Texas SB 2610 breach response: what state agencies get wrong before the DIR calls
Sienna VanceApril 29, 2026
Key takeaways
Texas SB 2610 applies specifically to Texas state agencies and their contractors, not to private-sector organizations generally. The governing implementation is Texas Administrative Code Chapter 202, and the notification authority is the Texas Department of Information Resources (DIR), not the Texas AG.
DIR breach notification is required without unreasonable delay -- enforcement practice interprets this as within 48 hours of confirmed breach discovery for incidents affecting state data. The clock starts at confirmed discovery, not at the time of the breach, which means detection capability directly determines notification compliance.
Texas Administrative Code §202.73 requires agencies to preserve volatile forensic evidence before remediation actions. Agencies that reboot compromised systems to restore services before imaging RAM and capturing live network state are destroying evidence their post-incident report will need to reference.
IR plans that satisfy SB 2610 documentation requirements but have never been exercised against a realistic scenario leave a specific evidentiary gap: if DIR requests evidence of plan testing during an inquiry, undocumented tabletop exercises do not satisfy the request.
Tool integration failures -- not individual tool failures -- are the most common reason IR response chains break under SB 2610 incident conditions. An EDR that flags correctly but cannot trigger isolation because the endpoint agent is misconfigured produces a compliant alert and an uncontained incident simultaneously.
TL;DR
Texas SB 2610 breach response is a documentation problem as much as a technical one. DIR expects specific evidence on a specific timeline, and the agencies that produce it are the ones that built the documentation process before the breach, not during it. Most state agency IR plans describe what to do. They do not describe what to produce, in what format, by what deadline, or what happens when the tool that was supposed to generate that evidence was offline when the incident occurred.
The K-12 district that passed the test and failed the incident
A Texas K-12 district operating under SB 2610 had completed its annual Texas Administrative Code Chapter 202 security plan review six weeks before a ransomware event. CrowdStrike Falcon was deployed, the incident response plan was documented and signed off by the CISO, and the tabletop exercise from the prior year showed clean execution. What the tabletop did not test: the handoff between Falcon's detection trigger and the Tanium agent responsible for isolating affected endpoints. During a system upgrade three weeks before the incident, the Tanium agent had been misconfigured on a subset of endpoints in the district's administrative building. Falcon flagged the initial payload correctly. The isolation trigger fired. Nothing happened on the affected endpoints because the agent was not listening.
The ransomware propagated for approximately four hours before a technician manually isolated the first affected machine. By that point, six servers in the administrative network had been encrypted, including the system hosting the student information database. The IR plan was compliant. The tools were compliant. The integration between them had never been tested as a system, and the gap between 'tools work' and 'response chain works' cost the district four hours of containment time and a post-incident report to DIR that had to explain why the automated containment did not function as documented.
The numbers that define the SB 2610 response window
48 hours
DIR enforcement practice for the 'without unreasonable delay' notification requirement under Texas SB 2610 for incidents affecting state data. The statute does not define the exact window, but DIR guidance and peer state enforcement patterns establish 48 hours as the operational expectation for initial notification. This is the window between confirmed breach discovery and the first DIR contact -- not between breach occurrence and notification, which means detection speed is a compliance variable.
3 documents
The minimum DIR expects to receive in the course of a SB 2610 breach response: an initial breach notification with preliminary scope assessment, interim updates as the investigation progresses, and a final post-incident report with forensic findings, remediation steps, and prevention measures. Most state agency IR plans describe the notification requirement. Few describe the format, content, and timeline for all three documents. (Texas Administrative Code §202.73 and DIR incident reporting guidance)
32%
Share of Texas state agency IR plans that had been exercised against a realistic scenario involving data exfiltration or ransomware in the prior 12 months, based on Vulnox assessment engagements with state agency contractors. The remaining plans were documented and approved but untested. An untested plan is a hypothesis about how the organization will respond -- not evidence that it will. (Vulnox assessment data, 2024)
What SB 2610 actually requires during a breach response
Texas SB 2610 and its implementing regulations in Texas Administrative Code Chapter 202 create a specific breach response obligation for state agencies that differs from general incident response practice in three ways.
First, the notification chain runs to DIR, not to affected individuals directly. State agencies notify DIR, and DIR coordinates with the agency on the scope and timing of any required individual notification. This is structurally different from private-sector breach response under the Texas Business and Commerce Code, where organizations notify affected individuals directly. Agencies that build their IR plan on private-sector breach response templates often get the notification chain wrong -- they plan for individual notification as the primary action and have no documented process for DIR coordination.
Second, the documentation standard is ongoing, not point-in-time. DIR expects interim updates as the investigation progresses, not a single notification and a final report. Agencies that treat the initial notification as the primary compliance obligation and then go quiet while the investigation runs are not meeting the update requirement. In practice, DIR will reach out. The agency that has a documented update cadence and has been producing interim reports is in a materially different position than the one that receives the DIR inquiry call unprepared.
Third, the evidence standard is forensic. Texas Administrative Code §202.73 requires preservation of relevant data, logs, and system images related to the breach. This is not a records retention requirement -- it is an active evidence preservation obligation triggered by the incident. Agencies that prioritize service restoration over evidence collection are destroying the forensic record that the post-incident report will need to draw from.
Example
The evidence preservation sequence matters in a specific way that most IR plans get wrong. Volatile evidence -- RAM contents, live network connections, running process lists -- exists only while a compromised system is powered on and unmodified. Once a system is rebooted to restore services, that evidence is gone. Disk images, log exports, and network captures can be collected after reboot. RAM cannot.
In Vulnox assessments of state agency IR plans, the most common gap is the absence of a documented volatile evidence collection step before any remediation action. The plan goes from 'detect' to 'contain' to 'eradicate' without a 'preserve volatile evidence' step between detection and containment. The resulting post-incident report can document what the logs showed. It cannot document what was running in memory on the compromised system at the time of detection -- which is frequently where the initial access mechanism and the attacker's tooling live.
RAM acquisition on a live system takes 5 to 15 minutes depending on memory size and acquisition tool. The forensic value -- attacker tooling, encryption keys for in-memory malware, C2 connection state -- is disproportionate to the time cost. The reason it gets skipped is not that IR teams do not know it matters. It is that the IR plan does not mandate it as a sequenced step before containment, so under incident pressure, teams default to the containment action they have rehearsed.
What Vulnox found when reviewing state agency IR posture
Assessment base: Vulnox IR plan assessments and gap analysis engagements with Texas state agency contractors, 2023-2024. Healthcare, education, and municipal government verticals.
IR plans that describe individual tool behavior, not integrated response chain behavior
In Vulnox assessments of state agency contractors operating under SB 2610, IR plan testing consistently revealed a gap between how individual tools were documented and how the response chain functioned as a system. Plans documented what CrowdStrike would detect, what the SIEM would alert on, and what the endpoint agent would do for isolation. They did not document what happened when the alert from the SIEM was supposed to trigger the endpoint agent -- specifically, what happened when that trigger failed. The K-12 district case is not unusual. The integration point is where the response chain breaks, and it is the point that plan documentation most often skips.
For DIR documentation purposes, an IR plan that describes individual tool capabilities is not the same as an IR plan that documents the response chain under realistic conditions. If a breach occurs and the response chain fails at an integration point that was never tested, the post-incident report to DIR will need to explain that failure. An agency that has documented integration testing -- including failure scenarios -- is in a substantially more defensible position than one whose plan assumes every tool fires correctly on every alert.
Notification workflows that depend on individual judgment rather than documented process
In assessments of state agency IR plans, Vulnox consistently found that the internal notification step -- who contacts DIR, at what point in the investigation, with what preliminary information -- was described in the plan as a role ('the CISO notifies DIR') without specifying the trigger, the timeline, or the content of the initial notification. In two separate engagements, the CISO named in the plan had left the organization. In both cases, the deputy who would have been responsible for DIR notification had never been briefed on the notification process.
SB 2610 and Texas Administrative Code §202.73 do not care whether the person who was supposed to notify DIR is still employed. The obligation runs to the agency. Notification workflows that depend on a named individual rather than a documented process with defined backup roles fail at the moment of personnel change -- which, in a realistic incident scenario, may be precisely when the plan is first activated.
Post-incident report content that does not match DIR expectations
DIR expects post-incident reports to include forensic findings, a timeline of events, remediation steps, and prevention measures. In Vulnox review of prior incident documentation from state agency clients, the most common gap was the forensic findings section: reports described what happened at the business level ('unauthorized access to the student information system') without the technical timeline that DIR uses to assess whether the agency's detection and containment response was adequate. Reports that cannot answer 'when did the attacker first gain access, how long did they have access before detection, and what did they access during that window' leave DIR to draw its own conclusions about those questions.
The post-incident report is the primary evidence document for a DIR inquiry. An agency that cannot produce a technically detailed timeline -- because volatile evidence was not preserved, because log retention was insufficient, or because the investigation was not scoped to answer those questions -- submits a report that is compliant in format and incomplete in content. DIR's response to that gap varies by relationship and context, but it creates an opening for follow-up inquiry that a technically complete report would have closed.
The finding that makes the compliance record work against you
Common belief
A clean annual security plan review and signed-off IR plan demonstrate that the agency is meeting SB 2610 requirements. If the documentation is current, the compliance posture is defensible.
What we found
In two Vulnox post-incident engagements where DIR was involved, the agencies that received the least scrutiny in the post-incident inquiry were not those with the cleanest prior review records. They were those that could produce tabletop exercise documentation, prior assessment findings, and evidence of remediation activity between annual reviews. The prior assessment record demonstrated that the agency treated the annual review as a floor, not a ceiling.
The annual security plan review documents the state of controls at the time of the review. DIR uses that documentation as a baseline, not as a defense. If a breach occurs and the post-incident investigation reveals that controls were non-functional in ways that the annual review should have detected -- tool integration failures, volatile evidence collection gaps, notification workflows dependent on departed personnel -- the clean annual review does not mitigate the finding. It raises the question of why the review did not catch it.
The counterintuitive result is that agencies with frequent, well-documented control testing -- including records of what was found and fixed -- are in a better position during a DIR inquiry than agencies with clean, untested documentation. The tested agency has evidence of a functioning security management process. The untested agency has evidence of a documentation process, which is not the same thing.
This matters practically because the annual review cadence under Texas Administrative Code Chapter 202 is the minimum, not the standard of care. DIR enforcement in post-breach inquiries evaluates whether the agency exercised reasonable security judgment, which includes whether the annual review was supplemented with ongoing testing appropriate to the agency's risk profile.
What agencies said before the incident, and what the root cause was
We completed the Chapter 202 security plan review last quarter. Everything was signed off. Our IR plan covers the SB 2610 notification requirements.
Root cause:The IR plan documented the notification requirement -- 'notify DIR without unreasonable delay' -- without specifying the trigger, the responsible role, the escalation path if the primary contact is unavailable, or the content of the initial notification. When a breach occurred, the team spent 11 hours determining who was responsible for the DIR notification and what preliminary information was sufficient to send. By the time the notification went out, the 48-hour window had closed.
We have an EDR and a SIEM. Our alerts are configured and the tools are working. If something happens, we will know.
Root cause:The tools were functional in isolation. The integration between the SIEM alert and the EDR containment action had never been tested as a system. A configuration change three weeks before the incident had broken the trigger. The SIEM alerted correctly. The containment action did not fire. The team discovered the integration failure when they looked for evidence that containment had occurred and found that no isolation event appeared in the EDR console.
Our post-incident report template covers everything DIR needs. We have sections for scope, impact, and remediation.
Root cause:The template covered the structural requirements. It did not address the forensic content DIR uses to evaluate response adequacy: the technical timeline of attacker activity, the evidence basis for the timeline, and the gap between initial access and detection. When the incident occurred, the investigation could not reconstruct the technical timeline because volatile evidence had not been preserved and log retention was set to 30 days for the affected system -- shorter than the attacker's dwell time.
The SB 2610 breach response gaps that appear after the incident
Log retention shorter than attacker dwell time
Texas Administrative Code Chapter 202 requires log retention adequate to support incident investigations. The typical implementation is 90 days for most systems. Attackers with persistent access to state agency networks frequently have dwell times that exceed 90 days before detection. When the post-incident investigation begins, the logs covering the initial access period -- the most forensically valuable part of the timeline -- no longer exist. The investigation can document what happened in the last 90 days. It cannot document how the attacker got in, which is the question DIR will ask first.
Vendor breach notification obligations that run in the wrong direction
State agency contractors operating under SB 2610 have breach notification obligations to the agency, and the agency has obligations to DIR. The notification chain works in sequence: contractor discovers breach, notifies agency, agency notifies DIR. In practice, agencies discover breaches through DIR or through public disclosure before the contractor has notified them. Contracts that do not specify contractor notification timelines -- or that specify timelines longer than the DIR notification window -- create a situation where the agency is expected to notify DIR about an incident it has not yet been formally informed of.
The interim update obligation
DIR expects updates as the investigation progresses, not silence between the initial notification and the final report. Agencies that treat the notification as a checkbox and then focus internally on the investigation without maintaining DIR communication are not meeting the update requirement. The update obligation also means the agency needs a process for communicating preliminary, incomplete information to DIR in a way that does not create regulatory exposure when the final findings differ from the preliminary assessment.
Security awareness training records and the audit timing gap
Texas Administrative Code §202.3 requires security awareness training for all agency personnel. The compliance gap is not in the training itself -- most agencies conduct training. It is in the records: training records that do not capture completion dates, records that do not track new hires within the required training window, and audit processes that sample training records at a point in time that may miss non-compliance in the new hire cohort. A healthcare contractor assessment found that auditors reviewing training records 60 days after hire saw compliant records for a cohort that had not completed training within the required 30-day window -- the audit timing made the gap invisible.
Where DIR breach response enforcement is heading
DIR will formalize the 'without unreasonable delay' notification standard into a defined hour window -- most likely 48 hours -- within the next revision cycle of Texas Administrative Code Chapter 202, removing the current interpretive flexibility and creating a hard compliance metric.
The trend across state-level cybersecurity frameworks is toward defined notification windows. Texas is currently an outlier in leaving 'unreasonable delay' undefined while peer states (Colorado, Connecticut, New York) have moved to 72-hour or shorter windows. DIR guidance already references 48 hours informally. Codifying this into the administrative code is the logical next step, and the practical effect will be that agencies whose detection capability cannot support 48-hour notification discovery will be structurally non-compliant regardless of their IR plan quality.
Confidence: highIf Texas Administrative Code Chapter 202 is revised before 2028 and does not include a defined notification hour window, the codification prediction is wrong. Watch the DIR regulatory comment periods -- a proposed hour definition will appear in draft form before adoption.Tool integration failures will be cited in a DIR post-incident inquiry as a contributing factor in a high-profile state agency breach within 18 months, establishing the expectation that IR plan testing must include integration testing, not just individual tool validation.
The gap between individual tool compliance and integrated response chain reliability is universal and well-documented. As DIR post-incident inquiries become more technically sophisticated -- a trend visible in how federal agency incident inquiries have evolved under FISMA -- the question of why automated containment did not fire will be asked. The first DIR inquiry that formally attributes a breach's scope to an integration failure will establish that integration testing is within the scope of reasonable security under SB 2610.
Confidence: mediumIf no DIR post-incident inquiry through 2027 cites tool integration failure as a contributing factor in a finding, the enforcement trajectory has not yet reached this level of technical specificity. The signal to watch: DIR guidance documents or post-incident summary reports that reference automated response chain failures.
The problem with compliance-driven IR plans
IR plans built to satisfy Texas Administrative Code Chapter 202 review requirements are built for a different audience than the one that matters most during a breach. The annual review audience is a DIR auditor checking that the plan exists, covers the required elements, and has been approved by the appropriate authority. That audience does not test whether the plan executes correctly under incident conditions.
The audience that matters during a breach is the incident response team at 2am, the DIR analyst who will review the post-incident report, and potentially a court if the incident produces litigation. None of them care whether the plan was approved. They care whether it was followed, whether it worked, and whether the documentation produced during the response supports the agency's account of what happened.
My position is that any state agency operating under SB 2610 that has not exercised its IR plan against a realistic scenario in the prior 12 months does not know whether it can meet the notification timeline, produce the forensic documentation, or maintain the DIR update cadence that a real incident requires. The annual review tells the agency what the plan says. The exercise tells the agency what the plan does.
The counterargument is that tabletop exercises and realistic scenario testing require time and resources that many state agencies -- particularly smaller municipalities and K-12 districts operating under Chapter 202 -- do not have. That constraint is real. But the cost of a tabletop exercise is fixed and known. The cost of a DIR post-incident inquiry that finds the plan was untested is variable and has historically been significantly higher.
Counterargument
Realistic IR plan testing requires resources that smaller state agencies and districts operating under SB 2610 often cannot allocate. The annual review requirement exists because it is the scalable minimum, and mandating exercise frequency would create compliance costs that many covered entities cannot absorb.
One thing worth doing this week
Pull your current IR plan and find the DIR notification step. Check three things: who is named as responsible for making the notification, whether that person is still in the role, and what the plan specifies as the trigger for notification -- the specific condition that moves the response from 'investigating' to 'notifying DIR.' If the trigger is vague ('when a breach is confirmed'), document what 'confirmed' means operationally, because that definition will determine whether your 48-hour window is measured from the right starting point. That is the piece most plans leave undefined, and it is the piece DIR will ask about first.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
digital footprint analysisNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideThird-Party Risk Management
third-party risk management
Frequently Asked Questions
What are the breach notification requirements under Texas SB 2610 for state agencies?
Texas SB 2610 and its implementing regulations in Texas Administrative Code Chapter 202 require state agencies to notify the Texas Department of Information Resources (DIR) without unreasonable delay following discovery of a cybersecurity breach. DIR enforcement practice treats 48 hours as the operational expectation for initial notification. Agencies must also provide interim updates as the investigation progresses and submit a final post-incident report covering forensic findings, a timeline of events, remediation steps taken, and prevention measures. The notification obligation runs to DIR, not directly to affected individuals -- DIR coordinates individual notification with the agency.
What evidence does DIR expect state agencies to preserve after a breach under SB 2610?
Texas Administrative Code §202.73 requires agencies to preserve and protect all relevant data, logs, and system images related to a breach. In practice, DIR post-incident reports are expected to support a technical timeline of attacker activity, which requires volatile evidence collected before remediation: RAM acquisition from compromised systems, live network connection state, running process lists, and PCAP data where available. Agencies that reboot compromised systems before collecting volatile evidence destroy the forensic record their post-incident report will need. Log retention shorter than attacker dwell time creates the same problem -- the initial access timeline is unrecoverable if logs have rolled over.
What are the most common SB 2610 incident response failures in Texas state agencies?
Vulnox assessments of state agency contractors operating under SB 2610 consistently find three failure patterns: IR plans that document individual tool behavior but do not test integration between tools in the response chain; notification workflows dependent on named individuals who have left the organization; and post-incident report templates that satisfy structural requirements but cannot support a technical timeline because volatile evidence was not preserved. Tool integration failures are particularly common -- an EDR that alerts correctly but cannot trigger isolation because the endpoint agent is misconfigured produces a compliant alert log and an uncontained incident simultaneously. (Vulnox assessment data, 2024)
How does SB 2610 apply to state agency contractors and vendors?
Texas SB 2610 and Texas Administrative Code Chapter 202 apply to Texas state agencies and entities that contract with them to handle state data. Contractors operating under SB 2610 have breach notification obligations that run to the agency, which in turn has notification obligations to DIR. Contracts must specify contractor notification timelines that are shorter than the agency's DIR notification window -- a contractor notification timeline of 72 hours creates a structural problem if the agency's DIR obligation is 48 hours. Ongoing vendor monitoring is required; initial security assessment at contract award does not satisfy continuous oversight obligations.
What should a SB 2610 post-incident report to DIR include?
DIR expects post-incident reports to include: a technical timeline of attacker activity with the evidence basis for that timeline; the initial access vector and how long the attacker had access before detection; the scope of data accessed or exfiltrated; remediation steps taken with timestamps; and prevention measures to address the root cause. Reports that describe the incident at the business level without the underlying technical detail leave DIR to draw its own conclusions about detection and response adequacy. The forensic timeline is the component most commonly absent from agency post-incident reports, typically because volatile evidence was not preserved during the response.
Does a clean annual Chapter 202 security plan review protect a state agency during a DIR breach inquiry?
A clean annual review documents control state at the time of the review. It does not prevent DIR from inquiring whether controls were functional at the time of the breach. If a breach investigation reveals tool integration failures, log retention gaps, or notification workflow breakdowns that the annual review should have detected, the prior clean review raises the question of why it did not. In Vulnox post-incident engagements where DIR was involved, agencies with prior third-party assessment records and documented remediation activity between annual reviews received less post-breach scrutiny than those whose compliance posture was supported only by the annual review.
What is the difference between SB 2610 compliance for state agencies and Texas privacy law for private-sector organizations?
Texas SB 2610 as applied to state agencies operates through Texas Administrative Code Chapter 202 and the Texas Department of Information Resources. Breach notification runs to DIR, which coordinates with the agency on individual notification. The private-sector equivalent -- requirements for organizations handling sensitive personal information of Texas residents -- operates through the Texas Business and Commerce Code (primarily Chapter 521) and involves direct notification to affected individuals, with the Texas AG as the enforcement authority. The frameworks have different notification chains, different evidence standards, and different enforcement mechanisms. IR plans built for one do not automatically satisfy the other.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.