Relating to the establishment of the Texas Cyber Command and the transfer to it of certain powers and duties of the Department of Information Resources.

Contracts

• State Contractors: Master Services Agreements (MSAs) must be audited immediately. The law requires compliance with TCC standards for any vendor with access to state systems.
• Subcontractors: You must amend downstream vendor agreements. The definition of "Contractor" explicitly includes subcontractors; you are contractually liable if your sub-vendors fail to complete TCC-certified training.
• Cloud Services: State agencies are statutorily prohibited from contracting with cloud vendors (SaaS, PaaS, IaaS) that do not maintain TX-RAMP certification. Loss of certification constitutes grounds for immediate contract termination.

Hiring/Training

• Mandatory Certification: Generic corporate cybersecurity training is no longer sufficient for staff assigned to state contracts. You must implement a training program specifically certified by the TCC.
• Onboarding: Update onboarding protocols to ensure new hires assigned to state accounts complete this specific training before accessing state data.

Reporting & Record-Keeping

• 48-Hour Notification: Update your Incident Response Plan (IRP). You must report any "suspected" or confirmed breach to the TCC within 48 hours of discovery.
• Post-Incident Analysis: A detailed technical report, including root cause analysis, must be filed with the TCC within 10 business days of incident eradication.
• Training Verification: You must submit annual verification of training completion to the contracting state agency.

Fees & Costs

• Incident Response Billing: The TCC is authorized to recover "reasonable and practical" costs for technical assistance provided to covered entities during a cyber event.
• Insurance Gap: Review cyber liability policies. Standard policies often exclude "government-mandated cost recovery" or service fees charged by a state agency.