Meet Texas SB 820 school cybersecurity duties with confidence

Texas SB 820 is a 2019 state law requiring every Texas school district to adopt a cybersecurity policy. It added section 11.175 to the Texas Education Code, which requires districts to secure their cyberinfrastructure, determine cybersecurity risk and plan mitigation, designate a cybersecurity coordinator, report breaches of student information to the Texas Education Agency and notify affected parents.

All Texas public school districts must comply with SB 820. The superintendent must designate a cybersecurity coordinator, and the board adopts the district's cybersecurity policy. A 2021 amendment (SB 1696) extended the duty to report breaches to the Texas Education Agency to open-enrolment charter schools as well. Edtech suppliers are not directly bound, but districts often expect them to support these duties.

SB 820 took effect on 1 September 2019, after passing the Texas Senate and House in the 86th Legislature's regular session. Its requirements sit in section 11.175 of the Texas Education Code, which was later amended in 2021 by SB 1696, adding an anonymous incident sharing system, and SB 1267, which set annual training rules for the district cybersecurity coordinator.

The cybersecurity coordinator is the district's liaison with the Texas Education Agency on cybersecurity matters. The coordinator reports cyber attacks or incidents that amount to a breach of student information, notifies the parents of affected students, and, following a 2021 amendment, is the district employee who must complete state cybersecurity training every year.

Districts must report any cyber attack or other cybersecurity incident against their cyberinfrastructure that is a breach of system security, as soon as practicable after discovery. A breach of system security means student information that is sensitive, protected or confidential under state or federal law was stolen, copied, transmitted, viewed or used without authorisation. Parents of affected students must also be notified.

SB 820 does not set its own fines or financial penalties. Compliance is overseen by the Texas Education Agency, and the education commissioner may adopt rules to implement the section. A district that fails to protect student data can still face consequences under other state and federal laws, such as FERPA, and the reputational and operational cost of an incident.

SB 820 sets the legal duty but does not prescribe a control set, so many districts base their policy on a recognised framework such as the NIST Cybersecurity Framework or ISO 27001. The law requires that a district's policy must not conflict with the information security standards the Texas Department of Information Resources adopts for higher education institutions.

Texas SB 820 is mapped in OneClickComply's control library and available on request; it is not yet a self-serve framework in the product. Districts can use AutoComplete policy generation, the risk register, automated evidence collection and continuous monitoring to meet its policy, risk and incident duties, with guidance from our in-house auditors.