If your organization operates in Texas, has fewer than 250 employees and owns or licenses computerized data that includes sensitive personal information, SB 2610 gives you a reason to formalize your cybersecurity program.
If you meet the program requirements at the time of a data breach, a person suing you over that breach cannot recover exemplary (punitive) damages. The law is voluntary, and ALCON DTS helps you build, run and document the program it describes.
SB 2610 is a Texas law passed by the Texas Legislature in its 89th Regular Session. It added Chapter 542, “Cybersecurity Program,” to the Texas Business and Commerce Code, effective September 1, 2025.
What changed: SB 2610 created a specific defense tied to your cybersecurity program. If you qualify and you can show that, at the time of the breach, you had implemented and maintained a program that meets Sec. 542.004, a person harmed by the breach may not recover exemplary damages from you (Sec. 542.003).
SB 2610 does not order you to do anything. There is no regulator, no registration and no penalty under Chapter 542. It sets out what your cybersecurity program must look like if you want the protection, and it works as a defense in a lawsuit.
It covers: exemplary damages. In a lawsuit arising from a breach of system security, a person harmed by the breach may not recover exemplary damages from a qualifying business (Sec. 542.003). Texas law defines exemplary damages as damages awarded as a penalty or punishment, not as compensation, and the term includes punitive damages (Civil Practice and Remedies Code Sec. 41.001).
It does not:
Chapter 542 applies only to a business entity in Texas that meets both tests (Sec. 542.002):
“Sensitive personal information” uses the Texas definition in Business and Commerce Code Sec. 521.002. In plain terms, it covers:
If you keep employee records, patient information or customer payment details in computerized form, you very likely own or license sensitive personal information.
Quick check: is SB 2610 relevant to you?
If all three are true, the safe harbor is available to you, provided your cybersecurity program meets Sec. 542.004. Chapter 542 does not say how employees are counted. Talk with your attorney about how it applies to your staffing.
| Employees | What the law expects | Example starting point |
|---|---|---|
| Fewer than 20 | Simplified requirements, including password policies and appropriate employee cybersecurity training | A written password policy with multifactor authentication, plus security awareness training for every employee with completion records |
| 20 to 99 | Moderate requirements, including the Center for Internet Security (CIS) Controls Implementation Group 1 | A gap assessment against CIS Controls Implementation Group 1, then a documented plan to close each gap |
| 100 to 249 | Compliance with the requirements of Sec. 542.004(b): conformity with a current version of one or more listed frameworks, plus the current version of HIPAA, GLBA Title V, FISMA or HITECH if you are subject to them, and PCI DSS if it applies to you | Choose a named framework that fits your industry, add any of those laws or PCI DSS that apply to you, assess against them and keep an evidence file that shows conformity |
If you have close to 100 employees, you may be near the line between the second and third tiers. If you are growing past 100 employees, plan your framework now so your program keeps pace.
Your program conforms to an industry-recognized framework if it conforms to a current version of one, or any combination, of these:
Your program must also conform to the current version of these laws if your organization is subject to them:
And, if it applies to you, the current version of the Payment Card Industry Data Security Standard (PCI DSS).
Frameworks change. When a listed framework is updated, your program still qualifies as long as you update it to the new version by the later of:
That means a steady review cycle matters. A program that met the framework two versions ago may not qualify later.
You keep the compliance decisions. We can run the controls. We can keep them current and document how they work, so you have a clear record of your program when your attorney, insurer or auditor asks. Our services help you build and maintain a program aligned to the framework you choose. Whether the safe harbor applies to a specific claim is a legal question decided on the facts.
| SB 2610 element | What ALCON DTS provides |
|---|---|
| Framework conformity and documentation (542.004(a)(2), (b)) | Compliance tracking against your chosen framework, with documented policies, procedures and an organized evidence file |
| Password policies (under 20 tier) | Identity and access management, including multifactor authentication, enforced password policies and secure credential storage |
| Employee cybersecurity training (under 20 tier) | Security awareness training with completion records |
| Technical safeguards: malware and endpoint defense | Endpoint detection and response, application control and managed administrator rights |
| Technical safeguards: email threats | Email security and filtering, plus email domain authentication (SPF, DKIM and DMARC) |
| Monitoring and detection | Centralized logging, security monitoring and alerting across devices and cloud apps, through our Security Monitoring (SIEM) service |
| Asset inventory and secure configuration (CIS IG1) | Device management, managed patching and updates, and automated documentation of systems and configurations |
| Network safeguards | Managed firewalls, switching and secure Wi-Fi |
| Integrity and recovery | Tested backup and recovery |
| Staying current (542.004(c)) | Regular, documented program reviews against the current framework version, with changes recorded in your evidence file |
The exact controls in your environment depend on your ALCON DTS plan and any project work. We will show you which are in place today and which would close a gap.
When you build a program you may one day need to show your attorney or insurer, you want a team that has done this work for years and documents it as it goes. Here is what you get with ALCON DTS.
ALCON DTS has earned awards and recognition from business and community organizations, a reflection of how we operate: plain answers, documented work and long-term relationships.
Ready to see where your program stands? We will compare your current controls with the SB 2610 tier that fits your headcount and show you what would close the gaps.
Texas SB 2610 · Cybersecurity Safe Harbor
See how your cybersecurity program lines up with what SB 2610 describes for your size. Choose your employee count, answer each question Yes, No or Not sure, and print a brief for your records.
Sec. 542.002: “This chapter applies only to a business entity in this state that: (1) has fewer than 250 employees; and (2) owns or licenses computerized data that includes sensitive personal information.”
Chapter 542 leaves two points open: how employees are counted, and what counts as a “business entity”, which matters for nonprofits. Talk with your attorney about how it applies to your organization and your staffing.
What the law expects for this size: “Simplified requirements, including password policies and appropriate employee cybersecurity training.” (Sec. 542.004(a)(4)(A))
What the law expects for this size: “Moderate requirements, including the requirements of the Center for Internet Security Controls Implementation Group 1.” (Sec. 542.004(a)(4)(B))
What the law expects for this size: “Compliance with the requirements of Subsection (b).” (Sec. 542.004(a)(4)(C)) In plain terms, Subsection (b) means a current version of one or more listed frameworks, plus the current version of HIPAA, GLBA Title V, FISMA or HITECH if you are subject to them, and a current version of PCI DSS if it applies to you.
Choose Yes when every part of the question is true today, unless the note under a question says otherwise.
Have you named one person as responsible for the program?Good practice
Evidence to keepProgram responsibility record
Are your administrative, technical and physical safeguards written down?
Evidence to keepThe written program
Is the program designed to protect the security and integrity of personal identifying information and sensitive personal information, and to protect against unauthorized access to or acquisition of that information that would result in a material risk of identity theft or other fraud?
Evidence to keepProgram purpose statement
Is the program implemented and maintained, with records that show it in use, not only planned?
Evidence to keepRecords that show the program in use
Is responsibility assigned for each control in your selected framework?Good practice
Evidence to keepControl responsibility list
Does each person have their own account, with shared logins retired and admin access kept apart from everyday access?
Evidence to keepAccount list
Do you have a written password policy?
Evidence to keepThe password policy
Is multifactor authentication on for email and admin access?
Evidence to keepSettings report
Have you identified your sensitive information, with access limited to the people who need it?
Evidence to keepAccess list for systems with sensitive information
Has each person completed security training?
Evidence to keepTraining completion records
Are your hardware and software listed, including laptops and the systems that hold sensitive information?
Evidence to keepDevice and software list
Are laptops that hold sensitive information encrypted?
Evidence to keepEncryption status report
Are devices kept updated, with new vulnerabilities reviewed and addressed?
Evidence to keepUpdate report
Is email protected, and can you show the setting?
Evidence to keepEmail protection settings
Is logging on for the systems that hold sensitive information?
Evidence to keepLogging settings
Do backups run on a schedule, and has a restore been tested?
Evidence to keepLatest restore test record
Are vendors who hold or can reach personal identifying information or sensitive personal information listed, with what each one is allowed to do?
Evidence to keepVendor list
Do you have a written plan with the steps for a suspected incident?
Evidence to keepIncident response plan
Do you have a written breach notification path, kept apart from this defense?
Texas breach notification duties under Chapter 521 still apply.
Evidence to keepBreach notification procedure
Have you selected a framework the law lists, such as the NIST Cybersecurity Framework, the CIS Critical Security Controls or the ISO/IEC 27000-series?
Evidence to keepFramework decision record
Are all CIS Controls Implementation Group 1 safeguards in place, shown by a current assessment on file?
If any safeguard is still open, choose No and keep a dated plan to close it.
Evidence to keepIG1 assessment and plan
Is a gap review against your selected framework on file, with evidence of conformity filed with the program?
Evidence to keepGap review and evidence file
Is your framework version current, or is the program being updated to a newer version by the later of its published implementation date or one year after it was published (Sec. 542.004(c))?
Choose Yes if either part is true.
Evidence to keepVersion review record
Have you confirmed which of these laws apply to you, with the current version of each one that does built into your program: HIPAA, GLBA Title V, FISMA or HITECH if you are subject to it, and PCI DSS if it applies to you?
If none apply, choose Yes and record that in your list of laws that apply.
Evidence to keepList of laws that apply
Questions you answer No or Not sure will be listed here.
Bring this checklist to a readiness review with our expert team. We will review your current controls against the SB 2610 tier that fits your headcount, show you what is already in place, and give you a clear plan for the gaps.
The safe harbor is decided in the lawsuit, where your organization must show its program was implemented and maintained at the time of the breach. This checklist helps you prepare that record. Among damages, SB 2610 limits only exemplary damages. Compensatory damages, breach notification duties and regulatory enforcement under other laws continue to apply as before.
This page is general information about Texas law, not legal advice for your situation. Consult your attorney about how SB 2610 applies to your organization.
Last reviewed: September 30, 2026
This page is general information about Texas law, not legal advice for your situation.
Our team includes a certified NIST CSF 2.0 Lead Implementer. The credential is issued by Certified Information Security.
Want to know where your organization stands? We will review your current controls against the SB 2610 tier that fits your headcount, show you what is already in place, and give you a clear plan for the gaps.
© 2026 ALCON DTS.
