Texas wrote small businesses a safe harbor. Claim it before you need it.
Since September 1, 2025, Texas law shields a business with fewer than 250 employees from exemplary (punitive) damages after a breach — if it had implemented and maintained a cybersecurity program conforming to a recognized framework. Most Coastal Bend businesses already have many of the habits. Almost none have the documented program the law rewards. The Corridor Compliance package builds that program, then keeps it current.
What the law actually asks of a firm your size
SB 2610 does not ask every small business to run an enterprise security department. It scales the duty to your size — and what it protects is specific: exemplary (punitive) damages are barred in a breach lawsuit when a conforming program was implemented and maintained.
| Your size | What the law expects | What it buys you |
|---|---|---|
| Fewer than 20 employees | A simplified program: password policies and appropriate cybersecurity training for employees | Exemplary damages barred in a breach lawsuit, if the program was in place and maintained when the breach happened |
| 20–99 employees | A moderate program, including the CIS Controls Implementation Group 1 safeguards | |
| 100–249 employees | Full conformity with a recognized framework — NIST CSF, the CIS Controls, the ISO/IEC 27000 family; HIPAA and PCI DSS count where they apply to you |
The recognized frameworks named in the law include the NIST Cybersecurity Framework, the CIS Controls, and the ISO/IEC 27000 family. Where they apply to your business, HIPAA, GLBA, FISMA, HITECH, and PCI DSS count as conforming regimes — if you already run under one of those rulebooks, the safe harbor builds on it rather than starting over.
This page is general information about a Texas law, not legal advice.
The Readiness Project: build the documented program
A fixed-fee project, scoped to a firm your size, that takes you from informal habits to a program you can demonstrate:
- Assess against a recognized framework. We measure your current setup against the framework and tier that fit your size — NIST CSF, the CIS Controls, or the regime that already applies to you — and document the gaps.
- Build the documented program. We put the program in place with the supporting policies and evidence set behind it: the written policies, the training record, the access and backup evidence — the paperwork that proves the controls are real.
- Hand over the documentation. The program documentation is yours, complete: your policies, your evidence set, your records, in usable form. You own it from day one, like everything else we document for you.
$1,950 fixed — the Readiness Project
One fixed price to build the documented program. What it takes to keep that program current is the Evidence Retainer, below.
The Evidence Retainer: keep it current
The safe harbor has a second half that one-time projects miss: the program must be implemented and maintained. A binder built once and left on a shelf is not a maintained program. The Evidence Retainer is the maintenance:
- Evidence collection — the records that show the program is running keep getting gathered, not reconstructed under pressure after an incident.
- Periodic reviews — the program is revisited on a schedule, so changes in your team, your tools, and your tier get absorbed instead of quietly expiring.
- A program that stays maintained — policies, training, and controls kept current as your business changes, so the posture the law protects is the posture you actually have.
$349 per month — the Evidence Retainer
Scoped to a firm your size, following the Readiness Project. Together they are the Corridor Compliance package: build the program once, then keep it demonstrably alive.
Find your SB 2610 tier, then check the basics.
Start on your own: work out which tier of the Texas safe harbor fits your business, then run the plain-language checks — MFA, tested backups, the payment call-back drill, and who still has access they shouldn’t. It is the same checklist our Coastal Bend town pages offer.
- Your SB 2610 tier, in plain words — and what it expects of you
- The payment-diversion call-back drill every office should run
- Access, backup, and point-of-sale checks sized for a small team
Two steps, two published prices
1 · Readiness Project
$1,950 fixed
Assess against a recognized framework, build the documented program and its policies and evidence set, and hand the documentation over to you.
2 · Evidence Retainer
$349 per month
Evidence collection, periodic reviews, and keeping the program maintained — the “maintained” half of “implemented and maintained,” handled month after month.
Both steps are scoped to a firm your size. If you run a managed IT plan with us, the same documented-program standard is what we build to there as well — plans run $150–$300 per seat per month, published on our pricing page.
Not ready for the full package? Start with the $495 Network & Risk Assessment.
A fixed-fee, fixed-scope review of your network, email security, backups, and account access — delivered as a written findings report with a prioritized fix list. It shows you where your current setup stands against your SB 2610 tier, and the report is yours either way. Sign a managed agreement within 30 days and the full $495 is credited toward your onboarding.
Your program, your documentation — never held hostage
Everything the Corridor Compliance package produces belongs to you: the documented program, the policies, the evidence set. That is the same posture as our managed agreements — give us 90 days; after that, end the agreement with 30 days’ written notice and Valhalla hands over complete network documentation, admin passwords, configurations, and data in usable form, with a real transition.
You own your systems, your data, and your documentation from day one. A compliance program you don’t own isn’t protection — it’s a hostage note.
Rated 5.0 out of 5 from 9 Google reviews
“Valhalla Tech provides prompt, reliable service with an extremely knowledgeable staff. From start to finish, my experience was very positive. They are always willing to help at any time and take the time to explain things clearly, which really sets them apart. You can tell they care about their customers and stand behind their work. I highly recommend Valhalla Tech to anyone looking for great service and expertise.”
“Great organization to have customize solutions to fit your organization needs. The Valhalla team delivers exceptional service and products that go above and beyond market standards. The latest project included a complete IT server system install and integration with our ordering management system. Highly recommend!”
“Awesome company and values! They are very responsive and open to answering any questions I have in an easy to understand way. I work with a nonprofit and no other tech company was as helpful as Valhalla, we use them for all of our computer parts ordering. Thank you so much for your continued help! I highly recommend Valhalla Technology to anyone looking for an IT Managed Services company for their business. It will be the best decision you ever make!”
“Called Valhalla Technology because we were having computer issues. They came out same day and were very professional. Told me what was wrong and fixed it. Ever since then if I have any issues, they always answer. Wouldn't think about using anybody else. We now use them for our phones as well! Just good product and service”
Frequently asked questions
What is Texas SB 2610?
SB 2610 is a Texas law, signed June 20, 2025 and effective September 1, 2025, that added Chapter 542 to the Texas Business & Commerce Code. For a Texas business entity with fewer than 250 employees that owns or licenses data including sensitive personal information, it bars exemplary (punitive) damages in a breach lawsuit if the business had implemented and maintained a cybersecurity program conforming to an industry-recognized framework.
What does the law expect of a business my size?
It scales by headcount. Fewer than 20 employees: a simplified program — password policies and appropriate employee cybersecurity training. 20–99 employees: a moderate program, including the CIS Controls Implementation Group 1 safeguards. 100–249 employees: full conformity with a recognized framework such as NIST CSF, the CIS Controls, or the ISO/IEC 27000 family. HIPAA, GLBA, FISMA, HITECH, and PCI DSS count as conforming regimes where they apply.
What is the Corridor Compliance package?
Two steps. The Readiness Project ($1,950 fixed) assesses your business against the framework and tier that fit your size, builds the documented program with its supporting policies and evidence set, and hands the documentation over to you. The Evidence Retainer ($349/mo) keeps it current: evidence collection, periodic reviews, and maintaining the program — because the safe harbor requires a program that is implemented and maintained, not built once.
Is this page legal advice?
No. This page is general information about a Texas law, not legal advice. For advice about your specific situation, talk to a Texas attorney.
Where should I start if I'm not sure which tier I'm in?
With the checklist on this page — it walks you through the tier finder. If you want your actual setup reviewed, the $495 Network & Risk Assessment covers your network, email security, backups, and account access and comes back as written findings — credited toward onboarding if you sign a managed agreement within 30 days. Call (361) 315-0017.