(a) Definitions. The following words and terms, when used in this section, shall have the following meanings, unless the context clearly indicates otherwise.
  (1) "Cybersecurity incident" means any observed occurrence in an information system, whether maintained by the trust company or by an affiliate or third party service provider at the direction of the trust company, that:
    (A) jeopardizes the cybersecurity of the information system or the information the system processes, stores or transmits; or
    (B) violates the security policies, security procedures or acceptable use policies of the information system owner to the extent such occurrence results from unauthorized or malicious activity.
  (2) "Information system" means a set of applications, services, information technology assets or other information-handling components organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, including the operating environment as well as any specialized system such as telephone switching or exchange systems and environmental control systems.
(b) Notice required. A state trust company shall notify the banking commissioner and submit the information required by subsection (c) of this section as soon as practicable but prior to customer notification, and not later than 15 days following the trust company's determination that a cybersecurity incident regarding the trust company's information system will likely:
  (1) require submission of a notice or report to another state or federal regulatory agency or to a self-regulatory body other than the notice required by this section;
  (2) require sending a data breach notification to trust company clients or beneficiaries of trusts and custodial arrangements handled by the trust company under applicable state or federal law, including Business and Commerce Code, §521.053, or a similar law of another state; or
  (3) substantively impact the ability of the state trust company to effect transactions on behalf of its clients or beneficiaries of trusts and custodial arrangements handled by the trust company, accurately report transactions to clients and beneficiaries, or otherwise conduct trust company business.
(c) Content of notice. The confidential notice required by subsection (b) of this section must include, to the extent known at the time of submission:
  (1) a brief description of the cybersecurity incident, including the approximate date of the incident, the date the incident was discovered, and the nature of any data that may have been illegally obtained or accessed;
  (2) subject to subsection (d) of this section, a list of the state and federal regulatory agencies, self-regulatory bodies, and foreign regulatory agencies to whom notice has been or will be provided; and
  (3) the name, address, telephone number, and email address of the employee or agent of the trust company from whom additional information may be obtained regarding the incident.
(d) Omission of certain information. The filing of a suspicious activity report (SAR) related to the cybersecurity incident under applicable federal law constitutes a notice described by subsection (b)(1) of this section. However, the trust company should not reference or mention the filing of a SAR in the notice filed with the commissioner.
(e) Incident response plan. The notice requirement imposed by this section must be incorporated into the trust company's written incident response plan, maintained as part of the trust company's information security program.
(f) Exemptions. This section does not apply to a state trust company that is exempt under Finance Code, §182.011.

Source Note: The provisions of this §17.5 adopted to be effective January 2, 2020, 44 TexReg 8234