Cybersecurity for retail public utilities that provide water or sewer service

Texas Senate Bill 1034 (SB1034) aims to enhance cybersecurity measures for retail public utilities that provide water or sewer services. The bill proposes several key provisions: 1) Prohibiting these utilities from connecting their supervisory control and data acquisition (SCADA) systems directly to the internet, requiring the use of secure intranet or virtual private network (VPN) connections instead. 2) Mandating cybersecurity training for employees with access to these systems. 3) Requiring periodic security audits and risk assessments. 4) Establishing incident reporting requirements for security breaches, including ransomware attacks. 5) Authorizing the Texas Commission on Environmental Quality (TCEQ) to adopt rules ensuring compliance with these requirements.

Supporters of SB1034 argue that the bill is a proactive step toward safeguarding critical infrastructure from cyber threats. By implementing stringent cybersecurity protocols, the legislation aims to protect water and sewer services from potential cyberattacks, thereby ensuring the safety and reliability of essential public utilities. The inclusion of mandatory training and regular audits is seen as a comprehensive approach to maintaining robust security standards.

Critics of SB1034 express concerns about the potential financial and operational burdens the bill may impose on retail public utilities, especially smaller entities with limited resources. The requirements for secure network configurations, employee training, and regular audits could lead to increased costs and administrative challenges. Additionally, some argue that the bill's provisions may be too prescriptive, limiting the flexibility of utilities to implement cybersecurity measures tailored to their specific needs.