SB2176 - Relating to the establishment of the Texas Cyber Command as a component institution of The University of Texas System and the transfer to it of certain powers and duties of the Department of Information Resources.

  89R12748 LRM-F     By: Parker S.B. No. 2176       A BILL TO BE ENTITLED   AN ACT   relating to the establishment of the Texas Cyber Command as a   component institution of The University of Texas System and the   transfer to it of certain powers and duties of the Department of   Information Resources.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Subtitle B, Title 10, Government Code, is   amended by adding Chapter 2063 to read as follows:   CHAPTER 2063. TEXAS CYBER COMMAND   SUBCHAPTER A. GENERAL PROVISIONS           Sec. 2063.001.  DEFINITIONS. In this chapter:                 (1)     "Chief" means the chief of the Texas Cyber   Command.                 (2)     "Command" means the Texas Cyber Command   established under this chapter.                 (3)     "Covered entity" means a private entity operating   critical infrastructure or a local government that the command   contracts with in order to provide cybersecurity services under   this chapter.                 (4)     "Critical infrastructure" means infrastructure in   this state vital to the security, governance, public health and   safety, economy, or morale of the state or the nation, including:                       (A)  chemical facilities;                       (B)  commercial facilities;                       (C)  communication facilities;                       (D)  manufacturing facilities;                       (E)  dams;                       (F)  defense industrial bases;                       (G)  emergency services systems;                       (H)  energy facilities;                       (I)  financial services systems;                       (J)  food and agriculture facilities;                       (K)  government facilities;                       (L)  health care and public health facilities;                       (M)     information technology and information   technology systems;                       (N)  nuclear reactors, materials, and waste;                       (O)  transportation systems; or                       (P)  water and wastewater systems.                 (5)     "Cybersecurity" means the measures taken to   protect a computer, computer network, computer system, or other   technology infrastructure against unauthorized:                       (A)     use, access, disruption, modification, or   destruction; or                       (B)     disclosure, modification, or destruction of   information.                 (6)  "Cybersecurity incident" includes:                       (A)     a breach or suspected breach of system   security as defined by Section 521.053, Business & Commerce Code;                       (B)     the introduction of ransomware, as defined by   Section 33.023, Penal Code, into a computer, computer network, or   computer system; or                       (C)     any other cybersecurity-related occurrence   that jeopardizes information or an information system designated by   command policy adopted under this chapter.                 (7)     "Department" means the Department of Information   Resources.                 (8)     "Governmental entity" means this state, a state   agency, or a local government.                 (9)     "Information resources" has the meaning assigned   by Section 2054.003, Government Code.                 (10)     "Information resources technologies" has the   meaning assigned by Section 2054.003.                 (11)     "Local government" has the meaning assigned by   Section 2054.003.                 (12)     "Sensitive personal information" has the meaning   assigned by Section 521.002, Business & Commerce Code.                 (13)  "State agency" means:                       (A)     a department, commission, board, office, or   other agency that is in the executive or legislative branch of state   government and that was created by the constitution or a statute;                       (B)     the supreme court, the court of criminal   appeals, a court of appeals, a district court, or the Texas Judicial   Council or another agency in the judicial branch of state   government; or                       (C)     a university system or an institution of   higher education as defined by Section 61.003, Education Code.           Sec.   2063.002.     ORGANIZATION. (a) The Texas Cyber Command   is a component of The University of Texas System and   administratively attached to The University of Texas at San   Antonio.           (b)     The command is managed by a chief appointed by the   governor and confirmed with the advice and consent of the senate.     The chief serves at the pleasure of the governor and must possess   professional training and knowledge relevant to the functions and   duties of the command.           (c)     The command shall employ other coordinating and   planning officers and other personnel necessary to the performance   of its functions.           (d)     Under an agreement with the command, The University of   Texas at San Antonio shall provide administrative support services   for the command as necessary to carry out the purposes of this   chapter.           Sec.   2063.003.     ESTABLISHMENT AND PURPOSE. (a) The command   is established to prevent and respond to cybersecurity incidents   that affect governmental entities and critical infrastructure in   this state.           (b)     The command is responsible for cybersecurity for this   state, including:                 (1)     developing tools to enhance cybersecurity   defenses;                 (2)     facilitating education and training of a   cybersecurity workforce;                 (3)     in collaboration with the department,   establishing appropriate cybersecurity standards; and                 (4)     creating partnerships needed to effectively carry   out the command's functions.           Sec.   2063.004.     GENERAL POWERS AND DUTIES. (a) The command   shall:                 (1)  promote public awareness of cybersecurity issues;                 (2)     develop cybersecurity best practices and minimum   standards for governmental entities;                 (3)     develop and provide training to state agencies and   covered entities on cybersecurity measures and awareness;                 (4)     administer the cybersecurity threat intelligence   center under Section 2063.201;                 (5)     provide support to state agencies and covered   entities experiencing a cybersecurity incident;                 (6)     administer the digital forensics laboratory under   Section 2063.203;                 (7)     administer a statewide portal for enterprise   cybersecurity threat, risk, and incident management, and operate a   cybersecurity hotline available for state agencies and covered   entities 24 hours a day, seven days a week;                 (8)     collaborate with law enforcement agencies to   provide training and support related to cybersecurity incidents;                 (9)     serve as a clearinghouse for information relating   to all aspects of protecting the cybersecurity of governmental   entities, including sharing appropriate intelligence and   information with governmental entities, federal agencies, and   covered entities;                 (10)     collaborate with the department to ensure   information resources and information resources technologies   obtained by the department meet the cybersecurity standards and   requirements established under this chapter;                 (11)     offer cybersecurity resources to state agencies   and covered entities as determined by the command; and                 (12)     adopt policies to ensure state agencies implement   sufficient cybersecurity measures to defend information resources,   information resources technologies, and sensitive personal   information maintained by the agencies.           (b)  The command may:                 (1)     adopt and enforce policies necessary to carry out   this chapter;                 (2)  adopt and use an official seal;                 (3)     establish ad hoc advisory committees as necessary   to carry out the command's duties under this chapter;                 (4)     acquire and convey property or an interest in   property;                 (5)     procure insurance and pay premiums on insurance of   any type, in accounts, and from insurers as the command considers   necessary and advisable to accomplish any of the command's duties;   and                 (6)     hold patents, copyrights, trademarks [Text truncated for display. Full text available on LegiScan.]