SB 1686

relating to requiring the cybersecurity council to conduct a study
concerning the cybersecurity of school districts.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1.  DEFINITION.  In this Act, "council" means the
cybersecurity council established under Section 2054.512,
SECTION 2.  STUDY CONCERNING CYBERSECURITY OF SCHOOL
DISTRICTS.  (a)  The council shall conduct a study to determine:
(1)  how school districts can improve their ability to
protect against cybersecurity risks and threats; and
(2)  how school districts can address rising
(b)  The council may, if necessary and as appropriate,
partner with a nonprofit entity or institution of higher education,
as defined by Section 61.003, Education Code, to conduct the study.
(c)  In conducting the study, the council shall consider:
(1)  the current best practices used by school
districts for cybersecurity controls for their information systems
to protect against vulnerabilities and to address rising
(2)  barriers or challenges for school districts in
purchasing or acquiring cybersecurity products or services;
(3)  the availability of resources school districts
need to respond to and recover from a cybersecurity event;
(4)  the impact of cybersecurity incidents that have
affected school districts, including the resulting costs to school
(5)  to the extent possible, any emerging cybersecurity
risks and threats to school districts resulting from the deployment
(6)  any other issues the council determines would have
a future impact on cybersecurity for school districts.
SECTION 3.  REPORT.  Not later than September 1, 2026, the
council shall prepare and submit to the governor, the lieutenant
governor, the speaker of the house of representatives, and the
legislature a written report that contains:
(1)  the results of the study conducted under Section 2
of this Act, including the amount of money school districts are
paying for cybersecurity insurance in this state; and
(2)  recommendations for best practices and controls
for school districts to implement in order to:
(A)  update and protect their information systems
against cybersecurity risks and threats; and
(B)  address rising cybersecurity costs.
SECTION 4.  EXPIRATION OF ACT.  This Act expires September 1,
SECTION 5.  EFFECTIVE DATE.  This Act takes effect
immediately if it receives a vote of two-thirds of all the members
elected to each house, as provided by Section 39, Article III, Texas
Constitution.  If this Act does not receive the vote necessary for
immediate effect, this Act takes effect September 1, 2025.