Title GV, Government Code

Sec. 2063.004. GENERAL POWERS AND DUTIES. (a) The command shall: (1) promote public awareness of cybersecurity issues; (2) develop cybersecurity best practices and minimum standards for governmental entities; (3) develop and provide training to state agencies and covered entities…

Sec. 2063.005. COST RECOVERY. The command may recover the cost of providing direct technical assistance, training services, and other services to covered entities when reasonable and practical. Added by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 1, eff. September 1, 202…

Sec. 2063.006. CYBERSECURITY EMERGENCY FUNDING. If a cybersecurity incident creates a need for emergency funding, the command may request that the governor or Legislative Budget Board make a proposal under Chapter 317 to provide funding to manage the operational and financial imp…

Sec. 2063.007. EMERGENCY PURCHASING IN RESPONSE TO CYBERSECURITY INCIDENT. (a) In the event the emergency response to a cybersecurity incident requires the command to purchase an item, the command is exempt from the requirements of Sections 2155.0755, 2155.083, and 2155.132(c) in…

Sec. 2063.008. PURCHASING OF CYBERSECURITY RESOURCES BY GOVERNMENTAL ENTITIES. (a) The command may not require, including by rule, governmental entities to purchase specific cybersecurity systems or resources. (b) The command may adopt guidelines designating the purchasing method…

Sec. 2063.009. RULES. The chief may adopt rules necessary for carrying out the purposes of this chapter. Added by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 1, eff. September 1, 2025.

Sec. 2063.010. APPLICATION OF SUNSET ACT. The command is subject to Chapter 325 (Texas Sunset Act). Unless continued in existence as provided by that chapter, the command is abolished September 1, 2031. Added by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 1, eff. Septemb…

Sec. 2063.011. LAWS NOT AFFECTED. (a) Except as specifically provided by this chapter, this chapter does not affect laws, rules, or decisions relating to the confidentiality or privileged status of categories of information or communications. (b) This chapter does not enlarge the…

Sec. 2063.101. BEST PRACTICES AND MINIMUM STANDARDS FOR CYBERSECURITY AND TRAINING. (a) The command shall develop and annually assess best practices and minimum standards for use by governmental entities to enhance the security of information resources in this state. (b) The comm…

Sec. 2063.102. STATE CERTIFIED CYBERSECURITY TRAINING PROGRAMS. (a) The command, in consultation with the cybersecurity council established under Section 2063.406 and industry stakeholders, shall annually: (1) certify at least five cybersecurity training programs for state and lo…

Sec. 2063.103. CYBERSECURITY TRAINING REQUIRED. (a) Each elected or appointed official and employee of a governmental entity who has access to the entity's information resources or information resources technologies shall annually complete a cybersecurity training program certifi…

Sec. 2063.104. CYBERSECURITY TRAINING REQUIRED: CERTAIN STATE CONTRACTORS. (a) In this section, "contractor" includes a subcontractor, officer, or employee of the contractor. (b) A state agency shall require any contractor who has access to a state computer system or database to …

Sec. 2063.201. CYBERSECURITY THREAT INTELLIGENCE CENTER. (a) In this section, "center" means the cybersecurity threat intelligence center established under this section. (b) The command shall establish a cybersecurity threat intelligence center. The center shall collaborate with …

Sec. 2063.202. CYBERSECURITY INCIDENT RESPONSE UNIT. (a) The command shall establish a dedicated cybersecurity incident response unit to: (1) detect and contain cybersecurity incidents in collaboration with the cybersecurity threat intelligence center under Section 2063.201; (2) …

Sec. 2063.203. DIGITAL FORENSICS LABORATORY. (a) The command shall establish a digital forensics laboratory to: (1) in collaboration with the cybersecurity incident response unit under Section 2063.202, develop procedures to: (A) preserve evidence of a cybersecurity incident, inc…

Sec. 2063.204. INFORMATION SHARING AND ANALYSIS ORGANIZATION. (a) The command shall establish at least one information sharing and analysis organization to provide a forum for state agencies, local governments, public and private institutions of higher education, and the private …

Sec. 2063.205. POLICIES. The command shall adopt policies and procedures necessary to enable the entities established in this subchapter to carry out their respective duties and purposes. Added by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 1, eff. September 1, 2025. SUB…

Sec. 2063.301. CYBERSECURITY REPORT. (a) Not later than November 15 of each even-numbered year, the command shall submit to the governor, the lieutenant governor, the speaker of the house of representatives, and the standing committee of each house of the legislature with primary…

Sec. 2063.302. CYBERSECURITY INCIDENT NOTIFICATION BY STATE AGENCY OR LOCAL GOVERNMENT. (a) A state agency or local government that owns, licenses, or maintains computerized data that includes sensitive personal information, confidential information, or information the disclosure…

Sec. 2063.303. VULNERABILITY REPORTS. (a) In this section, a term defined by Section 33.01, Penal Code, has the meaning assigned by that section. (b) The information security officer of a state agency shall prepare or have prepared a report, including an executive summary of the …

Sec. 2063.401. DESIGNATED INFORMATION SECURITY OFFICER. Each state agency shall designate an information security officer who: (1) reports to the agency's executive-level management; (2) has authority over information security for the entire agency; (3) possesses the training and…

Sec. 2063.402. CYBERSECURITY RISKS AND INCIDENTS. (a) The command shall develop a plan to address cybersecurity risks and incidents in this state. The command may enter into an agreement with a national organization, including the National Cybersecurity Preparedness Consortium, t…

Sec. 2063.403. INFORMATION SECURITY PLAN. (a) Each state agency shall develop, and periodically update, an information security plan for protecting the security of the agency's information. (b) In developing the plan, the state agency shall: (1) consider any vulnerability report …

Sec. 2063.404. ONGOING INFORMATION TRANSMISSIONS. Information received from state agencies by the department under Section 2054.069 shall be transmitted by the department to the command on an ongoing basis. Added by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 1, eff. Sep…

Sec. 2063.405. DATA SECURITY PLAN FOR ONLINE AND MOBILE APPLICATIONS. (a) Each state agency implementing an Internet website or mobile application that processes any sensitive personal or personally identifiable information or confidential information must: (1) submit a biennial …

Sec. 2063.406. CYBERSECURITY COUNCIL. (a) The chief or the chief's designee shall lead a cybersecurity council that includes public and private sector leaders and cybersecurity practitioners to collaborate on matters of cybersecurity concerning this state. (b) The cybersecurity c…

Sec. 2063.407. RECOMMENDATIONS. The chief may implement any portion, or all of the recommendations made by the cybersecurity council under Section 2063.406. Added by Acts 2013, 83rd Leg., R.S., Ch. 32 (S.B. 1102), Sec. 1, eff. May 10, 2013. Redesignated from Government Code, Sect…

Sec. 2063.408. CLOUD COMPUTING STATE RISK AND AUTHORIZATION MANAGEMENT PROGRAM. (a) In this section, "cloud computing service" has the meaning assigned by Section 2157.007. (b) The command shall establish a state risk and authorization management program to provide a standardized…

Sec. 2063.409. INFORMATION SECURITY ASSESSMENT AND PENETRATION TEST REQUIRED. (a) This section does not apply to a university system or institution of higher education as defined by Section 61.003, Education Code. (b) At least once every two years, the command shall require each …

Sec. 2063.501. DEFINITIONS. In this subchapter: (1) "Incident response team" means the Texas volunteer incident response team established under Section 2063.502. (2) "Participating entity" means a state agency, including an institution of higher education, or a local government t…

Sec. 2063.502. ESTABLISHMENT OF TEXAS VOLUNTEER INCIDENT RESPONSE TEAM. (a) The command shall establish the Texas volunteer incident response team to provide rapid response assistance to a participating entity under the command's direction during a cybersecurity incident. (b) The…

Sec. 2063.503. CONTRACT WITH VOLUNTEERS. The command shall enter into a contract with each volunteer the command approves to provide rapid response assistance under this subchapter. The contract must require the volunteer to: (1) acknowledge the confidentiality of information req…

Sec. 2063.504. VOLUNTEER QUALIFICATION. (a) The command shall require criminal history record information for each individual who accepts an invitation to become a volunteer. (b) The command may request other information relevant to the individual's qualification and fitness to s…

Sec. 2063.505. DEPLOYMENT. (a) In response to a cybersecurity incident that affects multiple participating entities or a declaration by the governor of a state of disaster caused by a cybersecurity event, the command on request of a participating entity may deploy volunteers and …

Sec. 2063.506. CYBERSECURITY COUNCIL DUTIES. The cybersecurity council established under Section 2063.406 shall review and make recommendations to the command regarding the policies and procedures used by the command to implement this subchapter. The command may consult with the …

Sec. 2063.507. COMMAND POWERS AND DUTIES. (a) The command shall: (1) approve the incident response tools the incident response team may use in responding to a cybersecurity incident; (2) establish the eligibility criteria an individual must meet to become a volunteer; (3) develop…

Sec. 2063.508. STATUS OF VOLUNTEER; LIABILITY. (a) A volunteer is not an agent, employee, or independent contractor of this state for any purpose and has no authority to obligate this state to a third party. (b) This state is not liable to a volunteer for personal injury or prope…

Sec. 2063.509. CIVIL LIABILITY. A volunteer who in good faith provides professional services in response to a cybersecurity incident is not liable for civil damages as a result of the volunteer's acts or omissions in providing the services, except for wilful and wanton misconduct…

Sec. 2063.510. CONFIDENTIAL INFORMATION. Information written, produced, collected, assembled, or maintained by the command, a participating entity, the cybersecurity council, or a volunteer in the implementation of this subchapter is confidential and not subject to disclosure und…

Sec. 2063.601. ELIGIBLE PARTICIPATING ENTITIES. A state agency or an entity listed in Section 2059.058 is eligible to participate in cybersecurity support and network security provided by a regional security operations center under this subchapter. Added by Acts 2021, 87th Leg., …

Sec. 2063.602. ESTABLISHMENT OF REGIONAL SECURITY OPERATIONS CENTERS. (a) Subject to Subsection (b), the command may establish regional security operations centers, under the command's managed security services framework established by Section 2063.204(c), to assist in providing …

Sec. 2063.603. REGIONAL SECURITY OPERATIONS CENTER LOCATIONS AND PHYSICAL SECURITY. (a) In creating and operating a regional security operations center, the command may partner with a university system or institution of higher education as defined by Section 61.003, Education Cod…

Sec. 2063.604. REGIONAL SECURITY OPERATIONS CENTERS SERVICES AND SUPPORT. The command may offer the following managed security services through a regional security operations center: (1) real-time cybersecurity monitoring to detect and respond to cybersecurity incidents that may …

Sec. 2063.605. NETWORK SECURITY GUIDELINES AND STANDARD OPERATING PROCEDURES. (a) The command shall adopt and provide to each regional security operations center appropriate network security guidelines and standard operating procedures to ensure efficient operation of the center …