(a) Information is excepted from the requirements of § 552.021 if it is information that relates to computer network security, to restricted information under § 2059.055, or to the design, operation, or defense of a computer network.
(b) The following information is confidential:
(1) a computer network vulnerability report;
(2) any other assessment of the extent to which data processing operations, a computer, a computer program, network, system, or system interface, or software of a governmental body or of a contractor of a governmental body is vulnerable to unauthorized access or harm, including an assessment of the extent to which the governmental body’s or contractor’s electronically stored information containing sensitive or critical information is vulnerable to alteration, damage, erasure, or inappropriate use;
(3) a photocopy or other copy of an identification badge issued to an official or employee of a governmental body; and
(4) information directly arising from a governmental body’s routine efforts to prevent, detect, investigate, or mitigate a computer security incident, including information contained in or derived from an information security log.

(b-1) Subsection (b)(4) does not affect the notification requirements related to a breach of system security as defined by § 521.053, Business & Commerce Code.
(c) Notwithstanding the confidential nature of the information described in this section, the information may be disclosed to a bidder if the governmental body determines that providing the information is necessary for the bidder to provide an accurate bid. A disclosure under this subsection is not a voluntary disclosure for purposes of § 552.007.
(d) A state agency shall redact from a contract posted on the agency’s Internet website under § 2261.253 information that is made confidential by, or excepted from required public disclosure under, this section. The redaction of information under this subsection does not exempt the information from the requirements of § 552.021 or 552.221.