EXCEPTION: CONFIDENTIALITY OF CYBERSECURITY MEASURES

(a) In this section: (1) "Critical infrastructure facility" has the meaning assigned by Section 551.0761. (2) "Cybersecurity" has the meaning assigned by Section 551.0761. (b) Information is excepted from the requirements of Section 552.021 if it is information that relates to: (1) a cybersecurity measure, policy, or contract solely intended to protect a critical infrastructure facility located in the jurisdiction of the governmental body; (2) coverage limits and deductible amounts for insurance or other risk mitigation coverages acquired for the protection of information technology systems, critical infrastructure, operational technology systems, or data of a governmental body or the amount of money set aside by a governmental body to self-insure against those risks; (3) cybersecurity incident information reported pursuant to state law; and (4) network schematics, hardware and software configurations, or encryption information or information that identifies the detection, investigation, or response practices for suspected or confirmed cybersecurity incidents if the disclosure of such information would facilitate unauthorized access to: (A) data or information, whether physical or virtual; or (B) information technology resources, including a governmental body's existing or proposed information technology system. (c) A governmental body may disclose information made confidential by this section to comply with applicable state or federal law or a court order. A governmental body that is required to disclose information described by Subsection (b) shall: (1) not later than the fifth business day before the date the information is required to be disclosed, provide notice of the required disclosure to the person or third party who owns the critical infrastructure facility or, in the event immediate disclosure is required, notify in writing the person or third party as soon as practicable but not later than the fifth business day after the information is disclosed; and (2) retain all existing labeling on the information being disclosed describing such information as confidential or privileged.