Essential cyber hygiene for small companies, built on CIS Controls Implementation Group 1, the set written for organizations with little IT staff. Texas SB 2610 uses the same tiers: basic measures under 20 employees, IG1 for 20 to 99, and a full framework such as the NIST Cybersecurity Framework or ISO/IEC 27001 for 100 to 249. The safe harbor shields a company with a documented program from punitive damages after a breach; it does not remove compensatory damages or regulatory action. Verify safeguard numbering against the published CIS Controls.
How many employees?
Count employees and regular contractors. Texas SB 2610 uses these bands to set the level of safeguards it expects; other states and insurers use similar logic.
CIS Controls Implementation Group 1 (56 safeguards), documented and practiced. Texas SB 2610 tier 2
16 safeguards for your tier · 0 in place
Insurer-asked items marked
S1CIS 1.1, 1.2Insurers askTier 1 basic
Know your devices
Keep a current list of every laptop, phone, server, and network device, and remove unknown ones.
Count every laptop, phone, server, printer, and router that touches company data. A spreadsheet is enough; a device management tool is better. Remove or block anything you cannot name.
S2CIS 2.1, 2.2, 2.3
Know your software
Keep a list of the software and SaaS in use; remove what is unsupported or unapproved.
List the software and cloud services in use, including the ones staff signed up for on their own. Anything unsupported (no longer receiving updates) or unapproved is removed or replaced.
S3CIS 3.1 to 3.6Insurers askTier 1 basic
Protect data by classification
Know which data is sensitive, where it lives, who can access it, how long it is kept, and encrypt it on devices and removable media.
Decide which data is sensitive (customer records, employee data, financial, health), where it lives, who can open it, and how long you keep it. Turn on disk encryption on every laptop and phone and encrypt USB drives.
S4CIS 4.1 to 4.7
Secure configurations
Set devices, cloud accounts, and network gear to secure defaults, lock screens, and change default passwords.
Change default passwords on routers, cameras, and cloud accounts; turn on screen locks; apply the vendor's security baseline for laptops and cloud settings. Example: the Microsoft 365 or Google Workspace security checklist applied.
S5CIS 5.1 to 5.4Insurers askTier 1 basic
Manage accounts
Keep an inventory of accounts, use unique passwords, disable dormant accounts, and separate admin accounts from daily use.
Keep a list of accounts, give each person their own login, disable the accounts of people who left, and use a separate admin account for admin work rather than for daily email.
S6CIS 6.1 to 6.5Insurers askTier 1 basic
Control access and use MFA
Grant and revoke access through a process; require multi-factor authentication for external applications, remote access, and all administrator accounts.
Access is granted and removed through a request someone approves. MFA is required for remote access, cloud apps reachable from the internet, and every admin account.
S7CIS 7.1 to 7.4Insurers askTier 1 basic
Patch continuously
Run automated updates for operating systems and applications and fix known vulnerabilities on a schedule.
Turn on automatic updates for operating systems, browsers, and apps. Check monthly that nothing is stuck, and fix known vulnerabilities within a set time, for example 30 days.
S8CIS 8.1 to 8.3
Keep audit logs
Collect and keep logs from systems and cloud services, with time synchronized.
Keep logs from your cloud services, firewall, and servers for at least 90 days with correct time settings, so you can work out what happened after an incident. Most cloud platforms do this with a setting.
S9CIS 9.1, 9.2Insurers askTier 1 basic
Protect email and browsers
Use supported browsers and email clients, filter malicious links and attachments, and publish SPF, DKIM, and DMARC.
Use supported browsers and mail clients, turn on the phishing and malware filtering your mail provider offers, and publish SPF, DKIM, and DMARC records; the domain check tells you if they are missing.
S10CIS 10.1 to 10.3Insurers askTier 1 basic
Defend against malware
Run and update endpoint protection on all devices; disable autorun.
Endpoint protection (antivirus or endpoint detection) on every computer, updating itself, with autorun disabled for USB media. Someone looks at the alerts.
S11CIS 11.1 to 11.4Insurers askTier 1 basic
Back up and test restores
Automate backups, keep a copy separate from the network, protect it, and test restores.
Backups run automatically, one copy is kept where ransomware cannot reach it (offline or a separate cloud account), access is protected, and you have restored something from it to prove it works.
S12CIS 12.1
Manage the network
Keep network equipment supported and updated; segment guest and business networks.
Router and firewall firmware kept updated, a separate guest Wi-Fi for visitors and personal devices, and the business network kept apart from it.
S13CIS 14.1 to 14.8Insurers askTier 1 basic
Train people
Run security awareness training at hire and yearly, covering phishing, deepfake fraud, passwords, data handling, and reporting.
Everyone completes short training when hired and yearly: phishing, deepfake and payment fraud, passwords and MFA, handling data, and how to report. Keep the completion records; the free Commons courses count.
S14CIS 15.1
Manage service providers
Keep an inventory of providers that hold your data or run critical systems, with contracts that cover security.
List the providers that hold your data or run critical systems (cloud, payroll, CRM, payments) and make sure contracts cover security, breach notice, and what happens to your data when you leave.
S15CIS 17.1 to 17.3Insurers askTier 1 basic
Respond to incidents
Name who handles incidents, keep contact lists, and define how staff report suspicious activity.
Name who handles incidents, keep an up-to-date contact list (bank, insurer, counsel, IT provider), and make it easy for staff to report anything suspicious without fear.
S16CIS AI-specific (Commons addition)Tier 1 basic
Secure AI tools
Approve AI tools before use, set their data settings, keep company data out of unapproved tools, and test customer-facing AI for prompt injection and data leakage.
Approve AI tools before use, set each tool's data and training settings, keep customer and confidential data out of unapproved tools, and test any customer-facing AI for prompt injection (tricking it into misbehaving) and data leakage.
Build your risk register
Tick the assets you have. The register pairs each with its common threats and the safeguards above.
Safe harbors are defined by statute and applied by courts. A completed checklist documents your program; it does not by itself establish eligibility. Confirm the tier definitions against the current text of SB 2610.
Help and settings
Choose how the site looks on this device.
The Brief: one email a week on what changed in AI governance and what to do about it. Confirmed by email, one-click unsubscribe.
Automatic answers use Anthropic AI and may be wrong. When enabled, your question and recent chat are sent to Anthropic with public site navigation. Do not include secrets or sensitive personal information. You can skip AI and use "Talk to a person". Privacy policy
Ask me where something is on the site or what a tool does. For legal advice or anything about your account, use "Talk to a person" to request human help.
Talk to a person
About this page: Security Essentials and risk register. The page address is included so we know what you mean.
We value your privacy
We use cookies to enhance your experience, analyze site traffic, and for marketing purposes. You can choose which cookies to allow below. By clicking "Accept All", you consent to our use of all cookies. See our Privacy Policy for details. Privacy Policy
