Texas SB 2610 Safe Harbor in Plain English: What a Firm Under 100 Employees Needs on File
Updated: 18 hours ago
Short answer: Texas SB 2610 added Chapter 542 to the Business & Commerce Code, effective September 1, 2025. If a Texas business with fewer than 250 employees that holds sensitive personal information is sued over a data breach, the people harmed may not recover exemplary (punitive) damages, as long as the business can show it had implemented and maintained a qualifying cybersecurity program at the time of the breach. For a firm under 100 employees, that means written safeguards, a recognized framework, and dated proof that the program was running.
This post is general information, not legal advice. Talk with your attorney about how SB 2610 applies to your business.
The key word in the law is demonstrates. A program that lives in one person's head is hard to show after a breach. What matters is what's on file.
What does Texas SB 2610 actually do?
SB 2610 creates a "cybersecurity program safe harbor." According to the enrolled bill text:
It limits one kind of damages. In a lawsuit arising from a breach of system security, people harmed may not recover exemplary damages from a covered business that demonstrates a qualifying program was in place at the time of the breach.
It doesn't create a new lawsuit. Section 542.005 says the chapter doesn't create a private cause of action or change any common law or statutory duty.
It applies to causes of action that accrue on or after September 1, 2025.
It isn't a mandate, and no agency certifies a program. It's a reason to build and document one.
Which Texas businesses does SB 2610 cover?
The chapter applies only to a business entity in Texas that:
Has fewer than 250 employees, and
Owns or licenses computerized data that includes sensitive personal information, as Section 521.002 of the Business & Commerce Code defines it.
Many Bryan–College Station professional firms, clinics, and agencies hold exactly that kind of data about clients or staff.
What must the cybersecurity program include?
Every qualifying program must:
Contain administrative, technical and physical safeguards for personal identifying information and sensitive personal information.
Conform to an industry-recognized cybersecurity framework. The bill lists several, including the NIST Cybersecurity Framework, NIST SP 800-171, ISO/IEC 27000-series standards, and the CIS Critical Security Controls.
Be designed to protect the security and integrity of that information and to protect against unauthorized access that would create a material risk of identity theft or fraud.
If your business is subject to HIPAA, Gramm-Leach-Bliley, or PCI DSS, the bill also points to those requirements.
What does a firm under 100 employees need?
The bill scales requirements by headcount:
Fewer than 20 employees: "simplified requirements, including password policies and appropriate employee cybersecurity training."
20 to 99 employees: "moderate requirements, including the requirements of the Center for Internet Security Controls Implementation Group 1" (CIS Controls IG1).
100 to 249 employees: conformance with a full recognized framework.
What should we keep on file to show a program?
Because the safe harbor turns on what you can demonstrate, think in terms of records. A practical file for a small Texas firm includes:
A written security policy naming the framework you follow and who owns the program.
An inventory of devices, accounts, and where sensitive personal information lives.
Password and MFA policy, plus a record of how it's enforced.
Training records with dates and who attended.
Patch, backup, and restore-test records showing the controls ran, not just that they were planned.
An incident response plan, with a copy kept offline.
A review log showing the program was checked and updated over time.
How do we keep the program current?
The bill says that when a listed framework is updated, a business's program still qualifies if it's updated by the later of the framework's published implementation date or one year after the update is published. Put a yearly framework review on the calendar and record that it happened.
How does 24uNet help Texas businesses?
The Lone Star Assurance MSA is a Texas managed security agreement run from our College Station office. One team runs your help desk and your security program and keeps the dated records that show it's working. It's built to support the kind of documented program SB 2610 describes. Local to Bryan–College Station? See our cybersecurity services for Bryan–College Station, and read what to do in the first hour of a cyberattack.
FAQ
Does SB 2610 require Texas businesses to have a cybersecurity program?
No. It isn't a mandate. It limits exemplary damages in breach lawsuits for covered businesses that can show a qualifying program was in place.
Does SB 2610 protect against all damages after a breach?
No. It addresses exemplary (punitive) damages only, and it doesn't change other duties under Texas law.
Which framework should a 20 to 99 person firm use?
The bill names CIS Controls Implementation Group 1 for that size. Other listed frameworks may also fit; your IT provider and attorney can help you choose.
Does a state agency certify our program?
No. There is no certification under SB 2610. What counts is what you can demonstrate with your records.
Is this legal advice?
No. This is general information about the bill text. Talk with your attorney about your situation.
Talk to 24uNet about a documented program
Want to see what your security file would look like today? Call us at Denver (303) 468-5515 or College Station (979) 256-5100, email sales@24unet.com, or learn about the Lone Star Assurance MSA.
Related reading: The Essential Guide to Managed IT Services for Growing Businesses.
Source: Texas Legislature, S.B. 2610 (89R), enrolled bill text: https://capitol.texas.gov/tlodocs/89R/billtext/html/SB02610F.htm · Bill history: https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2610
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments