Texas SB 2610 limits one kind of damages for smaller businesses with a recognized cybersecurity program, and here is what it covers, what it leaves untouched, and where to start.
If you run a small clinic, law office or financial services firm in Texas, you may have heard that a new law protects you in a breach lawsuit. The real answer is narrower than the headline and more useful than the doubt.
What SB 2610 says
SB 2610 was signed on June 20, 2025, and took effect September 1, 2025. It covers Texas businesses with fewer than 250 employees that own or license computerized data containing sensitive personal information, a description that fits many small clinics, law offices and financial services firms. In a lawsuit arising from a breach of system security, a harmed person cannot recover exemplary (punitive) damages from a covered business if the business shows that, at the time of the breach, it had implemented and maintained a cybersecurity program that conforms to an industry-recognized framework, such as the NIST Cybersecurity Framework or an industry-specific standard.
Three phrases carry the weight, as I read them. "Shows" tells me the business should be ready to demonstrate its program. "At the time of the breach" means building one afterward does not count. "Implemented and maintained" means a binder on a shelf is not enough.
When a referenced standard is updated, the business must update its program by the later of the updated standard's implementation date or the first anniversary of its publication.
What it does not do
The bill limits exemplary damages only. It does not limit compensatory damages, the Attorney General's authority to seek remedies, or regulatory enforcement, so I would not call a business protected or immune. One law firm's summary describes the expected framework as scaling with size: under 20 employees, basic measures such as password policies and employee training; 20 to 99 employees, CIS Controls Implementation Group 1; and 100 to 249 employees, an advanced framework such as NIST CSF or ISO/IEC 27001. This is an auditor's reading and not legal advice, so confirm your path with your attorney.
What I would do first
First, I would choose a framework that fits your size and write down why, since a lighter one your team follows beats an ambitious one nobody maintains. Second, I would compare today's practice with it control by control and record each gap with an owner and a review date. Third, I would keep dated proof, such as training logs, access reviews, policy versions and backup tests, because the business has to show the program existed at the time of the breach. Finally, I would assign someone by name to watch for updates to the standard you chose, given the update rule above. Good tools help, but it is the practice and its people who keep a program real.
If you would like to map where you stand against a framework, book a call with AssureRidge Cyber and I will tell you where I would start.