SB 2610 Guide by threep LLC

Recognized cybersecurity frameworks

The SB 2610 safe harbor depends on a cybersecurity program that conforms to an industry-recognized framework, among other requirements. Section 542.004(b) lists the options.

Frameworks named in the statute

A program may conform to a current version, or any combination of current versions, of:

  • NIST Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF)
  • NIST Special Publication 800-171
  • NIST Special Publications 800-53 and 800-53a
  • FedRAMP Security Assessment Framework
  • Center for Internet Security (CIS) Critical Security Controls
  • ISO/IEC 27000-series
  • HITRUST Common Security Framework
  • Secure Controls Framework (SCF)
  • Service Organization Control Type 2 (SOC 2)
  • “other similar frameworks or standards of the cybersecurity industry”

If the business is subject to them, the statute also recognizes current versions of HIPAA, Gramm-Leach-Bliley (Title V), FISMA, and HITECH, and, if applicable, PCI DSS.

Source: enrolled SB 2610, Sec. 542.004(b).

Which framework for which size

Fewer than 20 employees. Simplified requirements, including the password policies and training called out in the text. Framework conformance under (a)(2) still applies.

20 to 99 employees. Sec. 542.004(a)(4)(B) calls for moderate requirements including CIS Controls Implementation Group 1. That is in addition to the rest of 542.004(a), not instead of it.

100 to 249 employees. The statute points to conforming with Subsection (b).

For most small tax and CPA firms, CIS Controls IG1 is the practical starting point. It is short, well documented, and maps cleanly onto Microsoft 365 settings.

When a framework is updated

If a listed standard changes, Sec. 542.004(c) gives you time to catch up: the later of the published implementation date or one year after publication.

What this page does not do

It does not map every CIS IG1 safeguard to Microsoft 365 settings, and it does not certify compliance. For a short, questionnaire-based read on your own setup, use the free seat check.

Independent guide by threep LLC. Not affiliated with the State of Texas or any government agency. Not legal advice. Statute: enrolled SB 2610.