Relating to the reporting of certain security incidents by public water systems to the Texas Commission on Environmental Quality and the Department of Information Resources.
Summary
SB 1625 would expand and clarify the incident-reporting duties of public water supply and wastewater systems in Texas. It requires system operators to maintain internal procedures to immediately notify the Texas Commission on Environmental Quality (TCEQ) when certain events occur that could affect safe and adequate water service, including unauthorized entry, terrorism, theft, natural disasters, outages, boil-water or do-not-use advisories, and other disruptions. The bill also adds a separate category of reportable security incidents involving sensitive personal information, ransomware, attempts to access proprietary information, or computer/network problems that disrupt operations.
The bill further directs TCEQ to establish procedures to report each of the newly defined security incidents to the Department of Information Resources (DIR). It also preserves an existing exception so that nonindustrial public water systems are not required to report ordinary weather or emergency alerts issued by federal or state warning agencies. The act would take effect September 1, 2025, and it amends Section 341.033 of the Health and Safety Code.
Impact
SB 1625 would amend Texas Health and Safety Code Section 341.033 to broaden mandatory notification requirements for public water and wastewater systems, adding cybersecurity and data-breach-related incidents to the list of events that must be reported to TCEQ. It creates a new state reporting pathway from TCEQ to DIR for security incidents, linking water utility oversight with state cybersecurity coordination. Affected parties include public water supply systems, wastewater systems, TCEQ, DIR, and potentially local utility operators that must update internal incident-response and reporting procedures.
Sentiment
The available legislative history suggests the bill moved forward without recorded opposition in the provided vote data, and there are no committee transcript snippets indicating controversy. The measure appears to have been treated as a public-safety and infrastructure-security bill, with support implied by its advancement through the House and referral to Calendars. Overall sentiment appears neutral to favorable, focused on strengthening reporting and coordination rather than imposing a major policy shift.
Contention
The main potential point of contention is the added compliance burden on public water and wastewater systems, especially smaller operators that may need to revise procedures to identify and report cybersecurity incidents, data disclosures, and operational disruptions. Another possible issue is the breadth of the new reporting triggers, including attempts to access proprietary information and computer-system problems, which could raise questions about what events qualify and how quickly notice must be given. The bill also preserves an exemption for weather and emergency alerts, suggesting lawmakers were attentive to avoiding over-reporting of routine warnings.