisting state agencies in developing cybersecurity information-sharing programs to disseminate information related to cybersecurity risks and incidents; and

(7) incorporating cybersecurity risk and incident prevention and response methods into existing state emergency plans, including continuity of operation plans and incident response plans.

(b) In implementing the provisions of the agreement prescribed by Subsection (a), the department shall seek to prevent unnecessary duplication of existing programs or efforts of the department or another state agency.

(c) In selecting an organization under Subsection (a), the department shall consider the organization's previous experience in conducting cybersecurity training and exercises for state agencies and political subdivisions.

(d) The department shall consult with institutions of higher education in this state when appropriate based on an institution's expertise in addressing specific cybersecurity risks and incidents.

SECTION 15. Sections 2054.512 and 2054.513, Government Code, are transferred to Subchapter D, Chapter 2061, Government Code, as added by this Act, and redesignated as Sections 2061.0152 and 2061.0153, Government Code, respectively, to read as follows:

Sec. 2061.0152 [2054.512]. CYBERSECURITY COUNCIL. (a) The state cybersecurity coordinator shall establish and lead a cybersecurity council that includes public and private sector leaders and cybersecurity practitioners to collaborate on matters of cybersecurity concerning this state.

(b) The cybersecurity council must include:

(1) one member who is an employee of the office of the governor;

(2) one member of the senate appointed by the lieutenant governor;

(3) one member of the house of representatives appointed by the speaker of the house of representatives; and

(4) additional members appointed by the state cybersecurity coordinator, including representatives of institutions of higher education and private sector leaders.

(c) In appointing representatives from institutions of higher education to the cybersecurity council, the state cybersecurity coordinator shall consider appointing members of the Information Technology Council for Higher Education.

(d) The cybersecurity council shall:

(1) consider the costs and benefits of establishing a computer emergency readiness team to address cyber attacks occurring in this state during routine and emergency situations;

(2) establish criteria and priorities for addressing cybersecurity threats to critical state installations;

(3) consolidate and synthesize best practices to assist state agencies in understanding and implementing cybersecurity measures that are most beneficial to this state; and

(4) assess the knowledge, skills, and capabilities of the existing information technology and cybersecurity workforce to mitigate and respond to cyber threats and develop recommendations for addressing immediate workforce deficiencies and ensuring a long-term pool of qualified applicants.

(e) The cybersecurity council shall provide recommendations to the legislature on any legislation necessary to implement cybersecurity best practices and remediation strategies for this state.

Sec. 2061.0153 [2054.513]. CYBERSECURITY APPROVAL SEAL. The state cybersecurity coordinator may establish a voluntary program that recognizes private and public entities functioning with exemplary cybersecurity practices.

SECTION 16. Subchapter D, Chapter 2061, Government Code, as added by this Act, is amended by adding Section 2061.0155 to read as follows:

Sec. 2061.0155. RECOMMENDATIONS FOR CYBERSECURITY AND INFORMATION RESOURCES AND TECHNOLOGY SECURITY TRAINING. The department shall develop recommendations for cybersecurity and information resources and technology security training for state agency personnel and post those recommendations on the department's Internet website.

SECTION 17. Section 815.103, Government Code, is amended by adding Subsection (g) to read as follows:

(g) The retirement system shall comply with cybersecurity and information security standards established by the Department of Information Resources under Chapter 2061.

SECTION 18. Section 825.103, Government Code, is amended by amending Subsection (e) and adding Subsection (e-1) to read as follows:

(e) Except as provided by Subsection (e-1), Chapters 2054, [and] 2055, and 2061 do not apply to the retirement system. The board of trustees shall control all aspects of information technology and associated resources relating to the retirement system, including computer, data management, and telecommunication operations, procurement of hardware, software, and middleware, and telecommunication equipment and systems, location, operation, and replacement of computers, computer systems, and telecommunication systems, data processing, security, disaster recovery, and storage. The Department of Information Resources shall assist the retirement system at the request of the retirement system, and the retirement system may use any service that is available through that department.

(e-1) The retirement system shall comply with cybersecurity and information security standards established by the Department of Information Resources under Chapter 2061.

SECTION 19. The following provisions of the Government Code are repealed:

(1) Section 2054.076(b-1);

(2) Section 2054.514;

(3) Section 2054.517; and

(4) the heading to Subchapter N-1, Chapter 2054.

SECTION 20. (a) As soon as practicable after the effective date of this Act, but not later than August 31, 2020, the Department of Information Resources shall adopt rules necessary to implement the changes in law made by this Act.

(b) A rule adopted by the Department of Information Resources under Chapter 2054, Government Code, related to information security and cybersecurity continues in effect under Chapter 2061, Government Code, as added by this Act.

SECTION 21. To the extent of any conflict, this Act prevails over another Act of the 86th Legislature, Regular Session, 2019, relating to nonsubstantive additions to and corrections in enacted codes.

SECTION 22. This Act takes effect September 1, 2019.

* * * * *