What Does Texas SB 2610 Require for the Cybersecurity Safe Harbor?

The law sets 3 tiers. Headcount decides which one applies.

Texas SB 2610 requires password policies and employee cybersecurity training for a business with fewer than 20 employees, the CIS Controls Implementation Group 1 for a business with 20 to 99 employees, and conformance to a recognized framework such as NIST or ISO/IEC 27000 for a business with 100 to 249 employees.

The table compares the 3 SB 2610 tiers by employee count, the wording in Section 542.004 of the law, and the records CinchOps recommends a business in that tier keep on file.

A 12-person CPA practice in Katy and a 60-person engineering firm in The Woodlands sit in different tiers and owe different amounts of work. Both tiers use the word "including," which sets a floor and stops short of a complete list. Every tier also has to meet the base test in the law: administrative, technical and physical safeguards that protect personal identifying information and sensitive personal information.

The frameworks SB 2610 names include the NIST Cybersecurity Framework, NIST Special Publications 800-171 and 800-53, the CIS Critical Security Controls, the ISO/IEC 27000 series, HITRUST, SOC 2 and FedRAMP, plus "other similar frameworks." A business already subject to HIPAA, the Gramm-Leach-Bliley Act or PCI DSS has to conform to the current version of those as well. CinchOps explains two of the options in CIS Controls for Houston businesses and the NIST Cybersecurity Framework for small and mid-size businesses.

The law covers a business entity in Texas that has fewer than 250 employees and owns or licenses computerized data that includes sensitive personal information. Texas defines that as an unencrypted name combined with a Social Security number, a driver's license or government ID number, or an account or card number with its access code, along with identifying health information. The bill text does not say how to count part-time staff or contractors, so a business near 20, 100 or 250 should ask an attorney which side of the line it is on.

The protection is narrower than the name suggests.

The SB 2610 safe harbor removes one thing: exemplary damages in a lawsuit arising from a breach of system security. The lawsuit can still be filed, compensatory damages are still available, and Section 542.005 says the law does not change any common law or statutory duty a business already has.

Exemplary damages are defined in Texas law as "any damages awarded as a penalty or by way of punishment but not for compensatory purposes," and the definition includes punitive damages. They are the part of a verdict meant to punish. Compensatory damages, the part that repays what people lost, are outside the safe harbor.

Existing duties stay in force. A Texas business that suffers a breach of system security still has to notify affected individuals no later than the 60th day after it determines the breach occurred, and has to notify the Texas Attorney General no later than the 30th day when at least 250 Texas residents are involved. CinchOps walks through that sequence in the data breach reporting checklist for Texas small businesses.

Two limits in the text catch owners out. The protection applies only to a cause of action that accrues on or after September 1, 2025. And the business has to demonstrate that the program was implemented and maintained "at the time of the breach," so the burden sits with the business and the program cannot be built afterward.

The law says "demonstrates." In practice that means paper with dates on it.

A Houston business proves it qualified for the SB 2610 safe harbor with dated records created before the breach. The law requires the business to demonstrate that it implemented and maintained the program, so it needs a named framework, a dated assessment against it, training records and a log showing the program was kept up.

In 35+ years doing this, the gap I see most often is missing dates. The firewall is configured, the staff sat through training and the backups run, and nobody can show when any of it was last checked. A program that exists only in people's heads is hard to demonstrate to anyone.

The local numbers suggest how much work is ahead. The CinchOps Houston Area Security Index scored 4,393 Houston-area businesses on external security signals, and 49.6% earned a D or an F. An outside score does not decide whether a business qualifies under SB 2610, because the Index cannot see internal policies or training. It does show that about half the businesses measured would have visible problems to fix before they could make the case.

Frameworks change, and the law allows for it. When a named standard is updated, a program keeps qualifying if the business updates it by the later of 2 dates: the implementation date published in the new standard, or the first anniversary of its publication. A dated network security audit each year is the simplest way to show the program kept pace.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• The CIS Controls service assesses a business against Implementation Group 1 and records each gap and the date it was closed.
• An IT security audit produces the dated, written assessment the evidence file is built around.
• Through cybersecurity services, CinchOps closes the gaps an assessment finds and runs 24/7 threat monitoring between reviews.
• Under managed IT support, help desk requests are answered in under 15 minutes.
• CinchOps works with businesses across the Houston area, including CPA firms, law firms and engineering firms.

SB 2610 pays the business that did the work before anything went wrong and can show when it did it. The Houston businesses CinchOps assesses usually have part of a program in place and little of the paperwork. Find your tier, get the assessment dated, and talk to CinchOps if you want it built and kept current.