Write your company's cybersecurity program this month.
14 fill-in documents mapped to CIS Controls IG1, the framework Texas's safe harbor points to for companies with 20 to 99 employees. Plus an insurance answer crosswalk and a bilingual employee sign-off form.
Texas rewards a documented program, and renewal applications ask for proof. Most companies have pieces and no single written program.
What's inside
Information Security Program
The umbrella document: scope, roles, the list of policies, the review cycle and a leadership adoption page.
13 fill-in policies
Acceptable Use; Access Control and MFA; Privileged Access; Data Classification; Backup and Recovery; Incident Response; Business Continuity and Disaster Recovery; Patch and Vulnerability; Endpoint and Remote Work; Vendor Risk; Email Security and Funds Transfer Verification; Change Management; Network and Firewall. Word files with yellow fields to fill and instructions in the margin.
CIS IG1 Safeguard Map
A spreadsheet that shows which policy section covers each IG1 safeguard, with an evidence column for where the proof lives.
Insurance Answer Crosswalk
Common renewal application topics (MFA, backups, EDR, alert monitoring, AI use, bank change verification, training, incident plan) mapped to the policy section and the evidence to keep.
Bilingual employee acknowledgment
A one-page sign-off form in English and Spanish for Acceptable Use and Funds Transfer Verification, with a tracking sheet.
Bonuses
20-minute Policy Pack review call
A 20-minute review call with a senior engineer: where to start and which gaps matter most for your company. Book within 30 days.
2027 Cyber Renewal Calendar
A 120, 90, 60 and 30 day checklist tied to the crosswalk.
Owner and board one-pager
One page on what your cybersecurity program covers, to adopt at a leadership meeting and file with the program.
Evidence folder structure
Folder names and what to save in each: MFA reports, restore test logs, training records and acknowledgments, all dated.
Windows 10 and Microsoft 365 Cost Sheet
Current prices and dates on one page.
Who it's for
Texas companies with 15 to 250 people that want to write their program in-house.
Not a fit if you need someone to implement and evidence the controls. That is what a 20-minute fit call is for.
What it doesn't do
The pack gives you the documents. Making every line true in your systems and keeping the evidence current is the work. If you want that done, book a fit call.
Built by ITFocus, the one team that plans, builds, runs and improves your technology. Running technology and security for enterprises since 1997, bilingual in English and Spanish.
Questions
What format are the files?
Word documents and Excel spreadsheets, in English and Spanish.
Is this legal advice?
No. The pack gives general information about technology practices. Talk to your attorney about how the Texas safe harbor applies to your company.
Can I use it for more than one company?
The license covers one company, for internal use.
Does it guarantee the safe harbor or my renewal?
No. It gives you documents that may help qualify your company for the safe harbor and help you answer renewal questions with evidence. Coverage decisions belong to your insurer.
How do I get the files?
By email within 1 business day of your purchase, with the link to book your review call.
Start your written program this month.
Texas SB 2610 (effective Sept 1, 2025) bars punitive damages in a breach lawsuit against a business with fewer than 250 employees that kept a documented cybersecurity program at the time of the breach. Compensatory damages and regulator action still apply. A documented program may help qualify your company.
This check gives general information about your technology practices. It is not legal or insurance advice. Whether the Texas safe harbor applies depends on your facts; talk to your attorney.
The 2027 Texas Business Tech Check and the Texas Safe Harbor Policy Pack give general information about technology practices. They are not legal or insurance advice and do not guarantee that the Texas safe harbor applies, that any audit is passed, or that any insurer offers coverage or terms. Talk to your attorney and your insurance broker. ITFocus does not sell insurance.