Law / United States / 
Texas
Texas trust company regulation, notice of a cybersecurity incident to the banking commissioner
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=7&pt=2&ch=17&rl=5In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a Texas state trust company, other than one exempt under Finance Code section 182.011; declare provides_financial_services if your organization is one.
- Notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice to another state or federal regulator or a self-regulatory body, require a data breach notification to clients or beneficiaries under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect or report transactions or conduct your business.
- Include in the confidential notice, to the extent known, a description of the incident with its approximate date, discovery date and the data involved, a list of the regulators and bodies notified, and the name, address, telephone number and email address of an employee or agent who can give more information.
- Build the notice requirement into the written incident response plan you maintain as part of your information security program.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state trust company shall notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days following its determination that a cybersecurity incident regarding its information system will likely trigger a listed consequence. The listed consequences are a required notice to another regulator, a data breach notification to clients or beneficiaries, or a substantive impact on its ability to effect transactions or conduct its business.
The confidential notice must include, to the extent known, a brief description of the incident, a list of the regulators notified, and the name and contact details of an employee or agent from whom additional information may be obtained. The notice requirement must be incorporated into the trust company's written incident response plan, maintained as part of its information security program. Section 17.5 does not apply to a state trust company that is exempt under Finance Code section 182.011. Section 17.5 was adopted to be effective .
When LexLint raises it
When your app profile says your app provides financial services.