Relating to the application of the open meetings law and public information law to government information related to certain cybersecurity measures.

Texas shields cybersecurity talks and records

Texas government bodies can close discussions about cybersecurity measures, policies, or contracts solely intended to protect critical infrastructure within their jurisdiction. Closing these discussions is allowed, not required. Related records are confidential and exempt from public disclosure. Covered infrastructure includes communications and cybersecurity systems; power facilities and grids; dams; gas systems; hazardous-waste treatment; and water and wastewater facilities, pipelines, pumps, and supporting equipment. The records protection also covers insurance limits, deductibles, other risk-coverage amounts, and self-insured amounts protecting government technology, infrastructure, or data. It also covers cybersecurity incidents reported under state law. Network layouts, hardware and software settings, encryption details, and incident detection, investigation, or response practices are protected when release would help unauthorized access. Government bodies can disclose protected information to comply with state or federal law or a court order. They must notify the owner or affected third party at least five business days before the required release date. For immediate release, notice is due as soon as practical, within five business days afterward. Existing confidential or privileged labels must remain. The act provides for immediate effect with approval from two-thirds of all elected members in each legislative chamber; otherwise, September 1, 2025.