The Senate Committee on Business & Commerce advanced a committee substitute to House Bill 150 that would create a standalone Texas Cyber Command, preserving local control over vendor choice and adding explicit reporting and confidentiality safeguards.

Senator Parker, explaining the substitute to the committee, said the measure establishes an independent, mission‑driven governance model for the command. “Independence removes any doubt about chain of command,” Parker told the panel, adding the new entity would be “subject to the same laws, appropriation controls, and sunset review as every other executive branch agency.”

The substitute allows the command to sign interagency agreements to obtain “back office administrative support” and to use a San Antonio facility with a secure compartmented information facility (SCIF) for sensitive work. It bars the command from requiring state or local entities to purchase a particular vendor’s software. “The command may not, by rule or guidance, require any governmental entity to buy a particular system or service,” Parker said.

To preserve rapid response during cyber incidents, the substitute retains emergency purchasing authority but places those purchases inside specified guardrails. The executive director must certify in writing that a bona fide cyber emergency exists and that normal procurement timelines would materially heighten risk. All such emergency purchases must be disclosed in a quarterly report to the Legislative Budget Board and the state auditor, the substitute says.

The substitute also clarifies that existing confidentiality protections remain in place. Parker said the text confirms that nothing in the chapter “alters attorney client privilege, criminal investigative files, student records protections, or any other confidentiality rules on the books. Sensitive data will stay protected. Period.”

On threat monitoring, the substitute permits the command to monitor external channels only for entities that contract for those services; the command will not place external sensors on a district or agency without the district’s request and written agreement. The substitute imports prior recommendations from the Department of Information Resources (DIR) sunset review and migrates incident disclosure standards, tabletop exercise requirements and audit follow‑up so those duties continue without a lapse as responsibilities move from DIR to the new command.

The substitute also outlines coordination with law enforcement. Parker said the command’s digital forensic laboratory would host liaison agents from the Department of Public Safety, the Attorney General’s office and, where appropriate, federal task forces to preserve digital evidence to courtroom standards. “When a breach rises to criminal conduct, the incident response unit will pivot from containment to evidentiary support,” she said.

Senator King moved adoption of the committee substitute. On a roll call the committee recorded 11 ayes and 0 nays; the substitute was adopted and reported favorably to the full Senate.

The committee’s action sends the substitute to the full Senate for consideration.