Law / United States / 
Texas
Texas Cyber Command, cybersecurity incident notification by a state agency or local government
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a state agency or a local government (as Government Code section 2054.003 defines it) that owns, licenses, or maintains computerized data that includes sensitive personal information, confidential information, or information the disclosure of which is regulated by law; it does not bind a private business.
- In the event of a cybersecurity incident, comply with the notification requirements of Business and Commerce Code section 521.053 to the same extent as a person who conducts business in Texas.
- Notify the Texas Cyber Command, including the chief, not later than 48 hours after the discovery of the cybersecurity incident, or notify the secretary of state if the incident involves election data, and comply with the command's rules on reporting cybersecurity incidents.
- Not later than the 10th business day after the eradication, closure, and recovery from the incident, notify the command of the details of the incident and include an analysis of its cause.
- A term in a cybersecurity insurance contract or other contract for goods or services that prohibits or restricts your compliance with this section is void and unenforceable.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state agency or local government that owns, licenses, or maintains computerized data that includes sensitive personal information, confidential information, or information the disclosure of which is regulated by law must, in the event of a cybersecurity incident, notify the Texas Cyber Command, including the chief, not later than 48 hours after the discovery of the incident.
If the cybersecurity incident involves election data, the state agency or local government notifies the secretary of state instead of the command. Not later than the 10th business day after the eradication, closure, and recovery from a cybersecurity incident, a state agency or local government shall notify the command of the details of the incident and include an analysis of its cause.
Section 2063.302 does not apply to a cybersecurity incident that a local government is required to report to the independent organization certified by the Public Utility Commission of Texas under Section 39.151 of the Utilities Code. Contract language in a cybersecurity insurance contract or other contract for goods or services that prohibits or restricts a state agency's or local government's compliance with the section, or otherwise circumvents its requirements, is void and unenforceable.
A cybersecurity incident includes a breach or suspected breach of system security, the introduction of ransomware into a computer, computer network, or computer system, and any other cybersecurity-related occurrence that jeopardizes information or an information system designated by command policy. Section 2063.302 was transferred, redesignated and amended from Government Code section 2054.603 by chapter 331 of the Acts of 2025, effective .