TIER 01
Micro Business
< 20
Password policies, employee cybersecurity training, and documented safeguards. The lightest lift — but still requires proof.
Texas Senate Bill 2610
Effective · Sep 2025
Protect your business.
Limit your ◆ liability.
Texas law now shields businesses under 250 employees with a documented cybersecurity program from punitive damages in breach lawsuits. We make compliance simple, affordable, and provable — especially for oil & gas operators, law firms, and healthcare practices.
The Law in Plain English
Safe Harbor rewards the prepared.
Effective September 1, 2025, Texas SB 2610 created a legal safe harbor: if your business (under 250 employees) maintains a documented cybersecurity program aligned with a recognized framework, you're protected from exemplary (punitive) damages if you suffer a breach.
With a compliant program
- Shielded from exemplary (punitive) damages
- Litigation-ready proof of due care
- Stronger position with insurers and clients
- Framework alignment satisfies HIPAA overlap
- Documented evidence for security questionnaires
Without one
- Exposed to actual and punitive damages
- A ready-made negligence argument against you
- Harder cyber-insurance renewals
- Failed security questionnaires from key clients
- Regulatory penalties layered on top
Requirements Scale With Size
Three tiers. Clear expectations.
The law scales what's required to match the size of your business — bigger practices, more documentation.
TIER 02
Small Business
20–99
CIS Controls Implementation Group 1 alignment: formal documentation, role-based access controls, and regular assessments.
TIER 03
Mid-Size Business
100–249
Full alignment with NIST CSF, ISO 27001, HIPAA Security Rule, or SOC 2 — with documented evidence and independent review.
FAQ
What practices ask us most.
Does SB 2610 apply to my business?
If your business has fewer than 250 employees and handles sensitive information — including patient records, client data, operational or financial information — SB 2610 applies to you. For oil & gas operators, law firms, and healthcare practices, this is nearly universal.
What counts as a "recognized framework"?
Approved frameworks include NIST CSF 2.0, CIS Controls, ISO 27001, SOC 2, and the HIPAA Security Rule. The exact framework depends on your size tier — we help you pick the right one and document it correctly.
How long does it take to get compliant?
Most practices reach documented Safe Harbor status in 45–90 days. Micro businesses can be done in as little as 30. The bottleneck is usually documentation, not technology.
How much does it cost?
Our Safe Harbor programs are included in our Fortress Managed and Fortress Command plans. If you already have security services in place, we can build the compliance layer as a fixed-scope project — pricing depends on your size tier.
Does this overlap with HIPAA or my cyber-insurance requirements?
Yes — heavily. HIPAA Security Rule alignment satisfies the mid-tier SB 2610 requirements, and most cyber insurers require the same underlying controls. We build one program that satisfies all three.
Do you serve businesses outside Houston?
Yes. We support oil & gas operators, law firms, and healthcare practices across Texas remotely, with on-site engagements available in the Greater Houston Metroplex.
Ready?
Get Safe Harbor ready ◆
30 to 90 days to full compliance. Let's build your program.