Texas SB 2610 · In effect since September 1, 2025
The Texas cybersecurity safe harbor, explained for small firms
If your business has fewer than 250 employees and holds sensitive client data, SB 2610 can shield you from punitive damages after a breach — but only if you can show a real cybersecurity program was in place. This guide explains what that takes, in plain English.
Written for Texas tax, accounting, and CPA practices that run on Microsoft 365.
Free seat check
Start here. We will reply by email with a one-page summary. No tenant access, no obligation.
What SB 2610 does
Senate Bill 2610 added Chapter 542 to the Texas Business & Commerce Code. It gives qualifying small businesses a defense in one specific situation.
- It blocks exemplary (punitive) damages in a lawsuit over a data breach — if your cybersecurity program met the statute’s requirements when the breach happened.
- It does not erase liability. Ordinary damages and Attorney General enforcement are unaffected.
- It does not create a new right to sue, for or against you.
- The practical takeaway: have a documented program — usually a Written Information Security Program (WISP) — scaled to your size and tied to a recognized framework.
Who it covers
A business in Texas with fewer than 250 employees that owns or licenses computerized data containing sensitive personal information. Every covered size needs a cybersecurity program aligned to a recognized framework. Headcount only changes how much is expected.
The statute names password policies and employee cybersecurity training as the floor — not the whole program. A lightweight, framework-aligned program is still required.
Includes the CIS Critical Security Controls Implementation Group 1 (IG1), on top of the requirements that apply to every covered business.
Conform to a listed framework such as NIST CSF, CIS Controls, ISO 27000, SCF, or SOC 2.
How the free seat check works
A quick way to see where your Microsoft 365 setup stands against what SB 2610 expects for a firm your size. Offered by threep in North Texas.
- Answer a short questionnaire
Seats, MFA, admin accounts, backups, and whether you have a WISP. About 5 minutes. We never ask for access to your tenant.
- Get a one-page summary by email
Your likely SB 2610 tier and the top three gaps we see in your answers. Reviewed by a person, not an automated score.
- Talk it through, if you want
An optional 30-minute call about next steps for a WISP or Microsoft 365 hardening. No obligation.
Occasional email updates
A few short notes a year on SB 2610, WISPs, and Microsoft 365 basics. Unsubscribe anytime. Secondary to the free seat check.