Someone clicks the wrong link. Then the lawyers call.Someone clicks the wrong link. Then the lawyers call.

Texas safe harbor depends on a security program already implemented and maintained. We do the technical work and keep the record, so your lawyer gets a written account of what is in place.

Texas can take punitive damages off the table, if your security program was already in place. We put the controls in place and keep the evidence current.

Chapter 542 took effect September 1, 2025. In a lawsuit after a breach, punitive damages are the punishment on top of the actual loss. This law can block them.

Book 15 minutes with Billy

We’re accepting new clients.

Not sure it applies to you? Call (817) 265-5000.

Or ask Billy a question

In effect since September 1, 2025.
Texas Chapter 542.
It can block punitive damages.
Only if your program was already running.
Three yes answers.
That decides whether it applies to you.

Does it apply to you? Three yes answers.

A Texas business.
Fewer than 250 employees.
You own or license computerized sensitive personal information.

Three yeses, read on. Not sure about the third one? That’s a fine first question.

What the law asks for

What counts as sensitive personal information.
A name with an unencrypted Social Security or license number, an account number with the code that opens it, or health records. The text: Chapter 542, definitions in Chapter 521.
Safeguards on three fronts.
Administrative, technical and physical, covering personal identifying information too. A wider net than the one that decides whether you qualify.
A recognized framework.
A current version of a framework the law recognizes, such as NIST CSF or the CIS Controls. It also names ISO/IEC 27000-series standards, SOC 2 and others. No particular product is required.
The requirements that apply to your business.
The program must also meet applicable current HIPAA, GLBA, FISMA or HITECH requirements, plus PCI DSS when it applies. Your industry and the data you handle matter as well as your headcount.
Sized to your headcount.
Under 20 people password policies and staff training, at least20 to 99 CIS Implementation Group 1, at least100 to 249 the full frameworkEvery size still needs a framework.

Two words do most of the work.

Implemented and maintained. At the time of the breach, not the day you found out or the day you were sued.

You are the one who has to show it. A product bought or a policy drafted shows nothing on its own.

We do the technical work and keep the record. Your lawyer gets a written account of what is in place.

What we put in.

An inventory and a gap list.
Which systems hold what, who can reach it, what is missing, in the order we would fix it.
The controls, put in.
The work on the systems, not a report telling you to do it. Training delivered, attendance kept.
An evidence file, kept current.
What was in place and from when. We keep the receipts.

Billy holds an open binder showing laptop, padlock, and person icons while a business owner supports its edge. — The security work comes with receipts.

Great company if you want to protect your computer systems and keep them running and up to date. Fast response, easy to communicate with and overall great service.

RaDonna H., Google review

Every review on Google: five stars.

More reviews