What the law does
SB 2610 took effect on September 1, 2025. If your business is sued after a data breach, and you can show that you maintained a cybersecurity program that follows a recognized framework at the time of the breach, a court cannot award exemplary damages against you. Exemplary damages, often called punitive damages, are meant to punish, and they can be many times larger than the actual cost of the breach.
The law does not stop a lawsuit from being filed, and it does not remove responsibility for actual losses. It removes the largest and least predictable part of the exposure.
What you need, by company size
- Fewer than 20 employees: password policies and security awareness training for staff.
- 20 to 99 employees: the CIS Critical Security Controls, Implementation Group 1. This covers basics such as an inventory of devices, multi-factor authentication, patching, backups and malware defenses.
- 100 to 249 employees: a full framework such as the NIST Cybersecurity Framework or ISO 27001.
The part most businesses miss: proof
Having security tools is not enough. The protection depends on showing that the program existed and was maintained when the breach happened. That means written policies, an incident response plan, training records, log history and regular reports. If you cannot produce them, the safe harbor is hard to claim.
A practical checklist
- Write down your security policy and incident response plan.
- Turn on multi-factor authentication for email, remote access and administrator accounts.
- Put managed endpoint protection on every computer, with 24/7 monitoring.
- Protect email against phishing, the most common way attackers get in.
- Back up your data off site in a form that cannot be altered, and test a restore.
- Collect logs in one place and keep them.
- Train every employee and keep the attendance records.
- Review the program at least once a year and document the review.
Other benefits of doing this work
The same controls are what cyber insurers now ask about on applications and renewals, and for medical practices they strengthen HIPAA compliance at the same time. Most of the cost is work you would want done anyway.
This article is general information, not legal advice. Talk to your attorney about how the law applies to your organization.