All Roll Calls
Yes: 875 • No: 145
TexasHB 15089th Legislature Regular SessionHouse
Relating to the establishment of the Texas Cyber Command and the transfer to it of certain powers and duties of the Department of Information Resources.
Sponsored By: Greg Bonnen, Giovanni Capriglione, Cole Hefner, Ray Lopez, John Lujan, Tan Parker (Republican)
Signed by Governor
Education--Higher--Institutions & ProgramsElectronic Information SystemsGovernorLaw EnforcementPurchasing--StateScience & TechnologyState Agencies, Boards & CommissionsState Agencies, Boards & Commissions--Newly ProposedSTAFF DEVELOPMENT & TRAININGTERRORISM & INTERNAL SECURITYUNIVERSITY OF TEXAS AT SAN ANTONIOUNIVERSITY OF TEXAS SYSTEMCYBER COMMAND, TEXASINFORMATION RESOURCES, DEPARTMENT OFSENATE, TEXAS
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
19 provisions identified: 8 benefits, 2 costs, 9 mixed.
Cyber teams help restore public systems
The Texas Cyber Command must create an incident response unit and a digital forensics laboratory. The unit contains attacks, helps restore systems, and reduces harm when sensitive personal information is breached. It may loan resources to state agencies and covered entities while their systems recover. The Command must preserve incident evidence, analyze causes, and support investigations or court actions with specified state agencies. It must also develop and share threat-hunting tools with relevant agencies and covered entities under contracts.
State networks get centralized cyber protection
The Texas Cyber Command must provide real-time network monitoring, security assessments, continuous alerts, and immediate incident response through its center. It also provides statewide cybersecurity operations and network-security education. The Command may offer secure system design and services that check whether systems meet security and risk-management standards. It may hire a private company to build and operate the center and acquire, install, and maintain security equipment.
Texas creates a statewide cyber agency
Beginning September 1, 2025, the law creates the Texas Cyber Command to protect government systems and critical infrastructure. The Command and Department of Information Resources must sign a transfer plan by January 1, 2026. Transfers of cybersecurity duties, workers, contracts, property, records, and funds must finish by December 31, 2026; the department continues its duties until the plan's stated date. The Command runs a reporting portal and 24/7 hotline and ends September 1, 2031, unless continued through Sunset review. The law also repeals four technology provisions, but the supplied text does not explain their practical effects.
Security centers can host technology apprentices
Participants in qualifying programs can complete their required one-year apprenticeship at a regional security operations center. This replaces the law's former reference to regional network centers as eligible hosts. The Texas Higher Education Coordinating Board must approve the program. It must prepare participants for an entry-level information-technology job in a state agency.
Government cyber incidents get reporting deadlines
State agencies and local governments holding computerized personal, confidential, or legally protected data must report covered cyber incidents within 48 hours of discovery. Reports go to the Command, except election-data incidents go to the Texas Secretary of State. Incident details and a cause analysis are due within 10 business days after eradication, closure, and recovery. Local incidents requiring reports to a Public Utility Commission-certified independent organization are excluded. Existing breach-notice duties and Command reporting rules still apply.
Government networks face regular security checks
The Command must develop and review government cybersecurity best practices and minimum standards each year and adopt compliance policies. It must give all state agencies network-security guidelines and operating procedures, updating them as needed. Covered state agencies must complete a security assessment and a test for system weaknesses at least every two years. The Command or a vendor it selects performs the tests. University systems and higher education institutions are exempt from this testing requirement.
Texas Cyber Command gets emergency purchasing flexibility
The Texas Cyber Command can skip certain purchasing rules when responding to a cybersecurity incident requires an emergency purchase. After buying, it must notify the Legislative Budget Board and governor and keep records for a post-incident audit. It must report purchase details to the State Auditor's Office within 90 days after the purchase.
School districts gain flexible cybersecurity training schedules
Only a school district's cybersecurity coordinator must complete cybersecurity training every year. For other employees who need this training, the district sets the schedule after consulting the coordinator.
Cyber Command jobs require U.S. citizenship
Command policies must bar non-U.S. citizens from membership, employment, contracting, volunteering, or any other affiliation with the Command. The ban also covers organizations and entities it establishes or operates. Criminal justice agencies may share criminal records covered by nondisclosure orders with the Command for specified network-security personnel. This includes employees, applicants, contractors, subcontractors, interns, and volunteers serving the Command or its contractors and subcontractors.
Participating agencies pay shared cybersecurity costs
The Department of Information Resources must create billing that divides total network-security costs among served agencies and entities by proportional use. The Command may also recover reasonable and practical costs for direct technical help, training, and other services to covered entities. A private entity qualifies as covered only if it operates critical infrastructure and contracts with the Command for cybersecurity services. No fee amount or detailed usage formula is stated, and these rules do not directly bill households.
Government workers face yearly cybersecurity training
Government officials and employees with access to government information systems must complete Command-certified cybersecurity training each year. The Command must certify at least five programs annually and maintain certification standards. It also sets mandatory training for state information-resources employees and consults a higher education council about applying those requirements to college employees. Agencies and local governments must verify completion, local governments must require periodic audits, and noncompliant workers may lose system access. Exceptions cover people denied access for noncompliance and specified military, family, medical, disability, or extended leave when the required access conditions are met.
Agency security plans limit public access
State agencies must submit updated information-security plans by June 1 of each even-numbered year. Plans must address security risks and responsibilities; agencies must explain in writing why they do not use the Command's best practices. Agencies with websites or apps handling protected information must submit data-security plans by the same deadline, test for weaknesses, and fix them. Agency security plans, vulnerability reports, and related materials are confidential; the Command reviews plans and may recommend changes. Agencies must prepare summaries without risky security details, but those summaries are no longer expressly available to the public on request.
Governor can order covered network shutdowns
The governor can order a covered network disconnected from the Internet because of a substantial external threat under disaster-management law. The Department of Information Resources must carry out the order in coordination with the Command. This applies to entities receiving security services under Chapter 2059, not households generally. Disconnection protects systems from the threat but interrupts Internet access for the affected entity.
Regional cyber centers offer optional help
The Command may open regional security centers for eligible entities that choose to participate. Services may include live monitoring, threat guidance, immediate response, coordinated incident control, and cybersecurity education. More centers may open only after the Command finds the first center successfully provides its contracted services. Universities may partner to operate centers, but public junior colleges cannot be selected. A university partner must have suitable educational capabilities, sign a contract, support education, and restrict access to the center and operational information.
State agencies face cybersecurity purchasing limits
The Texas Cyber Command takes over network-security services for state agencies and may serve eligible nonstate entities by agreement. Agencies may buy services outside its center only when the Command finds the center cannot meet their needs at comparable cost. However, the Command cannot require government entities to buy specific cybersecurity systems or resources. It may recommend purchasing methods that offer the best value. Higher education institutions need approval from the Information Technology Council for Higher Education to receive services.
Texas expands shared cyber threat response
The Command must create a threat intelligence center that works with federal cybersecurity and law enforcement agencies. It must establish at least one group where governments, colleges, and businesses share threat information and response practices. Participants answering public-records requests must claim any available legal exception to disclosure of shared information. The Command must also set up a regional mutual-aid framework for sharing experts and recovery resources during Texas cyber incidents. Its statewide risk plan must avoid duplicate work and draw on college expertise when appropriate; outside help is allowed for work it lacks resources to handle.
Volunteer cyber help can bring fees
The Command runs a volunteer cyber response team for participating entities that request help. Deployment is allowed for incidents affecting multiple participating entities or after a governor-declared disaster caused by a cybersecurity event. Volunteers need relevant expertise, eligibility screening, criminal-history review, and confidentiality agreements; they must accept each deployment in writing and may decline. The Command may charge entities receiving help, but total fees cannot exceed the cost of running the team. Volunteers are not state employees; travel reimbursement is allowed, the state disclaims injury and property-damage liability, and volunteers have civil immunity except for willful or wanton misconduct.
State cloud vendors face security checks
The Command runs a risk and security approval program for covered cloud services that process state-agency data. It sets covered service categories and vendor certification requirements. Agencies cannot start or renew covered contracts unless vendors show compliance, and vendors must stay compliant throughout the contract. Vendors may use an approved federal or other state's program to demonstrate compliance.
State technology funding gets new limits
The department must agree to transfer funds needed for the Command's network-security duties. The Command may seek federal and other grants for those duties, but no award or amount is guaranteed. Revenue from specified technology fees, commodity-purchase administrative fees, and consolidated telecommunications fees may fund department technology planning and shared services. Network-security purposes under Chapter 2059 are no longer listed as authorized uses of those revenue streams. These spending changes do not create new household payment duties.
Sponsors & Cosponsors
Sponsors
Greg Bonnen
House
Giovanni Capriglione
House
Cole Hefner
House
Ray Lopez
House
John Lujan
House
Tan Parker
Republican • Senate
Cosponsors
Elizabeth "Liz" Campos
House
Cody Harris
House
Caroline Harris Davila
House
Suleman Lalani
House
Janie Lopez
House
Penny Morales Shaw
House
Mihaela Plesa
House
Richard Peña Raymond
House
Roll Call Votes
House vote • 5/29/2025
Record vote
Yes: 115 • No: 21
Senate vote • 5/27/2025
Record vote
Yes: 0 • No: 0
Senate vote • 5/27/2025
Record vote
Yes: 0 • No: 0
House vote • 4/16/2025
Record vote
Yes: 130 • No: 13
House vote • 4/15/2025
Record vote
Yes: 133 • No: 12
House vote • 4/15/2025
Record vote
Yes: 89 • No: 54
House vote • 4/15/2025
Record vote
Yes: 117 • No: 27
House vote • 4/15/2025
Record vote
Yes: 136 • No: 9
House vote • 4/15/2025
Record vote
Yes: 132 • No: 9
House vote • Unknown
Committee vote: Delivery of Government Efficiency
Yes: 12 • No: 0
Senate vote • Unknown
Committee vote: Business & Commerce
Yes: 11 • No: 0
Actions Timeline
Effective on 9/1/25
6/2/2025HouseSigned by the Governor
6/2/2025HouseSent to the Governor
6/1/2025HouseSigned in the Senate
6/1/2025SenateSigned in the House
5/31/2025HouseReported enrolled
5/30/2025HouseHouse concurs in Senate amendment(s)-reported
5/29/2025SenateText of Senate Amendment(s)
5/29/2025HouseStatement(s) of vote recorded in Journal
5/29/2025HouseRecord vote (RV#4057)
5/29/2025HouseHouse concurs in Senate amendment(s)
5/29/2025HouseSenate Amendments Analysis distributed
5/28/2025HouseSenate Amendments distributed
5/28/2025HouseSenate passage as amended reported
5/28/2025HousePlaced on intent calendar
5/28/2025SenateRecord vote
5/27/2025SenatePassed
5/27/2025SenateRead 3rd time
5/27/2025SenateRecord vote
5/27/2025SenateThree day rule suspended
5/27/2025SenateVote recorded in Journal
5/27/2025SenatePassed to 3rd reading as amended
5/27/2025SenateVote recorded in Journal
5/27/2025SenateAmended
5/27/2025SenateAmendment(s) offered (FA1 Parker)
5/27/2025Senate
Bill Text
Engrossed
Enrolled
House Committee Report
Introduced
Senate Committee Report
Related Bills
SB 2111, Relating to legal representation of indigent persons in this state and to proceedings before a magistrate including the appointment of counsel for an indigent defendant.
SB 1838, Relating to the appointment of attorneys ad litem and the compensation of certain attorneys ad litem in suits affecting the parent-child relationship filed by a governmental entity.
SB 3, Relating to the regulation of products derived from hemp, including consumable hemp products and the hemp-derived cannabinoids contained in those products; requiring occupational licenses and permits; imposing fees; creating criminal offenses; authorizing an administrative penalty.
SB 2878, Relating to the operation and administration of and practices and procedures related to proceedings in the judicial branch of state government, including court security, court documents and arrest warrants, document delivery, juvenile boards, constitutional amendment election challenges, mandatory expunction for certain persons, record retention, and youth diversion; increasing a criminal penalty; authorizing fees.
SB 646, Relating to repayment of certain mental health professional education loans.
HB 4325, Relating to civil liability for prohibited barratry.