Regular Session
Government Affairs & Regulatory Compliance Analysis
HB150 centralizes state cybersecurity oversight under the newly created Texas Cyber Command (TCC), stripping these powers from the Department of Information Resources (DIR). This legislation imposes strict new mandates on state contractors and private "critical infrastructure" entities, including a 48-hour incident reporting window, mandatory TCC-certified employee training, and statutory authority for the state to bill private companies for incident response costs.
Rep. Giovanni Capriglione·House Bill·Regular Session
Department of Information Resources (during transition period) • Texas Cyber Command
This legislation has regulatory implications for the following Texas businesses and organizations:
Significant regulatory changes (effective 2025-06-02). Review with your legal and compliance teams to understand implications.
Affected business types:
mediumModerate costs expected for implementation.
JD Key Consulting provides government affairs and regulatory strategy services. We help businesses navigate Texas agencies, understand legislative impacts, and advocate for their interests.
JD Key Consulting provides strategic guidance on Texas regulatory compliance and legislative impact for your business.
Key implementation requirements and action items for compliance with this legislation
JD Key Consulting specializes in Texas regulatory compliance strategy. Work directly with James Dickey—former Chairman of the Republican Party of Texas—to understand this bill's impact on your operations and develop an actionable compliance plan.
Schedule a ConsultationInformation presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.
This bill's path through the Texas Legislature
Showing first 50k characters.
View bill text in multiple formats on Texas Legislature websiteExplore more bills from this author and on related topics
Common questions about HB150
HB150 centralizes state cybersecurity oversight under the newly created Texas Cyber Command (TCC), stripping these powers from the Department of Information Resources (DIR). This legislation imposes strict new mandates on state contractors and private "critical infrastructure" entities, including a 48-hour incident reporting window, mandatory TCC-certified employee training, and statutory authority for the state to bill private companies for incident response costs.
HB150 was authored by Texas Representative Giovanni Capriglione during the Regular Session.
HB150 was signed into law by Governor Greg Abbott on June 2, 2025.
HB150 is enforced by Department of Information Resources (during transition period) and Texas Cyber Command.
The regulatory priority for HB150 is rated as "critical". Businesses and organizations should review the legislation to understand potential impacts.
The cost impact of HB150 is estimated as "medium". This may vary based on industry and implementation requirements.
HB150 addresses topics including education, education--higher, education--higher--institutions & programs, electronic information systems and governor.
Key dates for HB150: Effective date is 2025-06-02. Rulemaking: Must enter into a Memorandum of Understanding with DIR to detail the transfer of powers, assets, and personnel. (2026-01-01); Adopt rules prescribing categories of cloud computing services subject to the state risk and authorization management program (TX-RAMP) and certification requirements. (Ongoing). Consult with legal counsel regar
HB150 establishes the following penalties: administrative/financial penalty of Repayment of grant award + 2-year grant ineligibility for Local governments failing to comply with cybersecurity training requirements (Sec. 772.012).; operational penalty of Denial of access to information resources for Government employees or officials failing to comply with annual cybersecurity training requirements (Sec. 2063.103).; contractual penalty of Contract termination or breach for State contractors failing to complete certified cybersecurity training or failing to maintain cloud computing certification (TX-RAMP) (Sec. 2063.104; Sec. 2063.408).. Consult with legal counsel for specific applicability to your situation.
HB150 primarily affects technology companies and data processors. These businesses should review the legislation with their legal and compliance teams to understand potential impacts.
JD Key Consulting is an Austin, Texas-based government affairs firm led by James Dickey, former Chairman of the Republican Party of Texas. We specialize in Texas regulatory compliance and legislative strategy for data centers, energy, banking, and manufacturing.
