Law / United States / 
Texas
Texas school district cybersecurity policy, report of a breach of student information to the agency, and notice to the parent
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice, Reporting, Security, Governance
- Audit expectation
- none
What it requires
- If you are a school district, adopt a cybersecurity policy that secures district cyberinfrastructure against cyber attacks and other cybersecurity incidents and determines cybersecurity risk and implements mitigation planning; the policy may not conflict with the information security standards the Texas Cyber Command adopts for institutions of higher education (Tex. Educ. Code sec. 11.175(b) and (c)).
- Designate, through the superintendent, a cybersecurity coordinator to serve as the liaison between the district and the Texas Education Agency in cybersecurity matters (Tex. Educ. Code sec. 11.175(d)).
- Report to the agency or, if applicable, the entity that administers the system established under subsection (g), as soon as practicable after discovery, any cyber attack or other cybersecurity incident against the district's or open-enrollment charter school's cyberinfrastructure that is a breach of system security, meaning sensitive, protected or confidential student information was stolen, copied, transmitted, viewed or used by an unauthorized person (Tex. Educ. Code sec. 11.175(a)(1) and (e)).
- Through the district's cybersecurity coordinator, give the parent of or person standing in parental relation to each enrolled student notice of a reported attack or incident involving the student's information (Tex. Educ. Code sec. 11.175(f)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 11.175 requires a school district to adopt a cybersecurity policy, designate a coordinator, report a breach of system security to the agency and notify the parent. Each is a notification or a policy, and none requires the district to keep a record of the incident. The agency's anonymous incident-sharing system under subsection (g) is the State's record.
- Kind
- None
- As of
What this law does
A breach of system security is an incident in which student information that is sensitive, protected, or confidential, as provided by state or federal law, is stolen or copied, transmitted, viewed, or used by a person unauthorized to engage in that action. Each school district must adopt a cybersecurity policy to secure district cyberinfrastructure against cyber attacks and other cybersecurity incidents and to determine cybersecurity risk and implement mitigation planning.
A school district or open-enrollment charter school must report to the agency or, if applicable, the entity that administers the system established under subsection (g), any cyber attack or other cybersecurity incident against its cyberinfrastructure that constitutes a breach of system security, as soon as practicable after the discovery of the attack or incident.
The district's cybersecurity coordinator must give a parent of or person standing in parental relation to a student enrolled in the district notice of an attack or incident for which a report is required under subsection (e) involving the student's information. Section 11.175 was added by Acts 2019, 86th Legislature, chapter 605 (Senate Bill 820), effective .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .