Texas · Through 89th 2nd Called Legislative Session, 2025

Tex. Government Code § 2063.405: DATA SECURITY PLAN FOR ONLINE AND MOBILE APPLICATIONS.

(a) Each state agency implementing an Internet website or mobile application that processes any sensitive personal or personally identifiable information or confidential information must:
(1) submit a biennial data security plan to the command not later than June 1 of each even-numbered year to establish planned beta testing for the website or application; and
(2) subject the website or application to a vulnerability and penetration test and address any vulnerability identified in the test.
(b) The command shall review each data security plan submitted under Subsection (a) and make any recommendations for changes to the plan to the state agency as soon as practicable after the command reviews the plan.
Added by Acts 2017, 85th Leg., R.S., Ch. 683 (H.B. 8), Sec. 11, eff. September 1, 2017.
Added by Acts 2017, 85th Leg., R.S., Ch. 955 (S.B. 1910), Sec. 5, eff. September 1, 2017.
Reenacted and amended by Acts 2019, 86th Leg., R.S., Ch. 467 (H.B. 4170), Sec. 8.016, eff. September 1, 2019.
Reenacted and amended by Acts 2019, 86th Leg., R.S., Ch. 509 (S.B. 64), Sec. 16, eff. September 1, 2019.
Amended by:
Acts 2021, 87th Leg., R.S., Ch. 856 (S.B. 800), Sec. 11, eff. September 1, 2021.
Transferred, redesignated and amended from Government Code, Section 2054.516 by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 13, eff. September 1, 2025.

Where this section sits in the code

GOVERNMENT CODE
TITLE 10. GENERAL GOVERNMENT
SUBTITLE B. INFORMATION AND PLANNING
CHAPTER 2063. TEXAS CYBER COMMAND
SUBCHAPTER E. CYBERSECURITY PREPARATION AND PLANNING

(a) Each state agency implementing an Internet website or mobile application that processes any sensitive personal or personally identifiable information or confidential information must:

(1) submit a biennial data security plan to the command not later than June 1 of each even-numbered year to establish planned beta testing for the website or application; and

(2) subject the website or application to a vulnerability and penetration test and address any vulnerability identified in the test.

(b) The command shall review each data security plan submitted under Subsection (a) and make any recommendations for changes to the plan to the state agency as soon as practicable after the command reviews the plan.

Added by Acts 2017, 85th Leg., R.S., Ch. 683 (H.B. 8), Sec. 11, eff. September 1, 2017.

Added by Acts 2017, 85th Leg., R.S., Ch. 955 (S.B. 1910), Sec. 5, eff. September 1, 2017.

Reenacted and amended by Acts 2019, 86th Leg., R.S., Ch. 467 (H.B. 4170), Sec. 8.016, eff. September 1, 2019.

Reenacted and amended by Acts 2019, 86th Leg., R.S., Ch. 509 (S.B. 64), Sec. 16, eff. September 1, 2019.

Amended by:

Acts 2021, 87th Leg., R.S., Ch. 856 (S.B. 800), Sec. 11, eff. September 1, 2021.

Transferred, redesignated and amended from Government Code, Section 2054.516 by Acts 2025, 89th Leg., R.S., Ch. 331 (H.B. 150), Sec. 13, eff. September 1, 2025.

Collected 2026-08-27T01:47:16Z. Source file · JSON

Browse this collection