Texas SB 2610Readiness check

Does your organization have fewer than 250 employees?

Does your business operate in Texas or handle personal information of Texas residents?

Does leadership own cybersecurity, with documented roles, policies and a program that is reviewed at least annually?

Do you assess cybersecurity risk at least annually and track remediation?

Do you know which laws, regulations and contracts apply to you and track how you meet them?

Do you assess and manage the security of vendors that touch your data or systems?

Do you maintain an inventory of hardware, software and data, with owners?

Do you classify data and handle sensitive data, including personal information, accordingly?

Do you use secure baseline configurations and prevent unauthorized changes?

Are changes to systems approved, tested and recorded?

Are your cloud services configured securely and reviewed regularly?

Are endpoints protected with current anti-malware or EDR, disk encryption and patching?

Is sensitive data encrypted in transit and at rest, with managed keys?

Do you use unique accounts, strong authentication including multi-factor, and least privilege?

Is your network protected with firewalls, segmentation and secure remote access?

Are facilities and equipment physically protected?

Do you scan for vulnerabilities and apply patches within defined timelines?

Do you screen staff, have acceptable-use rules and remove access promptly at termination?

Do all staff complete security awareness training, including phishing awareness?

Do you monitor systems and logs for suspicious activity, and does someone act on alerts?

Do you have a documented, tested incident response plan?

Do you back up critical data and systems, and have you tested recovery?