U.S. Texas Cybersecurity Act

Why does it matter?

The Act turned Texas agency security from a set of DIR recommendations into statutory duties with dates, named signatories and a regulator. An agency head, chief financial officer and executive managers now sign that they have seen the risks in the information security plan (2054.133(e)); the plan, the biennial assessment and the data security plan all go to DIR on a legislative calendar; and a breach or ransomware incident reaches DIR, or the Secretary of State for election data, within 48 hours (2054.603(b)). DIR reports on the whole state's security to the Governor and the Legislature by November 15 of even-numbered years (2054.133(f) and 2054.0591), so an agency that cannot show its filings is visible at the Capitol.

Key benefits include:

• Named accountability

Section 2054.133(e) requires a written statement signed by the head of the agency, the chief financial officer and each designated executive manager that they have been made aware of the risks revealed while preparing the information security plan.

• A fixed filing calendar

The information security plan is due June 1 of even-numbered years (2054.133(c)), the biennial data security plan on the same date (2054.516(a)(1)), the security assessment report by December 1 of the assessment year or within 60 days of completion (2054.515(b)) and contractor training reports by August 31 each year (2054.5192(e)).

• Confidential filings

The information security plan (2054.133(d)) and the assessment report with its documentation (2054.515(d)) are confidential and exempt from disclosure under the Public Information Act, chapter 552.

• A 48-hour incident clock

A state agency or local government holding sensitive personal, confidential or legally regulated information notifies DIR, including the chief information security officer, within 48 hours of discovering a breach, suspected breach or ransomware incident (2054.603(b)(2)), then files a cause analysis within 10 business days of eradication, closure and recovery (2054.603(c)).

• Statewide coordination

DIR runs the information sharing and analysis organization and regional cybersecurity working groups with mutual aid agreements (2054.0594), the state cybersecurity coordinator leads the cybersecurity council (2054.512) and DIR keeps a plan for statewide cybersecurity risks and incidents with training, simulation exercises and emergency plan integration (2054.518).

How does it work?

The core instrument is the information security plan in section 2054.133. Each state agency develops and periodically updates a plan for protecting the security of its information; in doing so it considers its 2054.077 vulnerability report, incorporates the network security services DIR provides under chapter 2059, defines the responsibilities of staff who produce, access, use or hold its information, identifies its risk management measures and either adopts DIR's information security best practices or explains in writing why they are not sufficient (2054.133(b)). Written copies omit anything that could expose vulnerabilities. The plan goes to DIR by June 1 of each even-numbered year, and DIR may select plans for assessment under its rules.

Section 2054.515 adds the evidence. At least once every two years the agency assesses its information resources systems, network systems, digital data storage, data security measures and vulnerabilities, and its data governance program with the data management officer taking part, under requirements DIR sets by rule. The results go to DIR, and on request to the Governor, Lieutenant Governor and Speaker. Section 2054.516 covers public-facing software: an agency implementing a website or mobile application that processes sensitive personal, personally identifiable or confidential information files a biennial data security plan by June 1 of even-numbered years and subjects the application to a vulnerability and penetration test, fixing what the test finds. Institutions of higher education follow the developer disclosure and pre-deployment testing policy in 2054.517 instead.

People and incidents complete the scheme. Section 2054.5191 requires every state employee who uses a computer for at least 25 percent of their duties, and every elected or appointed officer, to complete a DIR-certified cybersecurity training program once a year; local governments apply the same test to their employees and officials and may deny system access to anyone who does not comply. Section 2054.5192 extends certified training to contractors with access to a state system, written into the contract and reported to DIR by August 31. Section 2054.603 defines a security incident as a breach or suspected breach of system security under Business and Commerce Code 521.053 or the introduction of ransomware, and sets the 48-hour notice and the 10-business-day post-recovery analysis.

Key Elements

• Information security plan (2054.133)

A periodically updated plan built on the vulnerability report, DIR's chapter 2059 network services, staff responsibilities, risk management measures and DIR best practices; filed by June 1 of even-numbered years; confidential; signed risk acknowledgment by agency leadership.

• Biennial security assessment (2054.515)

An assessment at least every two years of systems, networks, data storage, security measures, vulnerabilities and the data governance program, reported to DIR under DIR's rules; report and documentation confidential.

• Data security plans and testing (2054.516 and 2054.517)

A biennial data security plan and a vulnerability and penetration test for every website or mobile application that processes sensitive personal or confidential information; institutions of higher education require developer disclosures and pre-deployment testing under their own policy.

• Certified cybersecurity training (2054.519, 2054.5191, 2054.5192)

DIR certifies at least five training programs a year; state and local employees and officials who use a computer for 25 percent or more of their duties, and state contractors with system access, complete one annually, with completion verified to DIR.

• Security incident notification (2054.603)

Notice to DIR, including the chief information security officer, or to the Secretary of State for election data, within 48 hours of discovering a breach, suspected breach or ransomware; consumer notice under Business and Commerce Code 521.053; cause analysis within 10 business days of recovery.

• Statewide structures (2054.0591, 2054.0594, 2054.512, 2054.518, 2054.5181)

DIR's biennial cybersecurity report to the Governor and Legislature, the information sharing and analysis organization and regional working groups, the cybersecurity council, DIR's statewide risk and incident plan and the voluntary cyberstar certificate program for public and private entities.

What does it cover?

The Act and the chapter 2054 sections it created apply to Texas state agencies, which file the information security plan, the biennial assessment and the data security plan with DIR. Institutions of higher education carry the application security procedures in 2054.517, take part in the information sharing and analysis organization and are consulted by DIR under 2054.518(d). Local governments are bound by the security incident notification in 2054.603, the annual training requirement in 2054.5191(a-1) and may join regional cybersecurity working groups under 2054.0594(d). Contractors with access to a state computer system or database complete certified training under 2054.5192. Section 17 of HB 8 excludes the Electric Reliability Council of Texas from the changes the Act made.

What are its objectives?

The Act's title states its purpose: cybersecurity for state agency information resources. Its sections pursue that end through five outcomes.

Give every state agency a current, confidential information security plan that its leadership has read and signed (2054.133).

Produce biennial evidence of the agency's actual exposure through the security assessment and the vulnerability and penetration testing of public-facing applications (2054.515 and 2054.516).

Bring breaches, suspected breaches and ransomware to DIR within 48 hours and explain their cause within 10 business days of recovery (2054.603).

Raise the security habits of the state's workforce and contractors through annual DIR-certified training (2054.519 to 2054.5192).

Coordinate threat information, mutual aid and legislative recommendations statewide through the information sharing and analysis organization, the cybersecurity council and DIR's biennial report (2054.0594, 2054.512 and 2054.0591).

Framework in Context

The Act sits inside Government Code chapter 2054, DIR's enabling statute, and works with chapter 2059, the Texas Computer Network Security System, whose network services the information security plan must incorporate. DIR's rules under the chapter, including the Texas DIR Security Control Standards Catalog that sets the minimum controls agencies implement, were published as 1 Texas Administrative Code chapter 202 and were transferred to 1 TAC chapter 477 under the Texas Cyber Command on August 1, 2026 without a change in wording. School districts follow a separate statute, Education Code section 11.175 (TX SB 820), whose policies may not conflict with DIR's standards under chapters 2054 and 2059. The breach notice in 2054.603 points to Business and Commerce Code 521.053, the consumer notification law, and the cyberstar best practices in 2054.5181 must be consistent with the National Institute of Standards and Technology's cybersecurity standards, which is why agencies map the Act's duties to the frameworks below.

Common Framework Mappings

Organizations map the Act's planning, assessment, testing, training and notification duties to the frameworks below so that one control set serves DIR's filings and other audits.

Mapped frameworks include:

CIS Controls v8.1

CJIS Security Policy

COBIT 2019

FedRAMP Rev. 5

FERPA

GLBA Safeguards Rule (16 CFR Part 314)

HIPAA

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5