Relating to a limitation on civil liability of business entities in connection with a breach of system security.

Contracts

• Managed Service Providers (MSPs): Master Services Agreements (MSAs) must be amended to explicitly require the MSP to maintain the specific framework required by your business size (e.g., CIS Controls Group 1 for 20–99 employees).
• Vendor Agreements: Contracts with third-party data processors (payroll, cloud storage) must include flow-down clauses ensuring they meet Sec. 542.004 standards.
• Employment Agreements: Update employee handbooks to make non-compliance with password policies and training a disciplinary offense to demonstrate "maintenance" of the program.

Hiring/Training

• Tier 1 (<20 Employees): Mandatory implementation of "appropriate" cybersecurity training for all staff.
• Tier 2 & 3 (20+ Employees): IT leadership or external consultants must be certified or proficient in the specific required framework (CIS or NIST) to conduct valid gap analyses.

Reporting & Record-Keeping

• Written Information Security Program (WISP): You must create a formal WISP document. An unwritten set of practices will not satisfy the court.
• Audit Trails: You must retain logs of system updates, patch management, and employee training completion to prove the program was active at the time of a breach.
• Standard Updates: You must track updates to your chosen standard (e.g., a new version of NIST). You are legally required to implement changes within one year of the update's publication.

Fees & Costs

• No State Fees: There are no filing fees associated with this law.
• Operational Costs: Budget for potential increases in MSP fees to meet stricter compliance levels and third-party audit costs to validate the framework.