02 / Build / Texas SB 2610
Texas SB 2610:The Cybersecurity Safe Harbor for Smaller Businesses
A written program can limit exemplary damages after a breach.
Texas SB 2610 prevents a person harmed by a data breach from recovering exemplary damages from a Texas business with fewer than 250 employees, if that business implemented and maintained a cybersecurity program that conforms to an industry-recognized framework.
The law at a glance
- What it does: a person harmed by a data breach may not recover exemplary damages from a covered business that shows it had a qualifying cybersecurity program in place at the time of the breach.
- Who it covers: a business entity in Texas that has fewer than 250 employees and owns or licenses computerized data that includes sensitive personal information.
- When it took effect: September 1, 2025, for causes of action that accrue on or after that date.
- What it does not do: it applies to exemplary damages only. Compensatory damages remain available, and the law does not create new duties or penalties.
What your program has to show
You have to be able to demonstrate that, at the time of the breach, your business had implemented and maintained a cybersecurity program that:
- Contains administrative, technical and physical safeguards to protect personal information
- Conforms to an industry-recognized cybersecurity framework
- Was written down and actually followed, not just drafted
- Was kept current. When a framework is updated, the program must be updated by the later of the date the updated standard says to implement it or one year after it is published.
Documentation is what makes the protection usable. If you cannot show the program and the evidence that you followed it, you cannot rely on it.
Frameworks the statute recognizes
- NIST publications, including the NIST Cybersecurity Framework and SP 800-171 and 800-53
- CIS Critical Security Controls
- ISO/IEC 27000-series standards
- HITRUST Common Security Framework
- The Secure Controls Framework (SCF)
- SOC 2 Type 2
- FedRAMP
- Sector rules such as HIPAA and HITECH, the Gramm-Leach-Bliley Act and FISMA
- Other similar frameworks or standards
The list is not a checklist you must complete. You choose a framework that fits your business and conform to it.
How expectations scale with size
| Employees | What the statute expects |
|---|---|
| Fewer than 20 | A simplified program, such as strong passwords and security training |
| 20 to 99 | Conformity with CIS Controls Implementation Group 1 |
| 100 to 249 | Conformity with a full recognized framework |
Headcount is only part of the picture. A ten-person firm that holds thousands of client files carries different risk than a 250-person manufacturer, so match your program to the volume and sensitivity of the data you hold.
How Logos helps you qualify
- See where you stand. Take the Texas SB 2610 readiness check, which follows the 20 domains of the SCF CORE Fundamentals control set, designed for smaller organizations.
- Choose and design the framework. We build one control set around your systems and data, using the Secure Controls Framework, so it maps to the other obligations you face.
- Write the program. Policies, procedures and records that show how your controls work.
- Close the gaps. A prioritized plan for people, process and technology, with endpoint protection, identity and MFA and monitoring where you need them.
- Keep it current. Annual reviews and ongoing governance through vCISO services.
- Be ready if it happens. Incident response planning and an incident response retainer.
Six steps to take now
- Confirm that your business is covered: Texas, fewer than 250 employees, and sensitive personal information on your systems.
- Pick a recognized framework that fits your size and data.
- Assess your current state against it.
- Write the program and assign owners.
- Put the safeguards in place and keep the evidence.
- Review and update the program at least annually, and whenever the framework changes.
Common questions
Does SB 2610 stop someone from suing me after a breach?
No. It limits the exemplary damages a harmed person can recover from a covered business that shows a qualifying program. Compensatory damages remain available.
Does my business qualify?
The statute covers a business entity in Texas with fewer than 250 employees that owns or licenses computerized data that includes sensitive personal information. Ask your attorney how it applies to your situation.
Do I need a certification?
The statute asks you to demonstrate that you implemented and maintained a program that conforms to an industry-recognized framework. It does not name a required certification.
Which framework should I choose?
It depends on your size, your data and your other obligations. Many smaller organizations start with a framework built for them, such as SCF CORE Fundamentals or CIS Controls Implementation Group 1, and add to it as they grow.
When did it take effect?
September 1, 2025, for causes of action that accrue on or after that date.
Is this legal advice?
No. Logos Systems is not a law firm. This page describes the statute in general terms. Talk to your attorney about how it applies to you.
Reference
Bill text: Texas Legislature, SB 2610 (89th Regular Session).
Build the program that earns the protection.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call (877) 77-vCISO.