Could your business show its security program the day after a breach?
Picture the office manager at a small Texas CPA firm. A phishing email leads to a breach of client records, and by Monday the firm's attorney is asking what security was in place at the time. Under Texas SB 2610, what matters is what the business can show: written policies, controls aligned to a recognized framework and dated records that they were running. This page explains what that takes and how we help.
Prefer to talk? College Station (979) 256-5100 · Denver (303) 468-5515
Quick answer: Texas SB 2610 took effect September 1, 2025. If a Texas business with fewer than 250 employees that holds sensitive personal information is sued after a data breach, the people harmed may not recover punitive (exemplary) damages if the business demonstrates it implemented and maintained a qualifying cybersecurity program. To show one, keep written policies, controls aligned to a recognized framework such as CIS Controls IG1, and dated evidence that they are running. The Lone Star Assurance MSA from 24uNet is built to support that kind of documented program.​
​
​
Prefer to talk? College Station (979) 256-5100 · Denver (303) 468-5515
A short conversation about your business. Pricing is covered here, not online.
A Texas managed security MSA, run from College Station
The Lone Star Assurance MSA is a managed security MSA offered to Texas businesses. One team runs your help desk and your security program, and keeps the records that show it is working. It's run from our College Station office.
What is Texas SB 2610?
Definition: Texas SB 2610 is a 2025 Texas law that added Chapter 542, "Cybersecurity Program," to the Business and Commerce Code. It gives smaller Texas businesses a reason to document their cybersecurity by limiting exemplary (punitive) damages for businesses that can show a qualifying program.
-
Who it covers: Texas businesses with fewer than 250 employees that own or license computerized data that includes sensitive personal information, such as a name with a Social Security, driver's license or financial account number, or health information.
-
What it does: in a lawsuit arising from a breach, the people harmed may not recover exemplary damages if the business demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program that meets the law's requirements.
-
What it doesn't do: it doesn't limit actual damages, it isn't a mandate, and it doesn't change other duties under Texas law. No agency certifies a program.
-
The word that matters: demonstrates. A program that lives in someone's head is hard to show. Read the enrolled bill text.
Every program must contain administrative, technical and physical safeguards and conform to an industry-recognized cybersecurity framework. What "qualifying" means then scales with size:
-
Fewer than 20 employees: simplified requirements, including password policies and employee cybersecurity training
-
20 to 99 employees: moderate requirements, including CIS Controls Implementation Group 1 (IG1)
-
100 to 249 employees: a recognized framework from the law's list, such as the NIST Cybersecurity Framework or ISO/IEC 27000 series
The Lone Star Assurance MSA is aligned to CIS Controls IG1 for every client. Businesses with 100 to 249 employees are served through a separately scoped engagement.
This is general information, not legal advice. Talk to your attorney about your situation.
How can a small business show a documented cybersecurity program?
Five things make a program something you can show, not just something you say:
-
Write it down. A written security program and policies, adopted and dated by the owner.
-
Map it to a framework. Each CIS Controls IG1 safeguard, how it is met and where its evidence lives.
-
Keep dated evidence. Exports that show the controls were running, saved on a regular schedule.
-
Record the physical side. Locks, paper records, screens and network closets, observed and signed.
-
Review it every year. A dated, written review, with gaps tracked as named exceptions.
.png){kind=small}
What the Lone Star Assurance MSA delivers
-
A written security program. Plain-English policies and plans sized to your business, adopted by you and kept in your own Microsoft 365 library.
-
Documented controls and an evidence pack. Each CIS IG1 safeguard mapped to how it is met, evidence exports provided when you sign and a written exceptions list. See what's in an evidence pack.
-
Help desk for your staff. Remote-first help with everyday IT questions and problems, from the same team that runs your security program.
-
24/7 managed detection and response. Analysts watching your computers and servers around the clock.
-
Managed backup. Encrypted, immutable backup. Each user's Microsoft 365 mailbox backup is part of the MSA; server, workstation and data backups are billed separately.
-
Security awareness training built for Texas businesses. Short modules on phishing, payment fraud, passwords, sensitive data and reporting incidents, with completion records.
-
Everyday security controls. Enforced multi-factor sign-in, a business password manager, device encryption, email security, patching, vulnerability scanning and web filtering on each device.
-
An on-site walk-through and an annual review. The 24uNet team walks your Texas office to record physical safeguards, and 24uNet signs a dated review of the whole program each year.
One set of controls for every client
Every Lone Star Assurance MSA client gets the same core set of security controls. Some items are billed separately, such as server, workstation and data backups, additional devices and additional mailboxes. We cover those in a sales meeting, along with pricing. Need only one or two services? A la carte services are available through a Service Authorization.
Optional add-on: identity threat detection for Microsoft 365 accounts is available separately. It isn't part of the MSA and isn't required. See how identity threat detection works.
What's in an evidence pack
A cover memo and index; the written program and policies with adoption dates; a sensitive-data inventory; a risk assessment; the CIS IG1 map; technical evidence exports; training records; the incident response plan and contacts; a vendor register; the exceptions register; the on-site walk-through record; and 24uNet's annual review memo. The records belong to your business, and you decide when to share them.
Prefer to talk? College Station (979) 256-5100 · Denver (303) 468-5515
Documented program vs. no documented program
Policies. With a documented program: Written, dated and adopted by the owner. Without: Informal: "we do that".
​
Proof the controls ran. With a documented program: Dated exports in an evidence pack. Without: Searched for after the fact, if they exist.
​
Framework. With a documented program: Mapped to CIS Controls IG1, line by line. Without: Unknown.
​
Physical safeguards. With a documented program: Walk-through record, signed. Without: Not recorded.
​
Gaps. With a documented program: Written exceptions with an owner and a date. Without: Found when something breaks.
​
Annual review. With a documented program: Signed and dated. Without: None.
​
After a breach. With a documented program: Records ready for your attorney and insurer. Without: Rebuilt from memory.
​
Texas SB 2610. With a documented program: Built to support the documented program the law describes. Without: Hard to demonstrate.
Built for Texas firms that hold sensitive data
The Lone Star Assurance MSA is offered to Texas businesses:
-
That hold sensitive personal information about employees, clients or patients
-
That hold Microsoft 365 Business Premium or equivalent licensing. Not there yet? We help with the upgrade.
-
That want one team to run IT support and security and keep the records
It's a good fit for engineering and design firms, financial advisors, CPA firms, law firms, and medical and dental practices.
Where we work
24uNet was founded in 2004. Our Texas office is in College Station, and the 24uNet team does the on-site walk-throughs. Colorado clients are served from our Colorado office. See cybersecurity in Bryan–College Station.
How to start: a conversation, then a walk-through
-
Talk with us. A short conversation about your headcount, the personal information you hold and how you work. Pricing is covered here.
-
Walk-through and setup. The 24uNet team visits your Texas office. We inventory sensitive data, assess risk and put your security controls in place.
-
Adopt your program. You name a program owner and adopt the written program and policies we draft. Your team completes training.
-
Keep the records. Evidence packs on a regular schedule, exceptions tracked in writing, and a signed annual review from 24uNet.
Book a conversation
Prefer to talk? College Station (979) 256-5100 · Denver (303) 468-5515
Hours: 8am-5pm Central (College Station) · 8am-5pm Mountain (Denver)
Short definitions
-
CIS Controls IG1: the first Implementation Group of the Center for Internet Security Controls, 56 safeguards described as essential cyber hygiene.
-
Exemplary damages: damages awarded to punish rather than to compensate. Under Texas law the term includes punitive damages.
-
Sensitive personal information: under Texas law, a name combined with an unencrypted Social Security, driver's license or financial account number (with its access code), or information about a person's health care.
-
Written security program: the document that says who owns security, which policies apply and how they are reviewed.
-
Evidence pack: a dated set of records showing your controls were in place and running.
-
Managed detection and response: security analysts who watch devices around the clock and respond to threats.
Frequently asked questions
What is Texas SB 2610?
Texas SB 2610 added Chapter 542 to the Business and Commerce Code, effective September 1, 2025. If a Texas business with fewer than 250 employees that holds sensitive personal information is sued after a data breach, the people harmed may not recover exemplary (punitive) damages if the business demonstrates it implemented and maintained a qualifying cybersecurity program.
Does SB 2610 require my business to have a cybersecurity program?
No. SB 2610 is an incentive, not a mandate. Other Texas duties, such as protecting sensitive personal information and sending breach notices, still apply.
How can a small business show a documented cybersecurity program?
Write the program and policies down, map your controls to a recognized framework such as CIS Controls IG1, keep dated evidence that the controls are running, record physical safeguards, track exceptions, and review the whole program every year.
What is CIS Controls IG1?
Implementation Group 1 of the Center for Internet Security Controls: 56 safeguards the Center calls essential cyber hygiene. SB 2610 names IG1 for Texas businesses with 20 to 99 employees. The Lone Star Assurance MSA is aligned to IG1 for every client.
Does SB 2610 limit all damages after a data breach?
No. It addresses exemplary (punitive) damages only. It does not limit actual damages, and no security program can stop every breach. Ask your attorney how the law applies to your business.
What does the Lone Star Assurance MSA include?
A written security program, documented controls and evidence packs, help desk support for your staff, 24/7 managed detection and response, managed backup, awareness training built for Texas businesses, an on-site walk-through and an annual review by the 24uNet team.
Is help desk support included?
Yes. Help desk support for your staff is part of the Lone Star Assurance MSA. It is remote first and comes from the same team that runs your security program.
Is anything billed separately?
Yes. Every client gets the same core set of security controls in this MSA. Some items, such as server, workstation and data backups, additional devices and additional mailboxes, are billed separately. Identity threat detection is available as an optional add-on. A la carte services are available through a Service Authorization.
Do I need Microsoft 365 Business Premium?
Yes. The program is for businesses that hold Microsoft 365 Business Premium or equivalent licensing. If you do not have it yet, 24uNet helps with the upgrade.
Is this legal advice or a certification?
No. 24uNet is not a law firm, and this is not legal advice. SB 2610 creates no certificate, filing or registry, and we do not certify programs. Please consult an attorney.
What this is not
24uNet is not a law firm, and this page is not legal advice. Texas SB 2610 limits exemplary (punitive) damages only; it does not limit actual damages or change other legal duties. "Built to support" means the program is designed around what the law describes; whether a program meets the law is decided case by case. No security program can promise a legal outcome or stop every breach. Please consult an attorney about how the law applies to your business.
About the author: 24uNet
Written and reviewed by the 24uNet team. 24uNet was founded in 2004 and has offices in Denver and College Station. The 24uNet team does the Texas on-site walk-throughs and signs every annual program review.
24uNet on LinkedIn · X @24unet
Last reviewed: October 11, 2026
The security platforms behind these commitments are selected, deployed and managed by 24uNet, and may change. The capabilities do not.