FAQs
Have Questions?
What are the CIS Controls?
The CIS Controls are 18 prioritized security practices published by the Center for Internet Security. Each control is broken into specific safeguards, and version 8.1 is the current edition. Texas SB 2610 names them as the standard for businesses with 20 to 99 employees, which makes them a practical baseline for a Houston small business.
What is Implementation Group 1?
Implementation Group 1, or IG1, is the starting tier of the CIS Controls. It contains 56 safeguards, and the Center for Internet Security describes it as essential cyber hygiene and an emerging minimum standard for all enterprises. It covers basics such as inventory, secure settings, account management, patching, malware defenses, backups and training.
How do the CIS Controls relate to Texas SB 2610?
Texas SB 2610 bars exemplary damages in a breach lawsuit against a business with fewer than 250 employees that maintained a conforming cybersecurity program. For businesses with 20 to 99 employees, the law names CIS Controls Implementation Group 1. The program has to be in place before the breach. Ask an attorney how the law applies to you.
Is the Texas legal protection guaranteed?
No. The law limits one type of damages and does not affect compensatory damages or regulatory enforcement. Whether a business qualifies is a legal question for an attorney. CinchOps handles the technical side: putting the safeguards in place, running them, and keeping dated records that show the program existed.
We have fewer than 20 or more than 99 employees. Does this still apply?
The law sets different tiers. Below 20 employees it asks for password policies and cybersecurity training. From 100 to 249 it asks for a recognized framework such as NIST. The CIS Controls are still a sound baseline at any size, and CinchOps can map your program to the tier that fits.
