HB 4231 — Relating to cybersecurity for retail public utilities that provide water or sewer service.

Summary

Relating to cybersecurity for retail public utilities that provide water or sewer service.

Bill Text

Compared against the Texas statutes as published AI-generated reading aid — verify against the official bill.

This bill amends 2 section(s) of the Texas statutes: Section 2054.0525, Government Code, Section 2059.058, Government Code.

• Section 2054.0525, Government Code

  and → ; and (15) a retail public utility, as defined by Section 13.002, Water Code

  amended

• Section 2059.058, Government Code

  and → ; and (11) a retail public utility, as defined by Section 13.002, Water Code

  amended

• SUBCHAPTER O. CYBERSECURITY REQUIREMENTS Sec. 13.601. DEFINITIONS. In this subchapter: (1) "Center" means the Cyber Center for Security and Analytics at The University of Texas at San Antonio. (2) "Department" means the Department of Information Resources. Sec. 13.602. CONNECTION BETWEEN SUPERVISORY CONTROL AND DATA ACQUISITION SYSTEM AND INTERNET PROHIBITED. (a) A retail public utility may not connect the retail public utility's supervisory control and data acquisition system, or another equivalent operational information technology infrastructure, to the Internet. (b) Notwithstanding Subsection (a), a supervisory control and data acquisition system or other equivalent operational information technology infrastructure may be operated by an intranet, site-to-site virtual private network. (c) The commission, in consultation with the department, shall adopt rules as necessary to implement this section. Sec. 13.603. REQUIREMENTS AND CONTROLS. (a) The commission, in consultation with and as recommended by the department and the center, by rule shall adopt cybersecurity requirements for retail public utilities to require the authentication of a retail public utility employee's identification before granting the employee access to a retail public utility's network or information systems. (b) Not later than September 1 of each even-numbered year, the commission, in consultation with the department and the center, shall review and amend as necessary rules adopted under this section to ensure that the cybersecurity requirements continue to provide effective cybersecurity protection for retail public utilities. Sec. 13.604. TRAINING. At least annually, a retail public utility shall: (1) identify any employees and officials who: (A) have access to the retail public utility's computer system or databases; or (B) use a computer to perform any of the employee's or official's required duties; and (2) require the employees and officials identified under Subdivision (1) to complete a cybersecurity training program certified under Section 2054.519, Government Code. Sec. 13.605. SECURITY ASSESSMENT AND COMPLIANCE AUDIT. (a) The commission, the utility commission, or the department may require a retail public utility to conduct, in accordance with commission and department rules: (1) a security assessment of the retail public utility's: (A) information resource systems; (B) network systems; (C) digital data storage systems; (D) digital data security measures; or (E) information resources vulnerabilities; or (2) an audit of the retail public utility's compliance with this subchapter. (b) Not later than the 90th day after the date a retail public utility completes a security assessment or audit under Subsection (a), the retail public utility shall report the results of the assessment or audit to: (1) the commission; (2) the utility commission; and (3) the department. (c) A standing committee of the legislature with jurisdiction over cybersecurity or water service may request that the commission, the utility commission, or the department require an assessment or audit under Subsection (a) from a retail public utility. (d) The department shall provide to the center, and if applicable the standing committee of the legislature that requested the assessment or audit, access to each assessment or audit conducted under Subsection (a). (e) The department or the center may conduct a security assessment or audit required by this section on behalf of a retail public utility. (f) A retail public utility may contract with a person who is not the department or the center to conduct a security assessment or audit under this section. (g) Information contained in a report prepared under this section is confidential and not subject to disclosure under Chapter 552, Government Code. (h) The commission, in consultation with the department and the center, shall adopt rules as necessary to implement this section. Sec. 13.606. SECURITY INCIDENT NOTIFICATION. (a) In this s

  amended

Action History

1. March 31, 2025

   Referred to Delivery of Government Efficiency

2. March 31, 2025

   Read first time

3. March 10, 2025

   Filed

Sponsors

• Giovanni Capriglione · Primary

Subjects