88R9921 JXC-F
 
  By: Schwertner, King S.B. No. 2013
 
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to access to and the security of certain critical
  infrastructure.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  Section 113.001, Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021, is amended by adding Subdivision (5) to read
  as follows:
               (5)  "Affiliate," with respect to a company entering
  into an agreement in which the critical infrastructure is electric
  grid equipment, has the meaning assigned by the February 1, 2023,
  version of the ERCOT Nodal Protocols.
         SECTION 2.  Section 113.002, Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021, is amended by adding Subsection (c) to read
  as follows:
         (c)  Notwithstanding Subsection (a), a business entity may
  enter into an agreement described by Subsection (a)(1) in which the
  critical infrastructure is electric grid equipment if the business
  entity takes reasonable and necessary actions to ensure that remote
  access or control by the company is mitigated.
         SECTION 3.  Subchapter F, Chapter 411, Government Code, is
  amended by adding Section 411.1183 to read as follows:
         Sec. 411.1183.  ACCESS TO CRIMINAL HISTORY RECORD
  INFORMATION: INDEPENDENT ORGANIZATION CERTIFIED UNDER UTILITIES
  CODE. (a) An independent organization certified under Section
  39.151, Utilities Code, for security reasons is entitled to obtain
  from the department criminal history record information maintained
  by the department that relates to a person who has or is seeking
  employment at or access to the independent organization's systems
  that affect the security of the electric grid.
         (b)  Criminal history information obtained from the
  department may not be released or disclosed except:
               (1)  as needed in protecting the security of the
  electric grid;
               (2)  as authorized by a court order or a federal or
  state law or order; or
               (3)  with the consent of the person who is the subject
  of the criminal history record information.
         SECTION 4.  Section 2274.0101, Government Code, as added by
  Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
  Session, 2021, is amended by amending Subdivision (5) and adding
  Subdivision (6) to read as follows:
               (5)  "Governmental entity" means a state agency, a [or]
  political subdivision, or an independent organization certified
  under Section 39.151, Utilities Code, to perform a function
  described by Section 39.151(a), Utilities Code [of this state].
               (6)  "Affiliate," with respect to a company entering
  into an agreement in which the critical infrastructure is electric
  grid equipment, has the meaning assigned by the February 1, 2023,
  version of the ERCOT Nodal Protocols.
         SECTION 5.  Section 39.151, Utilities Code, is amended by
  adding Subsection (g-7) to read as follows:
         (g-7)  To maintain certification as an independent
  organization under this section, the organization must:
               (1)  identify all employee positions in the
  organization that are critical to the security of the electric
  grid; and
               (2)  before hiring a person for a position described by
  Subdivision (1), obtain from the Department of Public Safety or a
  private vendor all criminal history record information relating to
  the prospective employee.
         SECTION 6.  Subchapter H, Chapter 39, Utilities Code, is
  amended by adding Section 39.360 to read as follows:
         Sec. 39.360.  TRANSACTIONS WITH CERTAIN FOREIGN-OWNED
  COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE.  (a)  In this
  section, "company" and "critical infrastructure" have the meanings
  assigned by Section 113.001, Business & Commerce Code, as added by
  Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
  Session, 2021.
         (b)  An independent organization certified under Section
  39.151 may not register a business entity to operate in the power
  region for which the independent organization is certified unless
  the business entity:
               (1)  attests that the entity complies with Chapter 113,
  Business & Commerce Code, as added by Chapter 975 (S.B. 2116), Acts
  of the 87th Legislature, Regular Session, 2021, including by taking
  reasonable and necessary actions to mitigate remote access to or
  control of the entity's electric grid equipment by a company
  described by Section 113.002(a)(2), Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021;
               (2)  takes reasonable and necessary actions to mitigate
  remote access to or control of the entity's electric grid equipment
  by a country designated under Section 113.003, Business & Commerce
  Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
  Legislature, Regular Session, 2021; and
               (3)  attests that the entity complies with Subdivision
  (2).
         (c)  An independent organization certified under Section
  39.151 shall require as a condition of operating in the region that
  a business entity:
               (1)  report to the independent organization the
  purchase of any critical electric grid equipment from a company
  described by Section 113.002(a)(2), Business & Commerce Code, as
  added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
  Regular Session, 2021; and
               (2)  take reasonable and necessary actions to mitigate
  access to or control of the purchased critical electric grid
  equipment by a company described by Section 113.002(a)(2), Business &
  Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the
  87th Legislature, Regular Session, 2021.
         (d)  Notwithstanding any other law, an independent
  organization certified under Section 39.151 may immediately
  suspend or terminate a company's registration or access to any of
  the independent organization's systems if the independent
  organization has a reasonable suspicion that the company meets any
  of the criteria described by Section 2274.0102(a)(2), Government
  Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
  Legislature, Regular Session, 2021.
         (e)  A contractual provision that limits or contradicts
  Subsection (d) is contrary to public policy and is unenforceable
  and void.
         (f)  An independent organization certified under Section
  39.151 may adopt guidelines or procedures relating to the
  suspension or termination of a company's registration or access to
  any of the independent organization's systems.
         (g)  The commission shall:
               (1)  adopt any rules necessary to administer this
  section or authorize an independent organization to carry out a
  duty imposed by this section; and
               (2)  by rule establish a process to allow a company that
  has been adversely affected by a suspension or termination under
  Subsection (d) to request that the commission review and approve or
  deny the suspension or termination.
         SECTION 7.  The changes made to Chapter 113, Business &
  Commerce Code, and Chapter 2274, Government Code, apply only to a
  contract or agreement entered into on or after the effective date of
  this Act.
         SECTION 8.  It is the intent of the 88th Legislature, Regular
  Session, 2023, that the amendments made by this Act be harmonized
  with another Act of the 88th Legislature, Regular Session, 2023,
  relating to nonsubstantive additions to and corrections in enacted
  codes.
         SECTION 9.  This Act takes effect immediately if it receives
  a vote of two-thirds of all the members elected to each house, as
  provided by Section 39, Article III, Texas Constitution.  If this
  Act does not receive the vote necessary for immediate effect, this
  Act takes effect September 1, 2023.