Bill > SB1034

This bill enhances cybersecurity requirements for retail public utilities that provide water or sewer services by making several key changes. The bill adds retail public utilities to the list of entities eligible for network security services from the Department of Information Resources and introduces a new subchapter in the Water Code establishing comprehensive cybersecurity standards. These standards include prohibiting direct internet connections for supervisory control and data acquisition (SCADA) systems, except through secure virtual private networks, and requiring the development of employee authentication protocols for network access. The bill mandates that utilities conduct annual cybersecurity training for employees with computer system access, undergo potential security assessments and compliance audits, and report any significant security incidents within 48 hours, such as unauthorized data acquisitions, ransomware attacks, or system breaches that disrupt service. The Texas Commission on Environmental Quality, in consultation with the Department of Information Resources and the Cyber Center for Security and Analytics, will develop and periodically review these rules. Utilities will have until September 1, 2027, to fully implement the SCADA system connection restrictions, with the overall act taking effect on September 1, 2025, aimed at protecting critical water and sewer infrastructure from potential cyber threats.