Compliance
Texas SB 2610 Compliance for small and mid-size businesses
We build, run, and document the cybersecurity program Texas SB 2610 describes, so you have a clear record when it matters.
Who it’s for
A cybersecurity program built for the Texas safe harbor
Texas SB 2610 gives qualifying businesses with fewer than 250 employees a defense against exemplary (punitive) damages in a lawsuit after a data breach, when a qualifying cybersecurity program was in place at the time. ALCON DTS helps you build that program, run it every day, and keep the evidence that shows it was working.
Your attorney advises on how the law applies to you. We handle the controls, the documentation, and the regular reviews that keep the program current.
Who it helps
- Texas businesses with fewer than 250 employees
- Organizations that hold employee, patient, client, or customer records with sensitive personal information
- Firms growing past 20 or 100 employees, where the program requirements step up
- Businesses that want a written program to show insurers and customers
What’s included
What you get
Readiness review
We compare your current controls with the SB 2610 tier that matches your headcount.
Framework alignment
We align your program to a recognized framework, such as CIS Controls IG1 or the NIST Cybersecurity Framework, based on your size.
Written program and policies
Administrative, technical, and physical safeguards, written down and kept current.
Controls we run
Device protection, email security, tested backups, and security training, managed for you, with multifactor authentication available as an add-on.
Evidence file
An organized record of policies, training completion, restore tests, and reviews.
Program reviews
Regular reviews keep the program aligned with the current framework version.
How it works
How it works
Assess
We confirm your size tier and review your current controls.
Build
We close the gaps and write the program down.
Run
We operate the controls and collect evidence as the work happens.
Review
We review the program on a schedule and update it when frameworks change.
Resources
Learn more about the law
Our plain-language guide explains who qualifies, what the program looks like at each size, and which frameworks the law names. The readiness checklist helps you see where your organization stands today.
Texas SB 2610 · Cybersecurity Safe Harbor
Safe Harbor readiness checklist
See how your cybersecurity program lines up with what SB 2610 describes for your size. Choose your employee count, answer each question Yes, No or Not sure, and print a brief for your records.
This checklist is general information, not legal advice. Whether the safe harbor applies to a specific claim is a legal question decided on the facts. Talk with your attorney about your situation.
Before you start
Sec. 542.002: “This chapter applies only to a business entity in this state that: (1) has fewer than 250 employees; and (2) owns or licenses computerized data that includes sensitive personal information.”
Chapter 542 leaves two points open: how employees are counted, and what counts as a “business entity”, which matters for nonprofits. Talk with your attorney about how it applies to your organization and your staffing.
Step 1
Choose your size
What the law expects for this size: “Simplified requirements, including password policies and appropriate employee cybersecurity training.” (Sec. 542.004(a)(4)(A))
What the law expects for this size: “Moderate requirements, including the requirements of the Center for Internet Security Controls Implementation Group 1.” (Sec. 542.004(a)(4)(B))
What the law expects for this size: “Compliance with the requirements of Subsection (b).” (Sec. 542.004(a)(4)(C)) In plain terms, Subsection (b) means a current version of one or more listed frameworks, plus the current version of HIPAA, GLBA Title V, FISMA or HITECH if you are subject to them, and a current version of PCI DSS if it applies to you.
Step 2
Answer each question
Choose Yes when every part of the question is true today, unless the note under a question says otherwise.
Responsibility and the written plan
-
Have you named one person as responsible for the program?Good practice
Evidence to keepProgram responsibility record
-
Are your administrative, technical and physical safeguards written down?
Evidence to keepThe written program
-
Is the program designed to protect the security and integrity of personal identifying information and sensitive personal information, and to protect against unauthorized access to or acquisition of that information that would result in a material risk of identity theft or other fraud?
Evidence to keepProgram purpose statement
-
Is the program implemented and maintained, with records that show it in use, not only planned?
Evidence to keepRecords that show the program in use
-
Is responsibility assigned for each control in your selected framework?Good practice
Evidence to keepControl responsibility list
People and access
-
Does each person have their own account, with shared logins retired and admin access kept apart from everyday access?
Evidence to keepAccount list
-
Do you have a written password policy?
Evidence to keepThe password policy
-
Is multifactor authentication on for email and admin access?
Evidence to keepSettings report
-
Have you identified your sensitive information, with access limited to the people who need it?
Evidence to keepAccess list for systems with sensitive information
-
Has each person completed security training?
Evidence to keepTraining completion records
Devices and data
-
Are your hardware and software listed, including laptops and the systems that hold sensitive information?
Evidence to keepDevice and software list
-
Are laptops that hold sensitive information encrypted?
Evidence to keepEncryption status report
-
Are devices kept updated, with new vulnerabilities reviewed and addressed?
Evidence to keepUpdate report
-
Is email protected, and can you show the setting?
Evidence to keepEmail protection settings
-
Is logging on for the systems that hold sensitive information?
Evidence to keepLogging settings
-
Do backups run on a schedule, and has a restore been tested?
Evidence to keepLatest restore test record
Vendors
-
Are vendors who hold or can reach personal identifying information or sensitive personal information listed, with what each one is allowed to do?
Evidence to keepVendor list
Incident readiness
-
Do you have a written plan with the steps for a suspected incident?
Evidence to keepIncident response plan
-
Do you have a written breach notification path, kept apart from this defense?
Texas breach notification duties under Chapter 521 still apply.
Evidence to keepBreach notification procedure
Framework review
-
Have you selected a framework the law lists, such as the NIST Cybersecurity Framework, the CIS Critical Security Controls or the ISO/IEC 27000-series?
Evidence to keepFramework decision record
-
Are all CIS Controls Implementation Group 1 safeguards in place, shown by a current assessment on file?
If any safeguard is still open, choose No and keep a dated plan to close it.
Evidence to keepIG1 assessment and plan
-
Is a gap review against your selected framework on file, with evidence of conformity filed with the program?
Evidence to keepGap review and evidence file
-
Is your framework version current, or is the program being updated to a newer version by the later of its published implementation date or one year after it was published (Sec. 542.004(c))?
Choose Yes if either part is true.
Evidence to keepVersion review record
-
Have you confirmed which of these laws apply to you, with the current version of each one that does built into your program: HIPAA, GLBA Title V, FISMA or HITECH if you are subject to it, and PCI DSS if it applies to you?
If none apply, choose Yes and record that in your list of laws that apply.
Evidence to keepList of laws that apply
Your results
0Yes
0No
0Not sure
0Not answered
Questions to work on
Questions you answer No or Not sure will be listed here.
Your next step
Bring this checklist to a readiness review with our expert team. We will review your current controls against the SB 2610 tier that fits your headcount, show you what is already in place, and give you a clear plan for the gaps.
The safe harbor is decided in the lawsuit, where your organization must show its program was implemented and maintained at the time of the breach. This checklist helps you prepare that record. Among damages, SB 2610 limits only exemplary damages. Compensatory damages, breach notification duties and regulatory enforcement under other laws continue to apply as before.
This page is general information about Texas law, not legal advice for your situation. Consult your attorney about how SB 2610 applies to your organization.
Which SB 2610 tier fits you? Ten quick questions show how SB 2610 likely applies to your organization, including your tier, plus other security rules to know.
Next step
Start with a cybersecurity assessment
We compare your current controls with the SB 2610 tier that fits your headcount, show you what is already in place, and give you a clear plan for the gaps.
This page is general information about Texas law. Your attorney advises on how it applies to your organization.
