By: Harris of Williamson H.B. No. 4023

A BILL TO BE ENTITLED

AN ACT

relating to security procedures for digital applications that pose a network security risk to state agencies.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Chapter 2054, Government Code, is amended by adding Subchapter S to read as follows:

SUBCHAPTER S. DIGITAL APPLICATION SECURITY PROCEDURES

Sec. 2054.621. DEFINITIONS. In this subchapter:

(1) "Digital application" means an Internet website or application that is open to the public, allows a user to create an account, and enables a user to communicate with other users by posting information, comments, messages, images, or video. The term does not include:

(A) an Internet service provider, as defined by Section 324.055, Business & Commerce Code;

(B) e-mail; or

(C) an online service, application, or Internet website:

(i) that consists primarily of news, sports, entertainment, or other content preselected by the provider that is not user generated; and

(ii) for which any chat, comment, or interactive functionality is incidental to, directly related to, or dependent on provision of the content described by Subparagraph (i).

(2) "Network security" has the meaning assigned by Section 2059.001.

(3) "User" means a person who posts, uploads, transmits, shares, or otherwise publishes or receives content through a digital application.

Sec. 2054.622. DIGITAL APPLICATION SECURITY RISK LIST. The department shall:

(1) compile, maintain, and annually update a list of digital applications that create a network security risk to state agencies;

(2) limit or prohibit the placement and use of digital applications on the list under Subdivision (1) on:

(A) state-owned cell phones, computers, and other communication devices; and

(B) personal communication devices of state agency employees that are used in the agency's office or other workplace; and

(3) post the list under Subdivision (1) on a publicly accessible web page on the department's Internet website.

Sec. 2054.623. DIGITAL APPLICATION SECURITY MODEL POLICY FOR STATE AGENCIES. The department shall develop, maintain, and periodically update a model policy for state agencies to use under Section 2054.624 in limiting or prohibiting the placement and use on communication devices of the digital applications included on the list compiled under Section 2054.622.

Sec. 2054.624. STATE AGENCY DIGITAL APPLICATION SECURITY POLICY. (a) Each state agency shall develop, implement, and periodically update a policy limiting or prohibiting the placement and use of digital applications included on the list compiled under Section 2054.622 on:

(1) state-owned cell phones, computers, and other communication devices; and

(2) personal communication devices of state agency employees that are used in the agency's office or other workplace.

(b) Each state agency shall submit to the department a copy of the policy required under Subsection (a) and updates to the policy.

(c) The department:

(1) may offer recommendations for improvements to submitted policies;

(2) shall retain each copy and update submitted under Subsection (b); and

(3) shall notify each member of the legislature and the governor when a state agency submits a policy or update.

Sec. 2054.625. DISCLOSURE EXEMPTION. The model policy and state agency policies developed under this subchapter are exempt from disclosure under Chapter 552.

Sec. 2054.626. RULEMAKING AUTHORITY. The department may adopt rules to implement this subchapter.

SECTION 2. (a) As soon as practicable after the effective date of this Act, but not later than January 1, 2024, the Department of Information Resources shall develop the digital application security risk list and model policy as required by Subchapter S, Chapter 2054, Government Code, as added by this Act.

(b) A state agency is not required to comply with Section 2054.624, Government Code, as added by this Act, until May 1, 2024.

SECTION 3. This Act takes effect September 1, 2023.