| |
| |
|
|
A BILL TO BE ENTITLED
|
|
|
AN ACT
|
|
|
relating to security procedures for digital applications that pose |
|
|
a network security risk to state agencies. |
|
|
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS: |
|
|
SECTION 1. Chapter 2054, Government Code, is amended by |
|
|
adding Subchapter S to read as follows: |
|
|
SUBCHAPTER S. DIGITAL APPLICATION SECURITY PROCEDURES |
|
|
Sec. 2054.621. DEFINITIONS. In this subchapter: |
|
|
(1) "Digital application" means an Internet website or |
|
|
application that is open to the public, allows a user to create an |
|
|
account, and enables a user to communicate with other users by |
|
|
posting information, comments, messages, images, or video. The |
|
|
term does not include: |
|
|
(A) an Internet service provider, as defined by |
|
|
Section 324.055, Business & Commerce Code; |
|
|
(B) e-mail; or |
|
|
(C) an online service, application, or Internet |
|
|
website: |
|
|
(i) that consists primarily of news, |
|
|
sports, entertainment, or other content preselected by the provider |
|
|
that is not user generated; and |
|
|
(ii) for which any chat, comment, or |
|
|
interactive functionality is incidental to, directly related to, or |
|
|
dependent on provision of the content described by Subparagraph |
|
|
(i). |
|
|
(2) "Network security" has the meaning assigned by |
|
|
Section 2059.001. |
|
|
(3) "User" means a person who posts, uploads, |
|
|
transmits, shares, or otherwise publishes or receives content |
|
|
through a digital application. |
|
|
Sec. 2054.622. DIGITAL APPLICATION SECURITY RISK LIST. The |
|
|
department shall: |
|
|
(1) compile, maintain, and annually update a list of |
|
|
digital applications that create a network security risk to state |
|
|
agencies; |
|
|
(2) limit or prohibit the placement and use of digital |
|
|
applications on the list under Subdivision (1) on: |
|
|
(A) state-owned cell phones, computers, and |
|
|
other communication devices; and |
|
|
(B) personal communication devices of state |
|
|
agency employees that are used in the agency's office or other |
|
|
workplace; and |
|
|
(3) post the list under Subdivision (1) on a publicly |
|
|
accessible web page on the department's Internet website. |
|
|
Sec. 2054.623. DIGITAL APPLICATION SECURITY MODEL POLICY |
|
|
FOR STATE AGENCIES. The department shall develop, maintain, and |
|
|
periodically update a model policy for state agencies to use under |
|
|
Section 2054.624 in limiting or prohibiting the placement and use |
|
|
on communication devices of the digital applications included on |
|
|
the list compiled under Section 2054.622. |
|
|
Sec. 2054.624. STATE AGENCY DIGITAL APPLICATION SECURITY |
|
|
POLICY. (a) Each state agency shall develop, implement, and |
|
|
periodically update a policy limiting or prohibiting the placement |
|
|
and use of digital applications included on the list compiled under |
|
|
Section 2054.622 on: |
|
|
(1) state-owned cell phones, computers, and other |
|
|
communication devices; and |
|
|
(2) personal communication devices of state agency |
|
|
employees that are used in the agency's office or other workplace. |
|
|
(b) Each state agency shall submit to the department a copy |
|
|
of the policy required under Subsection (a) and updates to the |
|
|
policy. |
|
|
(c) The department: |
|
|
(1) may offer recommendations for improvements to |
|
|
submitted policies; |
|
|
(2) shall retain each copy and update submitted under |
|
|
Subsection (b); and |
|
|
(3) shall notify each member of the legislature and |
|
|
the governor when a state agency submits a policy or update. |
|
|
Sec. 2054.625. DISCLOSURE EXEMPTION. The model policy and |
|
|
state agency policies developed under this subchapter are exempt |
|
|
from disclosure under Chapter 552. |
|
|
Sec. 2054.626. RULEMAKING AUTHORITY. The department may |
|
|
adopt rules to implement this subchapter. |
|
|
SECTION 2. (a) As soon as practicable after the effective |
|
|
date of this Act, but not later than January 1, 2024, the Department |
|
|
of Information Resources shall develop the digital application |
|
|
security risk list and model policy as required by Subchapter S, |
|
|
Chapter 2054, Government Code, as added by this Act. |
|
|
(b) A state agency is not required to comply with Section |
|
|
2054.624, Government Code, as added by this Act, until May 1, 2024. |
|
|
SECTION 3. This Act takes effect September 1, 2023. |