Bill Text: TX SB2013 | 2023-2024 | 88th Legislature | Enrolled

---

Bill Title: Relating to access to and the security of certain critical infrastructure.

Spectrum: Partisan Bill (Republican 7-0)

Status: (Passed) 2023-06-09 - Effective immediately [SB2013 Detail]

Download: Texas-2023-SB2013-Enrolled.html

---

S.B. No. 2013

AN ACT
relating to access to and the security of certain critical
infrastructure.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Section 113.001, Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021, is amended by adding Subdivision (5) to read
as follows:
(5) "Affiliate," with respect to a company entering
into an agreement in which the critical infrastructure is electric
grid equipment, has the meaning assigned by the protocols of the
independent organization certified under Section 39.151, Utilities
Code, for the ERCOT power region.
SECTION 2. Subchapter F, Chapter 411, Government Code, is
amended by adding Section 411.1183 to read as follows:
Sec. 411.1183. ACCESS TO CRIMINAL HISTORY RECORD
INFORMATION: INDEPENDENT ORGANIZATION CERTIFIED UNDER UTILITIES
CODE. (a) An independent organization certified under Section
39.151, Utilities Code, for security reasons is entitled to obtain
from the department criminal history record information maintained
by the department that relates to a person who has or is seeking
employment at or access to the independent organization's systems
that affect the security of the electric grid or any other
background information maintained by the department that relates to
the person that is considered necessary by the independent
organization or required by the Public Utility Commission.
(b) Information obtained from the department under this
section may not be released or disclosed except:
(1) as needed in protecting the security of the
electric grid;
(2) as authorized by a court order or a federal or
state law or order; or
(3) with the consent of the person who is the subject
of the criminal history record information.
SECTION 3. Section 2274.0101, Government Code, as added by
Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
Session, 2021, is amended by amending Subdivision (5) and adding
Subdivision (6) to read as follows:
(5) "Governmental entity" means a state agency, a [or]
political subdivision, or an independent organization certified
under Section 39.151, Utilities Code, to perform a function
described by Section 39.151(a), Utilities Code [of this state].
(6) "Affiliate," with respect to a company entering
into an agreement in which the critical infrastructure is electric
grid equipment, has the meaning assigned by the protocols of the
independent organization certified under Section 39.151, Utilities
Code, for the ERCOT power region.
SECTION 4. Section 39.151, Utilities Code, is amended by
adding Subsection (g-7) to read as follows:
(g-7) To maintain certification as an independent
organization under this section, the organization must:
(1) identify all employee positions in the
organization that are critical to the security of the electric
grid; and
(2) before hiring a person for a position described by
Subdivision (1), obtain from the Department of Public Safety or a
private vendor criminal history record information relating to the
prospective employee and any other background information
considered necessary by the independent organization or required by
the commission.
SECTION 5. Subchapter H, Chapter 39, Utilities Code, is
amended by adding Section 39.360 to read as follows:
Sec. 39.360. TRANSACTIONS WITH CERTAIN FOREIGN-OWNED
COMPANIES IN CONNECTION WITH CRITICAL INFRASTRUCTURE. (a) In this
section, "company" and "critical infrastructure" have the meanings
assigned by Section 113.001, Business & Commerce Code, as added by
Chapter 975 (S.B. 2116), Acts of the 87th Legislature, Regular
Session, 2021.
(b) An independent organization certified under Section
39.151 may not register a business entity or maintain the
registration of a business entity to operate in the power region for
which the independent organization is certified unless the business
entity attests that the entity complies with Chapter 113, Business &
Commerce Code, as added by Chapter 975 (S.B. 2116), Acts of the
87th Legislature, Regular Session, 2021.
(c) An independent organization certified under Section
39.151 shall require as a condition of operating in the power region
for which the independent organization is certified that a business
entity report to the independent organization the purchase of any
critical electric grid equipment or service from a company
described by Section 113.002(a)(2), Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021.
(d) For each purchase reported by a business entity under
Subsection (c), the business entity shall submit an attestation to
the independent organization that the purchase will not result in
access to or control of its critical electric grid equipment by a
company described by Section 113.002(a)(2), Business & Commerce
Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
Legislature, Regular Session, 2021, excluding access specifically
allowed by the business entity for product warranty and support
purposes.
(e) Notwithstanding any other law, an independent
organization certified under Section 39.151 may immediately
suspend or terminate a company's registration or access to any of
the independent organization's systems if the independent
organization has a reasonable suspicion that the company meets any
of the criteria described by Section 2274.0102(a)(2), Government
Code, as added by Chapter 975 (S.B. 2116), Acts of the 87th
Legislature, Regular Session, 2021.
(f) A contractual provision that limits or contradicts
Subsection (e) is contrary to public policy and is unenforceable
and void.
(g) An independent organization certified under Section
39.151 may adopt guidelines or procedures relating to the
requirements in this section, including the qualification of
electric grid equipment or services as critical.
(h) The commission shall adopt any rules necessary to
administer this section or authorize an independent organization to
carry out a duty imposed by this section.
(i) The attorney general may conduct periodic audits of the
attestations required by Subsection (d) and may prioritize the
audits as necessary to protect critical infrastructure.
SECTION 6. The changes made by this Act to Chapter 113,
Business & Commerce Code, and Chapter 2274, Government Code, apply
only to a contract or agreement entered into on or after the
effective date of this Act.
SECTION 7. (a) For the purposes of Section 39.360(c),
Utilities Code, as added by this Act, a business entity operating in
a power region on the effective date of this Act shall report to the
independent organization certified for that power region under
Section 39.151, Utilities Code, any purchase made within the five
years preceding the effective date of this Act.
(b) For any past purchase reported by a business entity as
described by Subsection (a) of this section, the business entity
shall take reasonable and necessary actions to mitigate access to
or control of its critical electric grid equipment by a company
described by Section 113.002(a)(2), Business & Commerce Code, as
added by Chapter 975 (S.B. 2116), Acts of the 87th Legislature,
Regular Session, 2021, excluding access specifically allowed by the
business entity for product warranty and support purposes, and
report those actions to the independent organization.
SECTION 8. It is the intent of the 88th Legislature, Regular
Session, 2023, that the amendments made by this Act be harmonized
with another Act of the 88th Legislature, Regular Session, 2023,
relating to nonsubstantive additions to and corrections in enacted
codes.
SECTION 9. This Act takes effect immediately if it receives
a vote of two-thirds of all the members elected to each house, as
provided by Section 39, Article III, Texas Constitution. If this
Act does not receive the vote necessary for immediate effect, this
Act takes effect September 1, 2023.
______________________________ ______________________________
President of the Senate Speaker of the House
I hereby certify that S.B. No. 2013 passed the Senate on
April 4, 2023, by the following vote: Yeas 31, Nays 0; and that
the Senate concurred in House amendment on May 25, 2023, by the
following vote: Yeas 31, Nays 0.
______________________________
Secretary of the Senate
I hereby certify that S.B. No. 2013 passed the House, with
amendment, on May 23, 2023, by the following vote: Yeas 142,
Nays 1, one present not voting.
______________________________
Chief Clerk of the House
Approved:
______________________________
Date
______________________________
Governor