This article provides general information to support the development of a cybersecurity program. It is not legal advice.

Ask a business owner why they have not invested more heavily in cybersecurity and the answer is often straightforward: there are always other places to spend the money.

That is one of the difficulties with making the security business case. When cybersecurity works, the result can be almost invisible. No breach. No disruption. No customer data exposed. It can be difficult to put a dollar value on something that did not happen.

For some Texas small businesses, that conversation has now changed.

Since September 1, 2025, Texas law has provided qualifying businesses with protection from exemplary damages, commonly referred to as punitive damages, following a breach if they can demonstrate that an appropriate cybersecurity program was in place at the time.

That gives security leaders and business owners another way to think about return on investment.

Cybersecurity is still about reducing the likelihood and impact of an attack. But now, for qualifying Texas businesses, there can also be a clearer legal benefit to being able to demonstrate that reasonable security measures were already in place.

What Changed?

Texas Senate Bill 2610 created a cybersecurity safe harbor for certain businesses with fewer than 250 employees.

Under the law, a person harmed by a breach cannot recover exemplary damages from a qualifying business if that business can demonstrate that, at the time of the breach, it had implemented and maintained a cybersecurity program that met the law’s requirements. The provision applies to Texas business entities with fewer than 250 employees that own or license computerized data containing sensitive personal information.

That potentially covers a broad range of smaller organizations, from professional services firms and contractors to clinics, dealerships and regional businesses.

Why does that matter?

Exemplary damages are different from damages intended simply to compensate someone for a loss. They are designed to punish particularly serious conduct. That makes them one of the harder parts of potential breach exposure to predict.

The Texas law does not make a business immune from the consequences of a breach. But it does give qualifying organizations another reason to be able to show that cybersecurity was being taken seriously before something went wrong.

The Requirements Scale With the Business

One of the more practical aspects of the Texas law is that it recognizes that a 15-person company and a 200-person company should not be expected to run identical security programs.

For businesses with fewer than 20 employees, the legislation provides for simplified requirements, including password policies and appropriate employee cybersecurity training.

Businesses with 20 to 99 employees face a more substantial requirement, including the Center for Internet Security Controls Implementation Group 1.

For organizations with 100 to 249 employees, the program must conform to one or more recognized cybersecurity frameworks identified by the legislation.

The list is deliberately broad. It includes the NIST Cybersecurity Framework, NIST 800-171, NIST 800-53, CIS Critical Security Controls, ISO/IEC 27000-series standards, SOC 2 Type 2, HITRUST, the Secure Controls Framework and FedRAMP. Regulated organizations may also be able to meet the requirement through applicable federal standards such as HIPAA, Gramm-Leach-Bliley, FISMA or HITECH, while PCI DSS is recognized where applicable.

That matters because many organizations may already be doing part of this work.

The opportunity is to move from a collection of individual security tools and activities toward a documented, repeatable program that can be demonstrated when someone asks for evidence.

The Protection Is Only as Strong as the Evidence Behind It

This may be the most important practical point in the law.

The business has to demonstrate that the qualifying cybersecurity program was implemented and maintained when the breach occurred.

That makes documentation more than an administrative exercise.

Imagine trying to prove what security controls were operating 18 months after an incident. The employee who configured them may have left. The technology may have changed. Processes that everyone remembers following may never have been formally recorded.

A security control that exists but cannot be demonstrated can become difficult to defend.

That is why everyday records matter: a dated cybersecurity program, framework mappings, training records, assessment results, evidence that controls were operating, and documented risk decisions showing what was accepted, remediated or escalated.

The goal is not paperwork for its own sake.

It is being able to show that the business had a credible security program, that it understood its risks and that people were actively managing them.

Cyber Insurance and Safe Harbor Solve Different Problems

Cyber insurance remains an important part of risk management for many organizations, but insurance and this legal protection are not the same thing.

Insurance can help address costs such as incident response, legal support, breach notification, credit monitoring and covered losses.

Exemplary damages sit in a more complicated area. Policies can vary considerably in how punitive or exemplary damages are treated, particularly where insurability differs by jurisdiction.

The Texas safe harbor adds another layer to that risk discussion.

That can make the cybersecurity conversation with boards, lenders, investors and enterprise customers more concrete. Instead of discussing security purely in terms of reducing the probability of a breach, businesses can talk about how preparation can also influence the potential consequences when an incident occurs.

And the investment does not only serve one purpose.

The same evidence of a mature security program can appear in a cyber insurance application, a large customer’s security questionnaire, a regulatory discussion or the due diligence process around an acquisition.

Build the program once and it can create value in several different conversations.

Where the Protection Stops

The safe harbor should not be confused with immunity.

It protects qualifying businesses from one particular category of damages. It does not remove other potential liabilities following a breach.

Compensatory damages can still apply. Contractual obligations still matter. Regulatory action is not removed. The law also states that it does not create a new private cause of action or change existing common-law or statutory duties.

There is another reason for caution: this is still relatively new legislation.

There is not yet a developed body of Texas case law showing exactly how courts will apply the protection in different breach scenarios.

Gross negligence is one example worth watching. Under Texas law, gross negligence is ordinarily one of the grounds on which exemplary damages may be awarded. The new cybersecurity statute does not expressly include the kind of gross-negligence carve-out seen in some other state safe-harbor laws.

That does not mean organizations should assume the protection will apply regardless of their conduct. It means businesses should build security programs around reducing risk and meeting their obligations, not around testing the limits of an untested legal defense.

Texas Is Not Alone

Texas is part of a wider trend.

Connecticut also restricts punitive damages in certain breach-related claims where an organization maintained and complied with a qualifying written cybersecurity program. Unlike Texas, its law is not limited to businesses below a particular employee threshold, and its protection does not apply where the failure resulted from gross negligence or willful or wanton conduct.

Ohio takes a different approach. Rather than limiting one category of damages, its law can provide a qualifying organization with an affirmative defense to certain tort claims alleging that inadequate information security controls resulted in a breach.

Utah also provides affirmative defenses for qualifying organizations, including certain claims relating to inadequate security controls, breach response and notification. But the defense can be lost where an organization had actual notice of a threat, failed to take known remedial action within a reasonable time and that threat resulted in the breach.

For businesses operating across multiple states, the details matter. But there is an encouraging common thread: these laws consistently point organizations back toward recognized security frameworks and documented cybersecurity programs.

A Better Cybersecurity Business Case

For years, security teams have had to make a difficult argument.

Invest now so that something bad might not happen later.

That remains true, but it is no longer the whole story.

A well-designed, framework-based cybersecurity program can deliver value in several ways. First, it reduces the likelihood and potential impact of a cyber incident. Second, it gives customers, insurers and business partners greater confidence in how the organization manages risk. And in Texas and several other states, it may also provide meaningful legal protection when a breach occurs.

That turns cybersecurity into a much more familiar business discussion: risk, investment, evidence and return.

Security should never be treated as a box to check purely to qualify for a legal safe harbor. But if a stronger cybersecurity program can protect the business, support commercial relationships and reduce uncertainty around the worst-case scenario, the budget conversation becomes much easier to have.

Kudelski Security helps organizations understand where they stand, choose an appropriate cybersecurity framework and close the gaps that matter most. Contact our experts to start the conversation.

Sources

Statutory language above was read directly from these primary sources.

• Texas S.B. 2610, enrolled text, adding ch. 542 to the Business and Commerce Code: https://legiscan.com/TX/bill/SB2610/2025
• Texas Senate Research Center bill analysis, S.B. 2610, enrolled, June 12, 2025: https://capitol.texas.gov/tlodocs/89R/analysis/html/SB02610F.htm
• Texas Legislature Online, S.B. 2610 bill history: https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2610
• Conn. Gen. Stat. § 42-901, Adoption of cybersecurity controls by businesses. Exemption from punitive damages (P.A. 21-119): https://www.cga.ct.gov/current/pub/chap_747.htm#sec_42-901
• Ohio Rev. Code § 1354.02, Safe harbor requirements (S.B. 220, 132nd G.A., effective November 2, 2018): https://codes.ohio.gov/ohio-revised-code/section-1354.02
• Utah Code § 78B-4-702, Affirmative defense for a breach of system security (2021 Gen. Sess., ch. 40): https://le.utah.gov/xcode/Title78B/Chapter4/78B-4-S702.html

‍