What Texas SB 2610 actually asks of a 40-person company

Senate Bill 2610 added Chapter 542 to the Business and Commerce Code. It applies to a business that owns or licenses computerized data containing sensitive personal information and has fewer than 250 employees. If such a business is sued in tort after a breach, it is entitled to an affirmative defense against exemplary damages, the punitive part of a judgment, if it can show it implemented and maintained a cybersecurity program that met the statute's requirements at the time of the breach.

It does not shield the business from actual damages, from the Attorney General, or from the duty to notify. The clocks in Business and Commerce Code §521.053 keep running: affected Texans have to be told within 60 days of the breach being determined, and the Attorney General within 30 days if 250 or more Texans are affected; those reports are published by the Attorney General, so the second clock is a public one.

The statute scales the expected program to headcount, as the text reads:

• Fewer than 20 employees: a program with reasonable cybersecurity measures, such as password policies and employee awareness training
• 20 to 99 employees: a program that conforms at least to the Center for Internet Security's Critical Security Controls at Implementation Group 1
• 100 to 249 employees: a program that conforms to a recognized framework, among them the NIST Cybersecurity Framework, NIST SP 800-53 or 800-171, the CIS Controls, ISO/IEC 27001, or the federal cloud baseline

A company of forty is in the middle tier, so the question is a specific one: does its program conform to CIS Controls Implementation Group 1? The statute also expects a program to keep up when the framework it follows is revised, within a reasonable period, which is a way of saying the document has a review date on it.

IG1 is the 56 foundational safeguards of the 18 CIS Controls, chosen to be achievable by a small company with limited IT staff. Grouped the way we build them:

• Know what you have: an inventory of every device and every piece of software, with the unauthorized ones removed
• Know where the data is: what sensitive data exists, where it lives, who can reach it, and when it is disposed of
• Standard configurations: laptops, servers, and the firewall built from a baseline rather than from defaults, with unused accounts and services off
• Accounts and access: unique accounts per person, multi-factor authentication on remote access and on every administrator account, access removed when it is no longer needed
• Patching: operating systems and applications updated on a written schedule, with a vulnerability scan that tells you what was missed
• Logs: kept, with time synchronized, for the systems that matter
• Email and browsers: DNS filtering and mail protections in place
• Malware defenses: on every device, updating on their own
• Recovery: backups automated, protected, kept off-site, and restored from on a schedule to prove they work
• The network: infrastructure kept current and managed
• People: security awareness training at hire and yearly, including phishing and password handling
• Vendors: a list of the service providers that hold your data
• Incidents: a named person to handle an incident, and a way for staff to report one

The defense is only available for a program that existed at the time of the breach, so a program written afterwards is worth nothing, and a program that existed only as a policy nobody followed is worth very little. What a court, an insurer, or a customer's questionnaire will want to see is artifacts: the asset inventory with a date on it, the report showing multi-factor authentication is on for every administrator, the patch report for last month, the log of the last restore test, the training records, the vendor list, and a review date on the program itself.

That is a folder, kept current, with an owner. Most of its contents are things a well-run IT function produces anyway, which is why the gap at a 40-person company is usually documentation and three or four controls rather than a program from scratch.

No figure, because it depends on the estate, but the shape is consistent. A company that already has managed endpoints, a real firewall, tested backups, and multi-factor authentication is a documentation exercise away from IG1. A company running Windows 10 on the floor, a server under a desk, and shared admin passwords has the same list of projects it needed anyway, now with a reason to schedule them. The write-up is the same document either way, and it also answers most of what a cyber-insurance application asks.

This is not a certification. Nobody certifies a company against IG1 or the NIST framework, and a provider that says it will is selling a stamp. What we produce is the security baseline and documentation described on our Enterprise IT services page, written against the statute and the framework, with the artifacts above in it, and reviewed on a date.

The text is short and worth reading: Business and Commerce Code Chapter 542 for the safe harbor, and §521.053 for the notification clocks. None of this page is legal advice; what the statute means for your company is a question for your counsel, and the baseline document is written so it can be handed to them.