If your organization is experiencing a cybersecurity incident, the Texas Cyber Command is your point of contact. Our teams help state agencies and organizations across Texas prepare for, respond to, and recover from cyber threats.
State agencies, institutions of higher education, and local governments: report a confirmed or suspected cybersecurity incident through the established statewide channels below. You can also prepare with our response resources.
Required: 48 hours Reporting within 48 hours of discovery is required by law, but report as soon as you can: within 24 hours is strongly encouraged, and calling the hotline satisfies the requirement. See all reporting deadlines
Report through the SPECTRIM portal.
Access SPECTRIM (opens in new tab) Reporting requirementsSubmit the Local Incident Reporting Form via Archer Engage. School districts and charter schools report under Texas Education Code Section 11.175 through the same form.
Access Archer Engage (opens in new tab) Reporting requirementsThese paths are open to anyone and do not require a reporting portal.
Forward suspected phishing emails as an attachment to phishing@txcc.texas.gov. Analysts at the Network Security Operations Center (NSOC) review the message for malicious files and URLs and act to block confirmed malicious sites at the state network perimeter.
If you've identified a cyber threat, such as suspicious activity, indicators, or intelligence that could affect other organizations, you can submit it for research and information sharing through the Texas Information Sharing and Analysis Organization (TX-ISAO).
Report via TX-ISAO (opens in new tab)The same statutory deadlines apply to state agencies, institutions of higher education, local governments, school districts, and charter schools.
The sooner the Command knows, the sooner it can help you contain the incident and warn others. Reporting within 24 hours of discovery is strongly encouraged, well ahead of the statutory deadline.
Reporting a security incident within 48 hours of discovery is required by law. Calling the incident response hotline satisfies this requirement.
After eradication, closure, and recovery, submit the details of the incident and an analysis of its cause through the appropriate portal below.
Reporting is required for incidents assessed to propagate to other systems, result in criminal violations that must be reported to law enforcement, or involve the unauthorized disclosure or modification of confidential information, such as sensitive personal information.
The Texas Cyber Command provides organizations with incident response support, guidance, and resources before, during, and after a cybersecurity incident. The guides, templates, and resources below help organizations build a robust incident management and response program.
Procedures, contacts, and playbooks for assembling and operating an incident response team.
A starting template for building your organization's own incident response Redbook.
Procedures and plans for responding to and processing a privacy or information security incident.
A directory of cybersecurity resources available to Texas organizations.
Joint CISA and MS-ISAC guidance on preventing, mitigating, and responding to ransomware.
Depending on the nature of the incident, these authorities may also accept a report.