Bill > HB4231

This bill enhances cybersecurity requirements for retail public utilities that provide water or sewer services by adding several key provisions. The bill expands the Department of Information Resources' ability to provide network security services to include retail public utilities and adds a new subchapter to the Water Code establishing comprehensive cybersecurity standards. These standards include prohibiting direct internet connections for supervisory control and data acquisition (SCADA) systems, mandating cybersecurity authentication protocols, requiring annual cybersecurity training for employees with system access, and establishing mandatory security incident reporting within 48 hours of discovering unauthorized data access, ransomware introduction, or significant system disruptions. The bill also allows for security assessments and compliance audits by state agencies, with results to be reported to relevant commissions and kept confidential. Retail public utilities will have until September 1, 2027, to implement the direct internet connection restrictions, and the bill itself will take effect on September 1, 2025, giving utilities and state agencies time to prepare and develop necessary rules and infrastructure to comply with the new cybersecurity requirements.