Texas HB 3834 and HB 3512 mandate annual cybersecurity and AI awareness training for state and local government staff and contractors
Huntress explains the compliance obligations of Texas law HB 3834, passed in June 2019. It requires state agency and local government employees, and state contractors, to complete a Department of Information Resources (DIR)-certified cybersecurity awareness training every year. Since September 1, 2025, HB 3512 adds a second annual requirement: DIR-certified AI awareness training. The article cites the August 2019 ransomware attack on 23 Texas municipalities (a reported $2.5 million demand) as the motivation, and Verizon's 2026 DBIR figure of 62% of breaches involving the human element. It is a vendor compliance and marketing piece with no new threat activity, vulnerability or IOCs.
Technical Details
- Scope, state agencies: employees who use a computer for at least 25% of their duties, plus elected or appointed officers.
- Scope, local governments: employees and officials with access to a local government computer system or database who use a computer for at least 25% of their duties. For school districts, only the cybersecurity coordinator must complete the training.
- Scope, contractors: state agency contractors with access to state systems must train during the contract term and any renewal, with no exceptions.
- Exemption: staff on certain extended leave (e.g., military or FMLA) who no longer have system access.
- Vendor requirement: training must come from a vendor certified by the State of Texas. Certifications expire every August 31 and must be renewed annually.
- Certification: state agencies and local governments certify compliance to DIR through its online form by August 31. Individual records are not sent to DIR but must be retained.
- AI requirement: can be met with DIR's free certified AI awareness video, tracked as a custom episode in Huntress Managed SAT.
Remediation
- Confirm whether your organization and its personnel are in scope.
- Select a currently DIR-certified training vendor.
- Roll out both the cybersecurity and AI trainings annually and track completion.
- Certify to DIR by August 31 and keep completion records.
- Reinforce security awareness throughout the year rather than treating it as a once-a-year checkbox.
Linha do tempo
-
Texas HB 3834 and HB 3512 mandate annual cybersecurity and AI awareness training for state and local government staff and contractors
ler a análise desta fonte ocultar
Huntress explains the compliance obligations of Texas law HB 3834, passed in June 2019. It requires state agency and local government employees, and state contractors, to complete a Department of Information Resources (DIR)-certified cybersecurity awareness training every year. Since September 1, 2025, HB 3512 adds a second annual requirement: DIR-certified AI awareness training. The article cites the August 2019 ransomware attack on 23 Texas municipalities (a reported $2.5 million demand) as the motivation, and Verizon's 2026 DBIR figure of 62% of breaches involving the human element. It is a vendor compliance and marketing piece with no new threat activity, vulnerability or IOCs.
Technical Details
- Scope, state agencies: employees who use a computer for at least 25% of their duties, plus elected or appointed officers.
- Scope, local governments: employees and officials with access to a local government computer system or database who use a computer for at least 25% of their duties. For school districts, only the cybersecurity coordinator must complete the training.
- Scope, contractors: state agency contractors with access to state systems must train during the contract term and any renewal, with no exceptions.
- Exemption: staff on certain extended leave (e.g., military or FMLA) who no longer have system access.
- Vendor requirement: training must come from a vendor certified by the State of Texas. Certifications expire every August 31 and must be renewed annually.
- Certification: state agencies and local governments certify compliance to DIR through its online form by August 31. Individual records are not sent to DIR but must be retained.
- AI requirement: can be met with DIR's free certified AI awareness video, tracked as a custom episode in Huntress Managed SAT.
Remediation
- Confirm whether your organization and its personnel are in scope.
- Select a currently DIR-certified training vendor.
- Roll out both the cybersecurity and AI trainings annually and track completion.
- Certify to DIR by August 31 and keep completion records.
- Reinforce security awareness throughout the year rather than treating it as a once-a-year checkbox.