CYBERSECURITY TRAINING REQUIRED

(a) Each elected or appointed official and employee of a governmental entity who has access to the entity's information resources or information resources technologies shall annually complete a cybersecurity training program certified under Section 2063.102. (b) The governing body of a governmental entity or the governing body's designee may deny access to the governmental entity's information resources or information resources technologies to an employee or official who is noncompliant with the requirements of Subsection (a). (c) The governing body of a local government may select the most appropriate cybersecurity training program certified under Section 2063.102 for employees and officials of the local government to complete. The governing body shall: (1) verify and report on the completion of a cybersecurity training program by employees and officials of the local government to the command; and (2) require periodic audits to ensure compliance with this section. (d) A state agency may select the most appropriate cybersecurity training program certified under Section 2063.102 for employees and officials of the state agency. The executive head of each state agency shall verify completion of a cybersecurity training program by employees and officials of the state agency in a manner specified by the command. (e) The executive head of each state agency shall periodically require an internal review of the agency to ensure compliance with this section. (f) The command shall develop a form for use by governmental entities in verifying completion of cybersecurity training program and artificial intelligence training program requirements under this section. The form must allow the state agency and local government to indicate the percentage of employee and official completion. (g) The requirements of Subsection (a) do not apply to employees and officials who have been: (1) granted military leave; (2) granted leave under the federal Family and Medical Leave Act of 1993 (29 U.S.C. Section 2601 et seq.); (3) granted leave related to a sickness or disability covered by workers' compensation benefits, if that employee or official no longer has access to the governmental entity's information resources or information resources technologies; (4) granted any other type of extended leave or authorization to work from an alternative work site if that employee or official no longer has access to the governmental entity's information resources or information resources technologies; or (5) denied access to a governmental entity's information resources or information resources technologies under Subsection (b) for noncompliance with the requirements of Subsection (a).