Law / United States / 
Texas
Texas state bank regulation, notice of a computer-security incident to the banking commissioner
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://texreg.sos.state.tx.us/public/readtac$ext.TacPage?sl=R&app=9&p_dir=&p_rloc=&p_tloc=&p_ploc=&pg=1&p_tac=&ti=7&pt=1&ch=3&rl=24In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a Texas state-chartered bank; declare is_bank if your organization is one.
- Notify the banking commissioner of a computer-security incident that qualifies as a notification incident under 12 CFR Part 225, Subpart N, or Part 304, Subpart C, and submit the information those regulations require, no later than the time that information is due to your federal banking regulator; the Department of Banking states that this is 36 hours after you determine a notification incident has occurred.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state bank shall notify the banking commissioner and submit the information required by 12 CFR Part 225, Subpart N, or Part 304, Subpart C, as applicable, regarding a computer-security incident that qualifies under those regulations as a notification incident. The notice is due no later than the time the information is required to be submitted to the applicable federal regulatory agency.
The Texas Department of Banking states that financial institutions are required to notify regulators within 36 hours after determining a notification incident has occurred. Section 3.24 was adopted to be effective , and amended to be effective .
When LexLint raises it
When your app profile says your app is a bank.