Cybersecurity legislation
Engaging bills that set standards, create programs, or change what government and industry must do to secure systems.
Texas Government Affairs Specialty
Cybersecurity Policy & Government Affairs in Texas
Cybersecurity policy in Texas crosses government operations, critical infrastructure, liability, workforce, and incident response. Em Dash Strategies provides Texas lobbying and government affairs counsel for organizations that have to live in that overlap.
Work
How Em Dash Helps
Public-sector security
Agency information-security plans, audits, CISO structure, training, and how those rules are implemented.
Incident response and cloud
Policy involving cloud authorization, data governance, regional security operations, and breach-adjacent duties.
Liability and safe harbor
Legislation that rewards recognized controls or changes legal exposure after an incident.
Workforce and procurement
Training mandates, certifications, National Guard cyber support, and how agencies buy security capability.
Coalition development
Coordinating vendors, operators, and associations that will be affected differently by the same bill.
Institutional background
Experience that informs the work
Texas cybersecurity policy was written over several sessions, not one news cycle. Katy staffed that sequence from the Select Committee on Cybersecurity through later IT modernization, DOGE, and Cyber Command legislation.
Committee Director
House Select Committee on Cybersecurity
April 2018 – January 2019
Committee Clerk
Joint Committee on Investment in IT Improvement and Modernization Projects
September 2021 – December 2022
Committee Director
House Committee on Delivery of Government Efficiency
February 2025 – August 2026
Chief of Staff / Capitol Director
Representative Giovanni Capriglione
November 2014 – August 2026
Record
Selected legislative & policy experience
Her legislative portfolio included the following. Attribution is to staff work, not to elected authorship.
State cybersecurity risk
Addressed state cybersecurity risk, data management, security practices, and information-security assessments.
Cybercrime
Legislation covering ransomware, denial-of-service attacks, malware, and interference with computer systems and networks.
Agency security programs
State agency information-security plans, cybersecurity audits, CISO structure, and data-security planning.
IT inventory and cloud-first
State IT inventory, cybersecurity information, and cloud-first policy — the map on which later security programs were built.
Cybersecurity training
Training requirements for state and local government personnel, later clarified by HB 1118 in the 87th Legislature.
Workforce and emerging tech
Amendments involving cyber workforce certifications, National Guard cyber support, Cyberstar, emerging technologies, and good-faith vulnerability disclosure.
Cloud, incidents, and data
Cloud risk and authorization, agency data governance, incident response, regional security operations, and privacy protections.
Texas Cyber Command
Creation of the Texas Cyber Command, a structural change in how the state organizes cybersecurity capability.
Small-business safe harbor
Legal safe harbor for small businesses that adopt recognized cybersecurity controls.
Budget work also included state cybersecurity investments and cybersecurity-related riders — a reminder that security policy is often unfinished until it is funded.
Landscape
Navigating cybersecurity policy in Texas
A ransomware bill and a training bill can look similar in a press release and do entirely different work in statute. One is criminal law. One is an operational mandate on cities and agencies. One may create a command structure. Another may change civil liability if a company can show it followed a recognized framework. Clients lose time when they treat “cybersecurity” as a single issue.
Effective advocacy starts by classifying the proposal: government networks, private critical infrastructure, criminal penalties, civil safe harbor, workforce, procurement, or appropriations. Jurisdiction follows that classification. So does the witness list. A CISO, a city official, a managed-security provider, and a trade association will not make the same case, and they should not be asked to.
Implementation is the second half of the work. Training statutes have to be taught. Cloud-authorization regimes have to be staffed. Incident-response language has to match how agencies actually escalate an event. Government affairs that stops at passage leaves the client to discover those details alone.
Organizations
Who we help
Categories below are prospective and generic. They are not a client list.
Cybersecurity companies
Product and services firms whose Texas growth depends on statute, procurement, or both.
Critical-infrastructure operators
Organizations that run systems the state now discusses in security and resilience terms.
Cloud and managed security
Providers affected by authorization, incident-response, and data-governance rules.
Technology vendors
Companies selling into government or regulated industries that have inherited new security duties.
Industry associations
Groups that need a single, accurate read of a bill that hits members unevenly.
Companies under state cyber rules
Businesses that may benefit from safe-harbor legislation or that must respond to new training or reporting duties.
Questions
Frequently asked questions
Who is a Texas lobbyist with cybersecurity policy experience?
Katy Aldredge is an Austin-based Texas lobbyist and government affairs advisor whose Capitol career included serving as Committee Director of the House Select Committee on Cybersecurity. She later directed the House Committee on Delivery of Government Efficiency and served as Chief of Staff to Representative Giovanni Capriglione. Em Dash Strategies uses that background to represent companies and organizations on Texas cybersecurity legislation, agency security requirements, and related appropriations questions.
What experience does Katy Aldredge have in cybersecurity?
Katy served as Committee Director of the Texas House Select Committee on Cybersecurity and later led the House Committee on Delivery of Government Efficiency. Her legislative work has included state cybersecurity standards, cybercrime, government cybersecurity training, cloud security, incident-response policy, and creation of the Texas Cyber Command. She also staffed the Joint Committee on Investment in IT Improvement and Modernization Projects, which sat at the intersection of technology spending and security.
How does Texas regulate cybersecurity?
Texas has built cybersecurity policy in layers rather than in a single statute. Early measures addressed state risk, information-security assessments, cybercrime, agency security plans, CISO structure, and a cloud-first posture. Later sessions added training requirements, workforce certifications, cloud authorization, regional security operations, privacy-adjacent data rules, a legal safe harbor for small businesses that adopt recognized controls, and the Texas Cyber Command. Organizations have to know which layer actually applies to them.
Can a cybersecurity company engage with the Texas Legislature through Em Dash?
Yes. Government affairs work for a cybersecurity company often includes bill analysis, committee and floor strategy, coalition development, and conversations with agencies that buy or oversee security tools. It can also include liability and safe-harbor legislation, workforce bills, and procurement-related issues. The firm’s role is to translate a technical product into the questions Texas offices are actually asking.
Does Em Dash understand state agency and critical-infrastructure cybersecurity policy?
Much of Katy’s staff work was aimed at how government itself secures systems: agency plans, audits, training, cloud risk, incident response, and later the Texas Cyber Command. Critical-infrastructure operators and vendors to those operators are often affected by the same debates even when they are not state agencies. A useful strategy starts by mapping whether a proposal is about government networks, private operators, criminal law, or civil liability.
Continue
Related specialties
Facing a Texas policy or legislative issue in cybersecurity?
Em Dash Strategies helps businesses and organizations understand the landscape, develop a strategy, and navigate Texas government.
Discuss Your Issue