HB150

HB150 created the Texas Cyber Command as a separate state agency, effective September 1, 2025. It combines new incident-response capabilities with cybersecurity and network-security duties transferred from the Department of Information Resources (DIR). The governor appoints its chief with Senate consent for two-year terms; the first term ends February 1, 2027. The agency faces abolition September 1, 2031 unless continued through Sunset review. The governor signed the bill June 2, 2025. Final law, Sections 1, 50–51; official history.

What the command must provide: A cyber-threat intelligence center, an incident-response unit, a digital-forensics laboratory, a statewide reporting/management portal and a 24-hour hotline for state agencies and covered entities. Its work includes detecting attacks, containing malware, restoring systems, preserving evidence, supporting law enforcement, sharing threat information and training. It may arrange administrative support and a San Antonio facility with secure space for classified information through another state agency. The final law does not place it under the University of Texas System or require UTSA to administer it. Section 1, new Government Code 2063.002–.004 and .201–.205.

Who is covered: “Governmental entity” includes state agencies and local governments. The chapter’s state-agency definition includes executive and judicial agencies and public higher education, not legislative agencies. A “covered entity” is a private critical-infrastructure operator or local government contracting with the command for services. Separate network-security provisions permit agreements with the Legislature, local governments, specified schools, hospitals and other listed entities. Providing network services to higher-education institutions requires approval from the Information Technology Council for Higher Education. These are defined service routes, not a promise of free help to every business. Sections 1, 29–30 and 36.

Training and testing: Annual certified cybersecurity training generally applies to governmental officials and employees with access to the entity’s information resources or technology, replacing the former 25%-of-work computer-use threshold for covered employees. Exceptions include military and federal family/medical leave; specified other leave or alternative-work arrangements without system access; and people denied access for noncompliance. School districts retain a special rule: the cybersecurity coordinator trains annually, while other covered employees train on the district’s schedule. State contractors with system access must complete training during the contract and renewal periods. Information-resources employees also face mandatory training established by the command. Agencies other than public higher-education institutions must undergo an information-security assessment and penetration test—an authorized test for vulnerabilities—at least every two years. Sections 1, 4–6 and 19.

Staffing restriction: The command must adopt policies excluding non-U.S. citizens from being members, employees, contractors, volunteers or otherwise affiliated with the command or entities it establishes or operates under this chapter. This is broader than a restriction on access to classified information alone. New Section 2063.101(c).

Reporting, information and privacy: Existing incident-reporting duties move to the command, including notification within 48 hours after discovery and a detailed report within ten business days after eradication, closure and recovery. They apply to state agencies/local governments maintaining the specified protected computerized data; election-data incidents have a secretary-of-state notification route, and the law retains an exception for local incidents required to be reported to the designated electricity-system organization. These deadlines were not invented by HB150. The definition also covers other cybersecurity occurrences designated by command policy. Agencies retain security officers, vulnerability reports, security plans and testing for websites/apps handling protected information. The command must prioritize agency cybersecurity projects for funding in an October 1 report in even-numbered years and provide other biennial reports. Sections 1, 9–13 and 35.

Security plans, vulnerability reports and specified shared/response information remain protected from public disclosure. HB150 deletes the express sentence making a separate, non-sensitive vulnerability-report summary available on request; that deletion should not be described as abolishing every public-information right. It expressly says the new chapter does not generally change confidentiality/privilege laws or enlarge state government’s right to demand people’s information, records or communications. New Sections 2063.011, .204, .301–.303, .403 and .510.

Existing programs move, rather than start from scratch: The command takes over training certification, the cybersecurity council, cloud-service security assessment/authorization, the volunteer incident-response team and regional security centers. Cloud vendors must demonstrate and maintain compliance to obtain or renew covered state contracts. Volunteers remain subject to screening, confidentiality and written acceptance of deployments; their existing good-faith civil-damages protection excludes wilful and wanton misconduct and applies during deployment. Regional-center participation is by agreement; expansion beyond one center requires a finding that the first delivers its contracted services. The council includes the Elections Division director, DIR and legislative/governor representatives, with staggered six-year terms. Sections 4, 7 and 14–18.

Network security, purchasing and costs: The command takes over the state network-security center and its monitoring/response services. Where it supplies network services, it handles external threats while the customer agency/entity remains responsible for internal threats. Agencies cannot buy other network-security services unless the command finds its center cannot meet the need at comparable cost. DIR keeps proportional billing responsibilities and must coordinate with the command when carrying out a governor’s qualifying Internet-disconnection order. Separately, the command cannot require governmental entities to buy a particular cybersecurity system or resource. Emergency purchases bypass three specified procurement provisions—not all procurement law—and require notice, retained records and a state-auditor report within 90 days. Sections 1 and 28–48.

Transition and repeals: DIR continues the old duties until the date set by the required transfer agreement. That agreement was due January 1, 2026; the transfer of covered work, employees, funds, property, rules and contracts must occur no later than December 31, 2026, with safeguards against unnecessary disruption. HB150 repeals the old DIR cybersecurity-coordinator provision, certain superseded duties and the Cyberstar recognition program; it does not repeal cybersecurity training certification. Related school, grant-compliance, personnel-screening, agency-planning and fee statutes are updated to fit the new structure. This briefing describes the legal timetable, not proof that the transfer, hiring or facilities are complete. Sections 19–27 and 47–51.