Texas SB 2610 Cybersecurity Safe Harbor for SMBs (2026)

SB 2610 creates an affirmative defense against exemplary damages in a lawsuit brought over a breach of system security. If your business maintained a cybersecurity program that reasonably conforms to a recognized industry framework, a plaintiff cannot recover punitive damages from you for that breach. The practical effect is to cap your worst-case exposure — punitive awards are the unpredictable, headline-grabbing part of breach litigation, and this law takes them off the table for prepared businesses.

Be clear about the limits. The safe harbor does not make you immune from a lawsuit, and it does not eliminate compensatory damages, breach-notification duties, or regulatory obligations. It also will not help a business that ignored a known vulnerability or acted with willful disregard. Think of it as a reward for doing the security work you should be doing anyway — not a substitute for it. It sits alongside, not on top of, obligations like the Texas Data Privacy and Security Act.

The law is deliberately proportionate. What you must implement scales with your headcount, so a ten-person shop is not held to the same standard as a 200-person firm:

• Fewer than 20 employees — implement a cybersecurity program with reasonable administrative, technical, and physical safeguards, including basic password and access controls. The bar is real but achievable without a dedicated security team.
• 20 to 99 employees — conform to a recognized framework at an entry level, such as the CIS Controls Implementation Group 1 baseline.
• 100 to 250 employees — maintain a program that conforms to a full recognized framework across its control set.

The safe harbor is aimed squarely at small and mid-sized businesses; very large enterprises fall outside its scope. If your headcount sits near a threshold, confirm the exact tier with counsel, because the size band sets how much program you need to show. The takeaway for most Texas SMBs is encouraging: the required effort is scaled to your size, and the smallest businesses face the lightest lift.

SB 2610 does not invent a new checklist — it points to frameworks your industry already knows. Conforming to any one of the recognized standards satisfies the program requirement:

• The NIST family — the NIST Cybersecurity Framework and NIST SP 800-171 control mappings are the most common anchor for Texas businesses that also handle federal or defense data.
• The CIS Critical Security Controls — the CIS Implementation Groups give smaller businesses a graduated, plain-language path that lines up neatly with the law's size tiers.
• ISO/IEC 27001 — a strong fit for firms that want a certifiable, internationally recognized program.
• Regulatory frameworks — if you already comply with a mandate like the HIPAA Security Rule, the Gramm-Leach-Bliley Act, or PCI DSS for your industry, that program can serve as your recognized framework too.

The strategic move is to pick the framework you are closest to and build once. A firm pursuing SOC 2 readiness or meeting the FTC Safeguards Rule is already most of the way to a qualifying program.

The law asks for a program that reasonably conforms to your chosen framework and is actively maintained — not a binder that was true once and forgotten. In practice, a defensible program shows a written information security policy, identity controls such as phishing-resistant MFA on every account, tested backups following the 3-2-1-1-0 rule, ongoing security awareness training, and evidence that you review and update controls on a schedule. Documentation is the whole game here: if a program is not written down and dated, it is very hard to prove it existed before the incident. Keep the policy, the framework mapping, and your review records where you can produce them on demand.

SB 2610 and your cyber-insurance policy reward the same behavior, and the overlap is worth exploiting. The controls that earn the safe harbor — MFA, backups, logging, training, a framework-based program — are the same ones your carrier already asks about on the application. Building one program lowers your premium, strengthens your renewal, and earns the statutory defense at the same time. It also reduces the real-world likelihood of a breach, which no legal shield can do. Treat the safe harbor as one more reason to fund a program you can defend, and coordinate the effort with your broker and, for the affirmative defense itself, with legal counsel.

This week, do one concrete thing: pick your framework and honestly assess where you stand against it. Count your employees to find your tier, choose the recognized framework you are closest to — for most Texas SMBs that is the CIS Controls or the NIST CSF — and run a gap assessment so you know which controls are missing. Then close the highest-impact gaps first: MFA everywhere, tested and immutable backups, centralized logging, and a written security policy with a review date. When you are ready to formalize and document the program so it will hold up as a legal defense, our compliance services and cybersecurity services map your controls to a recognized framework and keep the evidence current, and our Houston managed IT team keeps those controls running between reviews. Build the program once and let it earn your safe harbor, satisfy your insurer, and lower your actual risk together.

• Houston managed IT
• The Woodlands managed IT
• Sugar Land managed IT