TEXASDATA LAW

Topic

Security Incidents and Breach Response

This hub covers how a Texas organization prevents, manages, and reports security incidents. It begins with reasonable security duties under Business and Commerce Code chapter 521 and the cybersecurity safe harbor in chapter 542, explaining the employee-size criteria, qualifying cybersecurity programs, the role of NIST and industry frameworks, how a written security program is evidenced, and the actual limits of the exemplary-damages protection, which is a defense and not blanket immunity. Incident response gets its own treatment: detection, triage, containment, preservation, forensic vendors and privilege, notice decisioning, ransomware and sanctions risk, tabletop exercises, vendor notices, regulator coordination, recovery, and lessons learned, with a security incident distinguished from each statutory breach definition. Texas breach notification follows: the covered information, the unauthorized-acquisition trigger, the notice duties of holders and owners, the Attorney General threshold and electronic filing, timing, content, exceptions, and vendor duties, anchored to current § 521.053 rather than treating every confidentiality event as reportable, with a sequenced checklist. Federal and multistate duties are mapped by sector and jurisdiction without merging their tests: HIPAA, the FTC Health Breach Notification Rule, GLBA safeguards notifications, the nationwide state chart with its fifteen-column reference structure, and public-company and sector disclosure duties including SEC materiality, Form 8-K Item 1.05, and Regulation S-K Item 106. Cyber insurance rounds out the hub: coverage terms, exclusions, notice and cooperation conditions, insurer consent for forensic vendors, privilege arrangements, and proof against actual policy terms.

Key questions

  • When does a security incident trigger Texas notice
  • What must a company prove to use the Texas cybersecurity safe harbor
  • How should an incident response balance privilege, forensic investigation, and disclosure
  • Which sector and multistate breach duties apply beyond Texas
  • What does a cyber insurance policy actually require at claim time

Controlling authorities

Business and Commerce Code chapter 521 (security, disposal, breach notice), including § 521.053 (notice duties); Business and Commerce Code chapter 542 (safe harbor, SB 2610); SEC Form 8-K Item 1.05 and Regulation S-K Item 106; CIRCIA incident-reporting provisions (rulemaking status is a research lead); NIST SP 800-61 Rev. 3 and SP 800-88 Rev. 2 as voluntary technical guidance.

Guides in this hub

Planned insights

  • I01 What the Texas Cybersecurity Safe Harbor Requires a Business to Prove (eligibility, program evidence, and the limits of the exemplary-damages protection)
  • I10 NIST Sanitization Guidance Has a New Final Revision (what Rev. 2 changes for a disposition program); candidates from the bank: nationwide breaches; ransomware and tabletop exercises; privilege and actual primary-source incident decisions; public AG breach-report analysis if usable data exists.

Tracker records

  • K05 Texas personal-information security and disposal obligations
  • K06 Texas breach notice and AG reporting provisions
  • K10 Texas cybersecurity safe harbor under SB 2610
  • K31 FTC Act Section 5 privacy and security enforcement
  • K45 CISA CIRCIA reporting rule current status
  • K60 NIST CSF 2.0
  • K61 NIST SP 800-88 Revision 2
  • K62 NIST SP 800-61 Revision 3
  • K66 Morgan Stanley 2022 SEC data-disposal order
  • RK004 Identity Theft Enforcement and Protection Act
  • RK005 cybersecurity safe harbor
  • RK030 PowerSchool
  • RK039 Meta and WhatsApp
  • RK059 SEC cybersecurity disclosure rules for public companies
  • RK060 CIRCIA incident reporting rule
  • RK064 ROSCA and OFAC sanctions risk in ransomware payments.

Companion links