Narrow the list by what you need most. Companies that want hosting and monitoring under one roof should look at BEAR Technologies, private equity portfolios and mid-market firms at Paranet, financial and professional firms that want published service metrics at DKBinnovative, and businesses spread across Dallas and Fort Worth at Mentis Group. Specialists cover the rest: Justice IT Consulting for CMMC, Rudick for architecture, engineering and construction, Aspire and Infonaligy for dental and medical practices, TekConcierge for hospitality, and Velo IT Group for companies of 20 to 150 people that want a fixed monthly fee. Ask each finalist for its average response and resolution times, a recent SOC 2 or comparable audit report, and how it would help you meet Texas breach-notice deadlines.
Does the Texas Data Privacy and Security Act apply to my business?
The law took effect on July 1, 2024. Small businesses as defined by the U.S. Small Business Administration are generally exempt, with one important exception: even a small business must get a consumer’s consent before selling that person’s sensitive data. The Texas Attorney General enforces the act, must give a business written notice and 30 days to cure a violation before suing, and can seek civil penalties of up to $7,500 per violation; consumers have no private right to sue under it.
How fast must a Texas business report a data breach?
Texas law requires notice to affected individuals no later than 60 days after the business determines that a breach occurred. If at least 250 Texas residents are affected, the Attorney General must also be notified, through the office’s online form, as soon as practicable and no later than 30 days after that determination, a deadline that was shortened from 60 days in September 2023.
What do Texas state agencies require of IT providers?
Since January 1, 2022, Texas state agencies may only sign or renew contracts for cloud computing services that comply with TX-RAMP, the state’s Risk and Authorization Management Program, and providers must stay certified for the whole contract. State agencies must also require contractors with access to a state computer system or database to complete a certified cybersecurity training program during the contract. An MSP that wants to serve state agencies should be able to show both.
