88R30349 JXC-F
 
  By: Schwertner, et al. S.B. No. 2013
 
  (Hunter)
 
  Substitute the following for S.B. No. 2013:  No.
 
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to access to and the security of certain critical
  infrastructure.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  Section 113.001, Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021, is amended by adding Subdivision (5) to read
  as follows:
               (5)  "Affiliate," with respect to a company entering
  into an agreement in which the critical infrastructure is electric
  grid equipment, has the meaning assigned by the protocols of the
  independent organization certified under Section 39.151, Utilities
  Code, for the ERCOT power region.
         SECTION 2.  Subchapter F, Chapter 411, Government Code, is
  amended by adding Section 411.1183 to read as follows:
         Sec. 411.1183.  ACCESS TO CRIMINAL HISTORY RECORD
  INFORMATION: INDEPENDENT ORGANIZATION CERTIFIED UNDER UTILITIES
  CODE. (a) An independent organization certified under Section
  39.151, Utilities Code, for security reasons is entitled to obtain
  from the department criminal history record information maintained
  by the department that relates to a person who has or is seeking
  employment at or access to the independent organization's systems
  that affect the security of the electric grid or any other
  background information maintained by the department that relates to
  the person that is considered necessary by the independent
  organization or required by the Public Utility Commission.
         (b)  Information obtained from the department under this
  section may not be released or disclosed except:
               (1)  as needed in protecting the security of the
  electric grid;
               (2)  as authorized by a court order or a federal or
  state law or order; or
               (3)  with the consent of the person who is the subject
  of the criminal history record information.
         SECTION 3.  Section 2274.0101, Government Code, as added by
  Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
  Session, 2021, is amended by amending Subdivision (5) and adding
  Subdivision (6) to read as follows:
               (5)  "Governmental entity" means a state agency, a [or]
  political subdivision, or an independent organization certified
  under Section 39.151, Utilities Code, to perform a function
  described by Section 39.151(a), Utilities Code [of this state].
               (6)  "Affiliate," with respect to a company entering
  into an agreement in which the critical infrastructure is electric
  grid equipment, has the meaning assigned by the protocols of the
  independent organization certified under Section 39.151, Utilities
  Code, for the ERCOT power region.
         SECTION 4.  Section 39.151, Utilities Code, is amended by
  adding Subsection (g-7) to read as follows:
         (g-7)  To maintain certification as an independent
  organization under this section, the organization must:
               (1)  identify all employee positions in the
  organization that are critical to the security of the electric
  grid; and
               (2)  before hiring a person for a position described by
  Subdivision (1), obtain from the Department of Public Safety or a
  private vendor criminal history record information relating to the
  prospective employee and any other background information
  considered necessary by the independent organization or required by
  the commission.
         SECTION 5.  Subchapter H, Chapter 39, Utilities Code, is
  amended by adding Section 39.360 to read as follows:
         Sec. 39.360.  TRANSACTIONS WITH CERTAIN FOREIGN-OWNED
  COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE.  (a)  In this
  section, "company" and "critical infrastructure" have the meanings
  assigned by Section 113.001, Business & Commerce Code, as added by
  Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
  Session, 2021.
         (b)  An independent organization certified under Section
  39.151 may not register a business entity or maintain the
  registration of a business entity to operate in the power region for
  which the independent organization is certified unless the business
  entity attests that the entity complies with Chapter 113, Business &
  Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the
  87th Legislature, Regular Session, 2021.
         (c)  An independent organization certified under Section
  39.151 shall require as a condition of operating in the power region
  for which the independent organization is certified that a business
  entity report to the independent organization the purchase of any
  critical electric grid equipment or service from a company
  described by Section 113.002(a)(2), Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021.
         (d)  For each purchase reported by a business entity under
  Subsection (c), the business entity shall submit an attestation to
  the independent organization that the purchase will not result in
  access to or control of its critical electric grid equipment by a
  company described by Section 113.002(a)(2), Business & Commerce
  Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
  Legislature, Regular Session, 2021, excluding access specifically
  allowed by the business entity for product warranty and support
  purposes.
         (e)  Notwithstanding any other law, an independent
  organization certified under Section 39.151 may immediately
  suspend or terminate a company's registration or access to any of
  the independent organization's systems if the independent
  organization has a reasonable suspicion that the company meets any
  of the criteria described by Section 2274.0102(a)(2), Government
  Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
  Legislature, Regular Session, 2021.
         (f)  A contractual provision that limits or contradicts
  Subsection (e) is contrary to public policy and is unenforceable
  and void.
         (g)  An independent organization certified under Section
  39.151 may adopt guidelines or procedures relating to the
  requirements in this section, including the qualification of
  electric grid equipment or services as critical.
         (h)  The commission shall adopt any rules necessary to
  administer this section or authorize an independent organization to
  carry out a duty imposed by this section.
         (i)  The attorney general may conduct periodic audits of the
  attestations required by Subsection (d) and may prioritize the
  audits as necessary to protect critical infrastructure.
         SECTION 6.  The changes made by this Act to Chapter 113,
  Business & Commerce Code, and Chapter 2274, Government Code, apply
  only to a contract or agreement entered into on or after the
  effective date of this Act.
         SECTION 7.  (a)  For the purposes of Section 39.360(c),
  Utilities Code, as added by this Act, a business entity operating in
  a power region on the effective date of this Act shall report to the
  independent organization certified for that power region under
  Section 39.151, Utilities Code, any purchase made within the five
  years preceding the effective date of this Act.
         (b)  For any past purchase reported by a business entity as
  described by Subsection (a) of this section, the business entity
  shall take reasonable and necessary actions to mitigate access to
  or control of its critical electric grid equipment by a company
  described by Section 113.002(a)(2), Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021, excluding access specifically allowed by the
  business entity for product warranty and support purposes, and
  report those actions to the independent organization.
         SECTION 8.  It is the intent of the 88th Legislature, Regular
  Session, 2023, that the amendments made by this Act be harmonized
  with another Act of the 88th Legislature, Regular Session, 2023,
  relating to nonsubstantive additions to and corrections in enacted
  codes.
         SECTION 9.  This Act takes effect immediately if it receives
  a vote of two-thirds of all the members elected to each house, as
  provided by Section 39, Article III, Texas Constitution.  If this
  Act does not receive the vote necessary for immediate effect, this
  Act takes effect September 1, 2023.