A new cybersecurity standard for Texas businesses
Starting September 1, 2025, a new Texas law, Senate Bill 2610 (SB 2610), changes how small and mid-sized businesses handle cybersecurity and legal risk. It reads like one more government requirement. It is closer to the opposite. SB 2610 is one of the few laws we have seen that rewards a business for doing the right thing. Have a qualifying security program in place, and a lawsuit over a data breach can't bring punitive damages. Skip it, and that protection isn't there when you need it.
What Texas SB 2610 does
Texas SB 2610 creates a "Safe Harbor" for businesses with fewer than 250 employees. If your business had a recognized cybersecurity program in place when a breach happened, the plaintiff in a lawsuit over that breach can't recover exemplary (punitive) damages. That is the whole protection. Actual damages, the breach notification deadlines, and Attorney General penalties still apply, and the law doesn't stop anyone from suing.
Which cybersecurity frameworks qualify?
The statute recognizes these frameworks, among others:
- NIST Cybersecurity Framework (CSF)
- ISO/IEC 27001
- CIS Controls (Center for Internet Security)
- SOC 2 (for service organizations)
- HIPAA Security Rule (for healthcare organizations)
- PCI DSS (for businesses handling payment cards)
How much the law expects depends on headcount. With fewer than 20 employees, it calls for simplified requirements, including password policies and employee cybersecurity training. From 20 to 99 employees, it calls for moderate requirements, including CIS Controls Implementation Group 1. From 100 to 249, the program has to follow one of the full frameworks.
What this means for your Central Texas business
If you own a business in Kyle, San Marcos, Bastrop, or Austin, this is worth an hour of your attention. Getting compliant does not have to be complicated or expensive, especially if you already work with a managed IT provider who knows these frameworks. Much of what the frameworks ask for is what a well-run IT setup should be doing anyway.
At safemode IT, we help Central Texas businesses build and maintain cybersecurity programs that follow these frameworks. We handle the technical work, the documentation, and the ongoing monitoring, so you can qualify for safe harbor protection and get back to running the business.
The time to set this up is before a breach. Book a 10-minute discovery call with safemode IT and find out where your business stands under Texas SB 2610.
Not sure your IT is as solid as it should be? Take 10 minutes and tell us about your setup. No pressure, no obligation.
Book a 10-Minute Discovery Call →Frequently asked questions
What is Texas SB 2610?
Senate Bill 2610 is a Texas law that took effect September 1, 2025. It creates a cybersecurity safe harbor for businesses with fewer than 250 employees. If a business had a recognized cybersecurity program in place when a breach happened, a lawsuit over that breach can't bring punitive damages against it.
Who qualifies for the SB 2610 safe harbor?
Businesses with fewer than 250 employees that adopt and maintain a cybersecurity program based on a recognized framework. The program has to be in place at the time of the breach and kept up, so a one-time checklist does not get you there.
Which cybersecurity frameworks count under SB 2610?
The NIST Cybersecurity Framework (CSF), ISO/IEC 27001, CIS Controls, SOC 2 for service organizations, the HIPAA Security Rule for healthcare organizations, and PCI DSS for businesses that handle payment cards. Which one fits depends on your industry and what data you hold.
What protection does SB 2610 give a business after a data breach?
One thing. The plaintiff in a data breach lawsuit can't recover exemplary (punitive) damages. Actual damages, breach notification duties, and regulatory penalties still apply. Without a qualifying program, punitive damages are back on the table.
Can safemode IT help us qualify for the SB 2610 safe harbor?
Yes. We build and maintain cybersecurity programs for Central Texas businesses that follow the recognized frameworks, and we handle the technical implementation, documentation, and ongoing monitoring. Learn more about our cybersecurity services or book a 10-minute discovery call.
Last updated: October 11, 2026
