SB75

SB75 creates a Texas Grid Security Commission to assess major threats and recommend resilience measures, and requires new exercises preparing for physical attacks on critical electric facilities. Signed June 20, 2025, it took effect immediately. It is a planning, reporting and preparedness law—not a declaration that the grid has been upgraded or made outage-proof. Official history; final law.

The new commission reports to the chief of the Texas Division of Emergency Management. It includes representatives of that division, the Public Utility Commission, the Railroad Commission, ERCOT, power generators and the transmission/distribution sector, including cooperatives, municipal utilities and river authorities. Additional government or organized-volunteer representatives may be included at the presiding officer’s discretion, and outside experts may advise it.

Its assessment covers severe weather, earthquakes, physical and cyberattacks, manipulation of control systems, electromagnetic threats, fuel-supply vulnerabilities and insider threats. It must evaluate the ERCOT grid’s critical infrastructure and municipalities’ essential services, including water, health care, communications, transportation and energy. It must also examine nuclear-site resilience, relevant security standards, lessons from other places and available university expertise, and identify ways to involve the Texas National Guard in cybersecurity response.

By December 1, 2026, it must send lawmakers recommended resilience standards—with implementation cost estimates, consequences of not implementing them and a timetable—and an all-hazards protection plan. The plan must address additional weatherization recommendations, cyber safeguards, electromagnetic-pulse protection and supporting industries. It must recommend standards for both alternating-current and direct-current micro-grids, meaning locally connected groups of power resources and users. These are recommendations; SB75 does not itself order every proposed equipment upgrade or replace existing weatherization requirements.

A separate, nonclassified threat-and-mitigation report is due each January 1 to lawmakers, the governor and the Public Utility Commission and must be made public. An information-security working group determines confidentiality and access. Three specified representatives must apply for federal security clearances; those granted clearances join the group. Confidential information is exempt from the public-information law, and meetings involving its discussion are exempt from the open-meetings law. The commission must balance transparency with security. This description states the statutory duties, not that reports, clearances or implementation are already complete.

The Public Utility Commission and ERCOT must conduct physical-attack exercises with generation and transmission/distribution providers at least once every two years, in addition to existing summer and winter load-shedding exercises and North American Electric Reliability Corporation standards. The first required exercise with each provider is due by December 31, 2026. “Critical facility” here means a transmission substation and associated control centers whose loss could trigger widespread grid instability or cascading outages. Exercises must identify utility, law-enforcement, ERCOT and regulator responsibilities. Participating providers must attest in writing that they coordinated with law enforcement; transmission/distribution providers need not disclose exact critical-substation locations for these exercises.