7 Texas Cybersecurity Rules Every Small Business Must Follow

Texas small businesses face stringent cybersecurity requirements with 60-day breach notification deadlines. With 43% of cyberattacks targeting small businesses and 60% closing after breaches, compliance with Texas’ Safe Harbor Program is crucial for legal protection and business survival.

7 Texas Cybersecurity Rules Every Small Business Must Follow

• Texas small businesses must notify affected individuals within 60 days of a data breach and report to the Texas Attorney General within 30 days if 250+ residents are affected.
• The Texas Cybersecurity Safe Harbor Program (SB 2610) protects compliant businesses from punitive damages with requirements scaled based on company size.
• Small businesses are prime targets for cybercriminals, with 43% of all cyberattacks targeting them and 60% shutting down within 6 months of a data breach.
• Implementing industry-recognized frameworks like NIST or CIS Controls can significantly reduce your cybersecurity risk while ensuring legal compliance.
• TechEd Publishers offers comprehensive guides to help Texas small businesses navigate and implement these critical cybersecurity requirements.

The Hidden Vulnerability: Why Texas Small Businesses Are Prime Cyber Targets

Small businesses in Texas are increasingly finding themselves in cybercriminals’ crosshairs. Despite their size, these organizations have become prime targets, with 43% of all cyberattacks now directed at small businesses. The consequences are devastating – 60% of small businesses shut down within six months following a data breach.

Why are small businesses so vulnerable? The answer is simple: they typically invest less than $500 in cybersecurity on average while housing valuable data. This combination of minimal protection and valuable assets creates an irresistible target for cybercriminals looking for easy wins. Texas businesses in particular face unique challenges with the state’s expanding economy making them attractive targets for hackers seeking financial information, customer data, and intellectual property.

The threat landscape has changed significantly, with TechEd Publishers tracking ransomware as the number one cyber threat to businesses today. Their research shows that phishing attempts account for a staggering 90% of all data breaches, highlighting the importance of employee awareness and training.

Texas Data Breach Notification Law: Your 60-Day Legal Obligation

1. When notification is required

Under Texas law, any business that conducts operations in the state must notify individuals when their sensitive personal information has been acquired by an unauthorized person. This notification requirement is triggered when both computerized data and personal identifying information are compromised. The law specifically covers incidents involving an individual’s first name or first initial and last name combined with sensitive data elements like Social Security numbers, driver’s license information, or financial account details.

2. What information must be included

Texas law requires breach notifications to be clear and comprehensive. Your notice must include:

• A detailed description of the incident
• The type of information that was compromised
• Steps individuals should take to protect themselves
• Actions your business is taking to prevent future breaches
• Contact information for further inquiries
• Whether notification was delayed due to law enforcement investigation

3. Methods of notification

The law provides several acceptable methods for notifying affected individuals:

• Written notice sent to the individual’s last known address
• Electronic notification (if consistent with E-SIGN Act requirements)
• Substitute notice methods when direct notification costs would exceed $250,000, affected individuals exceed 500,000, or insufficient contact information exists

4. Penalties for non-compliance

Failing to comply with Texas breach notification laws carries severe consequences. Businesses face civil penalties ranging from $2,000 to $50,000 per violation. For continuing violations, penalties can reach up to $250,000. Additionally, the Texas Attorney General can recover reasonable expenses, including attorney fees, investigation costs, and court costs. These significant financial penalties underscore the importance of having proper breach notification procedures in place.

SB 2610: The Texas Cybersecurity Safe Harbor Program

The Texas Cybersecurity Safe Harbor Program, established by Senate Bill 2610, represents a significant shift in how Texas approaches cybersecurity for small businesses. Rather than just imposing penalties, this program offers protection from punitive damages in legal actions following a data breach – but only if your business has implemented appropriate cybersecurity measures.

1. Tiered requirements by company size

One of the most practical aspects of SB 2610 is its recognition that not all businesses have the same resources. The requirements are intelligently scaled based on your company size:

• Businesses with fewer than 20 employees: Need to implement basic cybersecurity measures like password policies and employee training.
• Businesses with 20-99 employees: Must adopt the CIS Controls Implementation Group 1 (IG1), which provides essential cyber hygiene practices designed specifically for resource-constrained organizations.
• Businesses with 100-249 employees: Required to implement more comprehensive frameworks such as the NIST Cybersecurity Framework, HITRUST Common Security Framework, or ISO/IEC 27001 standards.

This tiered approach ensures that even the smallest businesses can achieve meaningful protection while scaling requirements for larger organizations with more resources.

2. Documentation necessities

Simply implementing security measures isn’t enough – you must document your program. Required documentation includes:

• Written cybersecurity policies and procedures
• Records of employee training sessions
• Documentation of risk assessments
• Incident response plans
• Evidence of regular security updates and maintenance

This documentation serves as proof that your cybersecurity program was active and maintained prior to any breach, which is essential for qualifying for the safe harbor protection.

3. Framework implementation guidelines

When implementing your chosen framework, focus on these critical elements:

• Identify and inventory all systems and data requiring protection
• Implement appropriate security controls based on your tier requirements
• Establish monitoring systems to detect potential security incidents
• Develop response procedures for when incidents occur
• Create recovery protocols to restore operations after an incident

Frameworks like CIS Controls IG1 provide a prioritized set of actions that deliver the highest cybersecurity return on investment, making them particularly valuable for resource-constrained small businesses.

Ready to assess your current compliance status? Use our interactive checker below:

Secure Data Handling Under the Texas Information Disposal Act

How you dispose of sensitive information is just as important as how you protect it while in use. The Texas Information Disposal Act establishes specific requirements for the destruction of records containing personal identifying information.

1. Proper destruction methods

The law requires businesses to destroy or arrange for the destruction of customer records containing personal identifying information. Acceptable destruction methods include:

• Physical shredding of paper documents using cross-cut or micro-cut shredders
• Pulverizing or incinerating paper records beyond recognition
• Reformatting storage devices that fully overwrites the data
• Using specialized software designed for secure data deletion

The key requirement is that the destruction method must render the information unreadable or undecipherable through commonly available means.

2. Electronic media sanitization standards

For electronic data, simple deletion is insufficient. When disposing of computers, servers, or storage devices, you must:

• Use data wiping software that meets Department of Defense standards
• Perform multiple-pass overwriting for magnetic media
• Utilize secure erase commands for solid-state drives
• Consider physical destruction for highly sensitive information storage devices

These measures ensure that deleted data cannot be recovered using commonly available data recovery tools.

3. Certificate of destruction requirements

When using third-party services for destruction, you should:

• Obtain a certificate of destruction documenting when and how records were destroyed
• Maintain these certificates as part of your compliance documentation
• Verify that your vendors follow secure destruction protocols
• Consider on-site destruction services for highly sensitive materials

Keeping these certificates provides evidence of compliance with disposal requirements and helps demonstrate due diligence in protecting sensitive information.

TDPSA Compliance: What Small Businesses Must Know

The Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, introduces new requirements for businesses handling consumer data. While many small businesses may be exempt from full compliance, specific provisions still apply.

1. Small business exemptions and limitations

The TDPSA generally exempts businesses that qualify as “small businesses” under the federal Small Business Administration’s size standards. However, this exemption has an important limitation: even exempt small businesses must obtain consent before selling sensitive personal data. This requirement applies regardless of company size.

Small businesses should carefully review whether they engage in activities that might constitute “selling” data – this could include sharing customer information with marketing partners or data analytics companies.

2. Consent requirements for selling sensitive data

If your small business sells sensitive personal data, you must:

• Obtain clear, informed consent from consumers before selling their sensitive data
• Make consent mechanisms easily accessible and understandable
• Provide a straightforward method for consumers to withdraw consent
• Maintain records of obtained consent for compliance purposes

Sensitive data includes information like precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric data, and children’s data.

3. Consumer rights you must honor

While fully-regulated businesses under TDPSA must honor a wider range of consumer rights, even exempt small businesses should be prepared to respect consumer choices regarding sensitive data. This includes:

• Honoring opt-out requests regarding the sale of sensitive data
• Providing clear information about data collection practices
• Implementing reasonable security measures to protect collected data
• Responding promptly to consumer inquiries about their data

These practices not only help with compliance but also build consumer trust and demonstrate your commitment to responsible data handling.

Essential Cybersecurity Measures for Texas Compliance

1. Employee training requirements

Your employees represent both your greatest vulnerability and your first line of defense. Effective training should include:

• Annual cybersecurity awareness training for all staff
• Specific training on recognizing and responding to phishing attempts
• Instruction on secure handling of sensitive information
• Clear procedures for reporting suspected security incidents
• Regular refresher training as threats change

Consider using training programs certified by the Texas Department of Information Resources, which meet state standards for cybersecurity education.

2. Implementing password policies and MFA

Weak passwords remain one of the easiest entry points for attackers. A robust password policy should include:

• Requirements for complex passwords (12+ characters with a mix of uppercase, lowercase, numbers, and symbols)
• Regular password changes, but not so frequent that users resort to predictable patterns
• Prohibition of password reuse across multiple accounts
• Implementation of multi-factor authentication (MFA) for all critical systems and accounts
• Use of password managers to help employees maintain unique passwords

Multi-factor authentication has been shown to prevent 99.9% of automated attacks, making it one of the most cost-effective security measures available.

3. Data backup and recovery planning

In the event of ransomware or other disasters, your backup strategy could mean the difference between a minor inconvenience and a business-ending catastrophe. A proper backup plan includes:

• Regular automated backups of all critical business data
• Following the 3-2-1 rule: three copies of data, on two different media types, with one copy stored offsite
• Testing backup restoration procedures regularly to ensure they work when needed
• Keeping some backups disconnected from the network to protect against ransomware
• Documenting the entire backup and recovery process for quick implementation during emergencies

4. Network security fundamentals

Securing your network infrastructure is critical for preventing unauthorized access. Essential network security measures include:

• Implementing and properly configuring firewalls to filter network traffic
• Segmenting networks to contain potential breaches
• Securing Wi-Fi networks with strong encryption (WPA3 when possible)
• Using virtual private networks (VPNs) for remote access
• Regular scanning for vulnerabilities and prompt patching of systems

These network defenses create multiple layers of protection that make it significantly harder for attackers to penetrate your systems.

5. Incident response planning

Despite best efforts, security incidents can still occur. Having a documented incident response plan allows you to act quickly and effectively when they do. Your plan should include:

• Clear definitions of what constitutes a security incident
• Assigned roles and responsibilities for response team members
• Step-by-step procedures for containing and eradicating threats
• Communication templates for notifying affected parties and authorities
• Documentation requirements for the incident and response activities
• Post-incident review procedures to improve future responses

Regularly testing your incident response plan through tabletop exercises ensures your team is prepared when a real incident occurs.

Industry-Specific Cybersecurity Requirements

Beyond the general requirements that apply to all businesses, certain industries face additional regulatory obligations.

1. Healthcare-specific obligations (HIPAA)

Healthcare providers, health plans, and healthcare clearinghouses in Texas must comply with the Health Insurance Portability and Accountability Act (HIPAA). Key requirements include:

• Conducting regular risk analyses to identify potential vulnerabilities to protected health information (PHI)
• Implementing a comprehensive set of administrative, physical, and technical safeguards
• Developing and maintaining formal policies and procedures for security and privacy
• Training employees on HIPAA requirements and your specific policies
• Executing business associate agreements with any vendors who handle PHI

HIPAA compliance is not optional, and violations can result in significant penalties—ranging from $100 to $50,000 per violation, with a maximum annual penalty of $1.5 million.

2. Financial services requirements (GLBA)

Financial institutions in Texas must comply with the Gramm-Leach-Bliley Act (GLBA), which includes:

• Developing a written information security plan that describes how you protect customer information
• Designating specific employees to coordinate your information security program
• Identifying and assessing risks to customer information and evaluating the effectiveness of current safeguards
• Implementing safeguards to control the risks identified in your assessment
• Monitoring and testing your program regularly
• Ensuring service providers maintain appropriate safeguards

These requirements apply to a wide range of businesses, including banks, mortgage brokers, tax preparers, and even auto dealers that offer financing.

3. Government contractor considerations

Texas businesses that contract with state or federal government agencies face stringent cybersecurity requirements:

• Federal contractors may need to comply with NIST SP 800-171 for handling Controlled Unclassified Information (CUI)
• Defense contractors must adhere to the Cybersecurity Maturity Model Certification (CMMC) requirements
• State of Texas contractors often need to follow the Texas DIR Security Control Standards Catalog
• Both state and federal contracts may require specific cybersecurity insurance coverage

These requirements are typically specified in contract terms and failing to meet them can result in contract termination or disqualification from future opportunities.

Available Resources That Can Save Your Business

Implementing comprehensive cybersecurity measures may seem difficult, especially for small businesses with limited resources. Fortunately, Texas offers several programs designed to help businesses improve their cybersecurity posture without breaking the bank.

The Texas Small Business Cybersecurity Assistance Center (TSBCAC) provides free resources specifically designed for small businesses. Their services include:

• Free virtual Chief Information Security Officer (vCISO) services
• Cybersecurity assessment tools to identify your most critical vulnerabilities
• Training resources for employees at all levels
• Templates for security policies and procedures
• Guidance on implementing recognized security frameworks

At the federal level, the Cybersecurity and Infrastructure Security Agency (CISA) offers a wealth of free tools and resources, including:

• The Cyber Essentials Toolkit, designed specifically for small businesses
• Vulnerability scanning services to identify potential weaknesses
• Phishing campaign assessment programs
• Incident response guidance and assistance

Cyber insurance has also become an essential component of business risk management. While not a substitute for proper security measures, it can provide financial protection against the costs associated with breaches. When selecting a policy, look for coverage that includes:

• Data breach response costs
• Business interruption losses
• Cyber extortion payments
• Liability protection for third-party claims
• Regulatory defense and penalties

By using these resources and implementing the cybersecurity measures outlined in this article, your Texas small business can significantly reduce its risk of becoming another cyber attack statistic.

Cybersecurity is no longer optional for Texas businesses of any size. The combination of increasing threats and changing regulations means that even the smallest businesses must take deliberate steps to protect their data and systems. By understanding and implementing these seven essential cybersecurity rules, you’re not just checking compliance boxes—you’re protecting your business, your customers, and your future.

For comprehensive guides on implementing these cybersecurity requirements for your Texas small business, TechEd Publishers offers expert resources designed to simplify compliance while maximizing protection.