Texas Cybersecurity Framework (TCF)
2026
Texas Just Changed the Rules.
Is Your Business Ready?
The Texas Cybersecurity Act (HB 8) sets new baselines for how organizations operating in
Texas must protect data, respond to breaches, and govern their security programs — and
the implications reach well beyond state government.
Most cybersecurity conversations start with a breach. A ransomware attack makes the news, a company pays
millions, and suddenly the boardroom wants answers. The Texas Cybersecurity Act — formally House Bill 8 — is
trying to change that pattern by establishing a proactive, structured framework for how Texas organizations must
approach security before something goes wrong.
But here’s what many business leaders are missing: this isn’t just a government IT mandate. If your company
contracts with state agencies, handles Texas state data, operates in healthcare, finance, energy, or legal services, or
simply wants to remain a competitive vendor in the Texas market — HB 8 has direct implications for how you run your
business.
The businesses I talk to every week think this law only applies to state agencies. That's the gap that's going to cost
someone.
— Scott Stricklin, CRO, Accoona IT
What the Texas Cybersecurity Act Actually Requires
The Act — rooted in Texas Government Code Chapter 2054 and enforced through the Department of Information
Resources (DIR) — establishes ten core principles. I’ve translated them into plain business language below, because
the legal text is dense and most executives don’t have time for a law review.
1. Cybersecurity Is an Executive Responsibility
The Act — rooted in Texas Government Code Chapter 2054 and enforced through the Department of Information
Resources (DIR) — establishes ten core principles. I’ve translated them into plain business language below, because
the legal text is dense and most executives don’t have time for a law review.
2. Risk-Based, Framework-Driven Security
The Act aligns with the NIST Cybersecurity Framework, implemented in Texas as the TX-CSF. Organized around
Identify, Protect, Detect, Respond, and Recover — this is the same framework your cyber insurance carrier is asking
about. If you haven’t mapped your security program to NIST, you’re already behind.
3. You Need a Designated Security Officer
Every covered entity must formally designate an Information Security Officer (ISO/CISO) with documented
responsibilities for risk management, incident coordination, and compliance reporting. ‘Our IT guy handles it’ is not
sufficient under HB 8.
4. Third-Party Audits Are Mandatory
Independent security audits are required at least every five years — and continuous risk assessments in between.
This is one of the most significant shifts for small and mid-size organizations: self-assessment is no longer enough.
You need an objective, external perspective on your vulnerabilities.
5. The 48-Hour Incident Reporting Rule
If a breach is suspected or confirmed, you have 48 hours to report it to DIR and the State Cybersecurity Coordinator.
This is not a negotiable window. If your incident response plan doesn’t start with ‘who do we call in the first hour,’ you
need to update it today.
6. Data Minimization and Privacy Protection
The Act requires organizations to inventory and classify sensitive and personally identifiable information (PII), limit
retention to legal requirements, and securely destroy PII when it’s no longer needed. If you’re holding data you don’t
need, you’re holding liability.
7. Annual Cybersecurity Training Is Non-Negotiable
People are the most exploited vulnerability in any organization. The Act mandates cybersecurity awareness and
role-based training for employees, officials, and relevant contractors. Compliance is auditable and tied to grant
eligibility — meaning skipping training has financial consequences beyond the breach risk itself.
8. Your Vendors Are Your Responsibility
The Act extends cybersecurity accountability to the supply chain. Contracts must include cybersecurity and
breach-notification requirements. Cloud services must be evaluated for security and compliance. If your vendor gets
breached and your contract doesn’t address it, that’s on you.
What This Means If You're a Private Sector Business
I want to be direct with you: the formal compliance requirements of HB 8 apply to state agencies and covered
government entities. But the ripple effects reach every organization doing business in Texas — for four specific
reasons.
Vendor and procurement requirements will tighten.
State agencies that must comply with HB 8 will require their
vendors to demonstrate equivalent security standards. If you want a state contract — or want to keep one — your
security posture will be evaluated.
Cyber insurance standards are moving in lockstep.
Insurers are already asking about NIST framework alignment,
incident response plans, and third-party audit history. HB 8 formalizes exactly what carriers have been informally
requiring for two years.
Regulatory pressure in healthcare, finance, and energy is cumulative.
HIPAA, SOX, GLBA, and NERC CIP
already exist in your sector. HB 8 adds another layer of state-level requirements that overlap with — and in some
cases strengthen — federal standards.
Litigation exposure is real.
The 48-hour reporting window, the data minimization requirements, and the
executive-accountability provisions create clear standards against which a breach response can be judged. Failure
to meet them will be used in court.
The 3 Questions Every Texas Executive Should Ask Today
1. When was our last independent, third-party security assessment — and what did we do with the findings?
2. Do we have a documented incident response plan that includes a 48-hour notification protocol?
3. Can I show — in writing — that executive leadership has reviewed and approved our cybersecurity strategy in the last 12 months?
If any of these questions made you pause, that’s the gap. And it’s fixable — but it requires moving from a reactive
posture to a proactive one.
Not Sure Where You Stand?
Get your free Texas Cybersecurity Act compliance readiness score. In 2 minutes, you’ll know exactly where
your gaps are — and what to do next.
ABOUT THE AUTHOR
Scott Stricklin
Chief Revenue Officer, Partnerships & Strategy — Accoona IT
Scott leads partnerships and go-to-market strategy at Accoona IT, where he works directly with Texas
executives to translate cybersecurity risk into business decisions. With a background spanning enterprise
technology, compliance advisory, and managed services, Scott brings a rare perspective: the ability to speak
both boardroom and server room. He can be reached at accoona.it.