1. (a) Each state agency shall develop, and periodically update, an information security plan for protecting the security of the agency's information.

2. (b) In developing the plan, the state agency shall:

   1. (1) consider any vulnerability report prepared under Section 2063.303 for the agency;
   2. (2) incorporate the network security services provided by the department to the agency under Chapter 2059;
   3. (3) identify and define the responsibilities of agency staff who produce, access, use, or serve as custodians of the agency's information;
   4. (4) identify risk management and other measures taken to protect the agency's information from unauthorized access, disclosure, modification, or destruction;

   5. (5) include:

      1. (A) the best practices for information security developed by the command; or
      2. (B) if best practices are not applied, a written explanation of why the best practices are not sufficient for the agency's security; and
   6. (6) omit from any written copies of the plan information that could expose vulnerabilities in the agency's network or online systems.
3. (c) Not later than June 1 of each even-numbered year, each state agency shall submit a copy of the agency's information security plan to the command. Subject to available resources, the command may select a portion of the submitted security plans to be assessed by the command in accordance with command policies.
4. (d) Each state agency's information security plan is confidential and exempt from disclosure under Chapter 552.
5. (e) Each state agency shall include in the agency's information security plan a written document that is signed by the head of the agency, the chief financial officer, and each executive manager designated by the state agency and states that those persons have been made aware of the risks revealed during the preparation of the agency's information security plan.

6. (f) Not later than November 15 of each even-numbered year, the command shall submit a written report to the governor, the lieutenant governor, the speaker of the house of representatives, and each standing committee of the legislature with primary jurisdiction over matters related to the command evaluating information security for this state's information resources. In preparing the report, the command shall consider the information security plans submitted by state agencies under this section, any vulnerability reports submitted under Section 2063.303, and other available information regarding the security of this state's information resources. The command shall omit from any written copies of the report information that could expose specific vulnerabilities.

   Transferred, redesignated and amended from Government Code, Section 2054.133 by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 12, eff. September 1, 2025.

Added by Acts 2013, 83rd Leg., R.S., Ch. 1222 (S.B. 1597), Sec. 1, eff. September 1, 2013.

Acts 2015, 84th Leg., R.S., Ch. 369 (S.B. 34), Sec. 1, eff. September 1, 2015.

Acts 2017, 85th Leg., R.S., Ch. 683 (H.B. 8), Sec. 10, eff. September 1, 2017.

Acts 2017, 85th Leg., R.S., Ch. 955 (S.B. 1910), Sec. 3, eff. September 1, 2017.

Acts 2019, 86th Leg., R.S., Ch. 509 (S.B. 64), Sec. 15, eff. September 1, 2019.

Acts 2019, 86th Leg., R.S., Ch. 573 (S.B. 241), Sec. 1.14, eff. September 1, 2019.