HB1500

Effective September 1, 2025, HB1500 continues the Department of Information Resources (DIR) until its next Sunset abolition date, September 1, 2037, unless continued again. DIR helps public entities plan, buy and operate technology. The act also removes the provision that would have expired its entire enabling chapter at Sunset. Final law

Board and customer oversight. The board becomes 11 members: seven voting and four nonvoting. The governor appoints the nonvoting customer representatives: one higher-education employee, two employees from agencies on DIR’s top-ten customer-spending list, and one employee of an agency with fewer than 500 full-time employees. The old rotating ex-officio arrangement is replaced; the higher-education seat moves from voting to nonvoting. Transition provisions address vacancies and appointments, including December 1, 2025 deadlines for one voting and the higher-education nonvoting appointment.

Board members must complete required training and acknowledgments before participating, with a December 1, 2025 cutoff for previously trained members to complete the added subjects. DIR must issue an annually reviewed training manual. Advisory committees must cover purchasing, information security and statewide technology planning, with rules for membership, conflicts and public input. A customer committee specifically represents agencies with 500 or fewer employees, including at least three members from agencies with 150 or fewer. These committee thresholds differ from the board’s “fewer than 500” seat.

Purchasing support, not a takeover. DIR and the comptroller must develop a voluntary technology-purchasing certification course, offered in person at least quarterly to people holding the specified purchasing/contract-management certifications. DIR must also offer annual training for agency leaders, but cannot require their participation under this provision.

A new procurement-assistance pilot helps approved agencies with planning, cost estimates and solicitations. DIR may limit participation and types of purchases; higher-education institutions are excluded. DIR may not control the procurement or resulting contract. Its civil-liability protection excludes intentional conduct and gross negligence. A legislative report is due December 1, 2028, and the pilot statute expires January 1, 2029.

Finding state assistance. The comptroller, working with DIR, must develop a searchable, standard-format system for advertising state assistance opportunities on the Electronic State Business Daily. “Assistance” includes grants and other specified awards; higher education/university systems and the three named health-and-human-services agencies may opt in under the stated conditions. The law replaces older grant-database/e-grants provisions. It does not itself create a new grant entitlement or promise that one application applies to every program.

Technology reporting and services. DIR must sample at least five agencies’ information-resources deployment reviews every two years to check accuracy; site visits are not required. Agencies must report how their technology manager fits into executive leadership, with an organizational chart. The act revises complaint handling and reporting, separates the data-governance assessment from security testing, and sets the data-governance report deadline at June 1 of even-numbered years. Related assessment records remain confidential.

Other changes define technology services for cooperative purchasing, let specified comptroller and Agriculture systems elect into shared-technology arrangements, and make agency use of the Capitol Complex telephone system optional while retaining DIR’s duty to provide it. It modernizes directory cost recovery and repeals old pay-telephone, unlisted-number and terminal-equipment provisions. It also updates disability-related wording without removing the stated accessibility obligations and existing significant-difficulty/expense qualification. Government Code 2054, including the retained service and reporting provisions

Cybersecurity requires reading the companion law too. HB1500’s text removes the “25 percent of duties” computer-use threshold from annual cybersecurity training and requires covered state agencies to undergo an information-security assessment and a penetration test—a controlled test for exploitable weaknesses—at least every two years. Higher education is excluded from that particular testing provision.

But HB1500 must not be read as leaving all cybersecurity authority permanently at DIR. Its conflict clause defers to the described Texas Cyber Command legislation. HB150 separately establishes the Command as a standalone state agency, transfers most relevant functions under a staged process due by December 31, 2026, and carries parallel testing requirements in Government Code 2063.409. Its annual-training rule in 2063.103 is tied to officials/employees with access to the entity’s information resources, with statutory exceptions; school districts also have a specific scheduling provision. This is not a claim that every public employee without exception must take annual training or that the transfer was complete on September 1, 2025. HB150 final law, including sections 5, 19 and 50 · Government Code 2063 · Sunset Commission’s final-results explanation