Austin Legislative Hub
A breach is not just a technology problem, it is an evidence problem. Who decides, what gets preserved, what Texas requires, and what you can prove when it is over. One page. Fifteen minutes. Same rail, same fare, no gate.
No class. No webinar. No slide deck. The Car runs start to finish on its own — four Signals, a pressure door between each one, and the complete signed Car waiting in the Library.
Educational orientation only. Not legal advice — the statute is quoted here so you can read it yourself, but whether an event is a reportable breach is a determination for counsel and your insurer. This Car ends with a blank page and a pen: the decision is yours.
This ride
Ride depth
No account, no form, no sales handoff. The ride starts the moment you board — four Signals, a pressure door between each one, and the Library at the end.
How do you want this — Quick Start or Deep Dive?
The owner orientation. Three bullets per Signal — the punchline of each stop and nothing else. Enough to make the decision this Car asks you to make.
Release 1 delivers Quick Start as four acts at the length on the button — measured in this build, not estimated. About 3 min per act (~12 min end to end) is the Release 2 editorial-depth target.
Every line of this Car's approved text, in order, with the founder's notes as cards beside it. Narrated by Rex, with the read-along measured from his recordings.
Release 1 delivers Deep Dive as the same four acts at the length on the button — measured in this build, not estimated. That length is measured from Rex’s recordings in this build. About 10 min per act at Deep (~40 min end to end) is the Release 2 editorial-depth target, not current delivery.
You are not locked in. The Quick / Deep switch rides with you in the player, so you can cross over at any stop. The complete original Car — worksheet, red lines, correction log and all — is always one tap away under “Full Reading + Sources”.
Now boarding
State Liner · Car 05 — Cyber Resilience & Incident Reporting · Guided by Rex
The first breach call rarely sounds dramatic. This Car is about the hour after it.
1:12A pile of tools is not a response plan, and every vendor promise is narrower than it sounds.
0:56Texas asks for reasonable procedures and puts the disclosure clock on a date you have to determine.
3:42A defense you cannot document is a defense you do not have.
1:21Your ride depth
Audio-first rider: Rex narrates this Car, and the transcript highlights sentence by sentence from his recordings.
Car 05 · Cyber Resilience & Incident Reporting · Rex
Statute quotations on this Car were taken from the code's own text and the enrolled bill text on 2026-09-11 and are quoted, not paraphrased, with section numbers so you can check every one. Whether an event requires notification is a legal determination for counsel, not a claim this Car makes.
Educational orientation only. Not legal advice — the statute is quoted here so you can read it yourself, but whether an event is a reportable breach is a determination for counsel and your insurer. This Car ends with a blank page and a pen: the decision is yours.
This is Car 05 exactly as it was signed — every word of the approved doctrine, the worksheet, the red lines, the boundaries, and the correction log, unabridged and unedited. The rider above is a second way through the same words, not a replacement for them.
State Liner · Car 05
A breach is not just a technology problem, it is an evidence problem. Who decides, what gets preserved, what Texas requires, and what you can prove when it is over. One page. Fifteen minutes. Same rail, same fare, no gate.
v1 doctrine · corrections signed and dated in the log below.
The first breach call rarely sounds dramatic. A controller sees a strange invoice. A staff member enters credentials into a false sign-in page. A vendor reports an exposure. A laptop disappears. A former employee still has access. This Car is about the hour after that call: who decides, what gets preserved, what Texas requires you to do, and what you can prove when it is over. One page. Fifteen minutes. Same rail, same fare, no gate.
The worst moment to decide who has authority is during the first hour after the call. Technical recovery matters, but the business also needs to know who pauses systems, who calls the vendor, who documents facts, who talks to counsel or insurance, and who determines whether notifications are required.
If that call came at 7:15 tomorrow morning, would your team know the first three calls to make?
The Meridian move on this stop is a card, not a plan. Create the First-Hour Card: incident leader, technology lead, outside vendor, insurance and counsel contact, and one plain instruction — do not destroy evidence. Five lines, printed, where somebody can reach it without a password. The blank version is at the bottom of this Car.
Cybersecurity is often sold to the small employer as a stack of products: endpoint protection, backups, monitoring, cyber insurance, managed IT, training, penetration testing. Those tools matter. But a pile of tools is not a response plan.
The managed IT provider protects devices. The insurer enforces conditions. The software company protects its own service. The attorney advises. Every one of those promises is real, and every one of them is narrow. The owner is still the person who has to connect the facts, approve the decisions, protect the business, and show reasonable safeguards.
Can you prove — not merely believe — that your safeguards, vendor responsibilities, and decision authority fit together?
The Meridian move here is a folder. Build an Evidence Folder and keep it current: vendor agreements, the security-control record, training evidence, an asset inventory, backup confirmation, insurance requirements, and the incident log. Nothing in that list requires a consultant to start.
Chapter 521 of the Business & Commerce Code — the Identity Theft Enforcement and Protection Act — is the Texas duty that sits underneath every incident conversation. It has two halves: protect the information before anything happens, and disclose it on a clock afterward.
“A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information collected or maintained by the business in the regular course of business.” — Tex. Bus. & Com. Code § 521.052(a)
“The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred …” — § 521.053(b)
“A person who is required to disclose or provide notification of a breach of system security under this section shall notify the attorney general of that breach as soon as practicable and not later than the 30th day after the date on which the person determines that the breach occurred if the breach involves at least 250 residents of this state.” — § 521.053(i)
Three things in that language deserve an owner’s attention. The duty to maintain reasonable procedures exists before any incident, on an ordinary Tuesday, with no breach in sight. The clock does not start when the crisis ends — it starts on the date you determine a breach occurred, and the attorney-general clock at 250 Texas residents is shorter than the clock for telling the people affected. And the state’s own notification form asks what measures you took regarding the breach, which is a question about records you either kept or did not.
Car 01 taught the defensive value of a documented cybersecurity program. Senate Bill 2610 sized that program to the business: simplified requirements for an entity with fewer than 20 employees, the Center for Internet Security Controls Implementation Group 1 for at least 20 but fewer than 100, and the full program requirements from 100 to fewer than 250 — built on recognized frameworks the statute names, from the NIST Cybersecurity Framework and NIST 800-171 to CIS Controls, ISO/IEC 27000, HITRUST CSF, the Secure Controls Framework, and SOC 2.
“Notwithstanding any other law, in an action arising from a breach of system security, a person harmed as a result of the breach may not recover exemplary damages from a business entity to which this chapter applies if the entity demonstrates that at the time of the breach the entity implemented and maintained a cybersecurity program in compliance with Section 542.004.” — Senate Bill 2610, adding Tex. Bus. & Com. Code ch. 542
Look at the shape of that protection. It is a defense the business has to demonstrate, at a moment when nobody is in the mood to go looking for documents — and a defense you cannot document is a defense you do not have. It is also narrow on purpose: it speaks to exemplary damages. It does not remove the Chapter 521 duties above, which run on their own track and their own clock.
So Car 05 turns Car 01’s idea into standing operating discipline. The program is not what you say you have. It is what you can show, repeat, test, and improve.
If a dispute, insurer, regulator, customer, or attorney asked for evidence next week, what would you put on the table?
The Meridian move is thirty minutes, once a year. Run a tabletop drill: walk through a realistic event, record the decisions, capture the gaps, assign the owners, and preserve the revision date. The drill is not the point. The record it leaves behind is the point.
Resilience means the business stays able to decide. You know the important data, the critical vendors, the accountable people, the first-hour steps, the recovery choices, and the proof you can produce afterward. A small employer cannot promise perfection, and Texas does not ask for it — the standard is reasonable procedures, and the practical question is whether your business can show the choices it made.
At the end of this Car, you should be able to say five things out loud without checking with anyone:
The Meridian lesson on this Car is a working session: build the First-Hour Card, identify the one missing evidence item you already know about, and put the first tabletop drill on the calendar with a date and an owner. Three outputs, one sitting.
Five Cars. One record. You now have the beginning of a Texas small-employer governance file — what you protect, what you use, who owns it, and what you will do next. The Caboose is where you look back down the rail and see the whole file at once.
This Car is educational orientation. It is not legal advice, not an incident-response plan for your business, and not a determination about any event. Whether a particular event is a breach of system security, whether notification is required, who must be told, and when — those are legal determinations that belong to counsel, made on the facts, usually with your insurer in the room.
This Car will not tell you that you are protected, that your program qualifies, or that a notification is or is not required. The statutory read of the cybersecurity-program safe harbor lives on Car 01, where it is taken line by line. If an incident is happening right now, stop reading and call counsel and your insurer.
The standing instruction line exists for one sentence: do not destroy evidence. Preserve logs, devices, mailboxes, and messages until somebody with authority says otherwise.
Statute quotations on this Car were taken from the code’s own text on 2026-09-11 and are quoted, not paraphrased. Section numbers are given so you can check every one of them.
Take the next step
Arrival
Everything this Car says lives here. Replay any Signal, read the whole Car unabridged, or take the next step.
Replay depth — same choice you made at the Ticket
Any stop, any time. Start over from the top of Car 05.
Read instead of listen, or replay one stop. The transcript is the Car's own text, word for word, and it follows along.
The complete signed Car — doctrine, worksheet, red lines, boundaries, and the correction log. Nothing abridged.
David M. Williams, GRC Chair at Dynasty Stack, answers questions about this ride. Write if and when you want to: david.m.williams@dynastyplays.com. Nothing is sent unless you write.
Questions about this ride
Optional and up to you. Email David, GRC Chair at Dynasty Stack, at david.m.williams@dynastyplays.com. Nothing is shared and no one contacts you unless you write first.
Take the next step
Meridian Rail · State Liner · Car 05 · v1 · 2026-09-11