BILL ANALYSIS

H.B. 5331

By: Dean

Delivery of Government Efficiency

Committee Report (Unamended)

BACKGROUND AND PURPOSE

The bill author has informed the committee that state agencies and local governments often purchase cybersecurity insurance to help manage the risk of cyberattacks. However, some policies may include clauses that restrict or prohibit the disclosure of cybersecurity incidents, conflicting with the requirement in state law to report cyberattacks to the Texas Department of Information Resources within 48 hours of discovery. H.B. 5331 seeks to ensure that public entities are not contractually restricted from fulfilling their legal obligations under state law by clarifying that any language in a cybersecurity insurance contract or other contract for goods and services that prevents a state agency or local government from complying with required security incident notifications is void and unenforceable.

CRIMINAL JUSTICE IMPACT

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

H.B. 5331 amends the Government Code to establish that contract language in a cybersecurity insurance contract or other contract for goods or services prohibiting or restricting a state agency's or local government's compliance with statutory provisions relating to security incident notification by a state agency or local government or otherwise circumventing the requirements of those provisions is void and unenforceable. The bill's provisions are expressly intended to clarify rather than change existing law.

EFFECTIVE DATE

On passage, or, if the bill does not receive the necessary vote, September 1, 2025.