Cyber Liability Insurance Cost in Texas

Texas cyber insurance pricing depends on the business, data, security controls, limits, retention, and coverage. State law exempts qualifying commercial cyber coverage from rate and form filing, subject to conditions. Compare each proposal's response services, liability, interruption, sublimits, and reporting terms rather than relying on the headline limit.

This guide has no verified premium dataset matched to your Texas business. A documented average can provide context, but a useful quote needs your records, industry, controls, limits, and retention. Budget for both premium and the amount you would fund during an incident.

Check cyber coverage separately

General liability is mainly designed for bodily injury, property damage, and personal and advertising injury. Do not assume it funds forensics, customer notification, privacy lawsuits, extortion response, or lost income after a network incident.

A package may include a cyber endorsement. Check its dedicated limit, sublimits, retention, and incident-response contact. TDI's home-business guidance specifically advises considering data-breach or cyber liability coverage when storing customer medical or financial records. A small office can have that exposure too.

The Texas rule that should change how you shop

This is the part almost nobody tells Texas buyers, and it is the most important thing in this post.

In 2021 the Legislature passed SB 1367, and TDI implemented it in Commissioner's Bulletin B-0022-21, dated August 9, 2021. The bulletin's own summary is that SB 1367 eliminates rate and form filing requirements for certain lines of commercial insurance, effective for a policy delivered, issued for delivery, or renewed on or after September 1, 2021.

Item 15 on that list is commercial cybersecurity, including first and third party commercial lines coverage for losses arising out of or relating to data privacy breaches, network security, computer viruses, and similar exposures.

The statutory mechanics sit in two places. Insurance Code Section 2251.0031 provides that the rate filing requirements of Subchapter C do not apply to the listed commercial lines written by an authorized insurer. Insurance Code Section 2301.0031 does the same for forms, specifically switching off Section 2301.006 on filing and approval of forms, Section 2301.007(a) and (b) on disapproval and withdrawal of approval, and Section 2301.008 on adoption and use of standard forms. Both sections let the commissioner temporarily reimpose filing for up to a year, after notice and hearing, on a finding that a reasonable degree of competition does not exist for the line.

Two qualifications in the bulletin are worth keeping: if exempt lines are combined with non-exempt lines, the rates and forms must be filed; and other statutes and rules, including cancellation and nonrenewal requirements, still apply to the exempt lines.

Then there is the distribution side. Insurance Code Section 981.004 normally requires that the full amount of required insurance cannot be obtained after a diligent effort from an authorized Texas insurer before a surplus lines placement, and limits the surplus lines insurer to the amount exceeding what admitted insurers will write. Section 981.004(g) switches both of those off for the lines described in Sections 2251.0031(a) and 2301.0031(a), which includes commercial cybersecurity.

Put it together and the picture is clear. In Texas, cyber is a line where neither the price nor the policy wording passes through a filing process, and where the surplus lines market is open without the usual search of the admitted market first. TDI's surplus lines guide is candid about what that costs the buyer: unlike Texas-licensed companies, surplus lines companies are not members of a guaranty association, the coverage has fewer consumer protections, and if the insurer fails, claims could go unpaid.

None of that is an argument against buying cyber coverage. It is an argument for reading the policy instead of the premium.

What Texas law obligates you to do after a breach

The reason to carry this coverage is that the response is not optional.

The duty to notify individuals. Business and Commerce Code Section 521.053(b) places the duty on a person who conducts business in this state and owns or licenses computerized data containing sensitive personal information. Notice must go to any individual whose sensitive personal information was or is reasonably believed to have been acquired by an unauthorized person, without unreasonable delay and in each case not later than the 60th day after the person determines the breach occurred. There are two carve-outs: a law enforcement delay, and delay as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

What counts as a breach. Section 521.053(a) defines breach of system security as unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information, including data that is encrypted if the person accessing it has the key required to decrypt it. Good faith acquisition by an employee or agent for the business's own purposes is excluded, unless the data is then used or disclosed without authorization.

The vendor asymmetry. Section 521.053(c) requires a person who maintains sensitive personal information it does not own to notify the owner or license holder of any breach immediately after discovering it. Immediately for the data owner, 60 days for individuals. If you are the vendor holding someone else's customer data, that is a contractual indemnity conversation as much as an insurance one.

The Attorney General trigger. Section 521.053(i) requires notice to the Attorney General if the breach involves at least 250 residents of this state, submitted electronically no later than 30 days after the person determines the breach occurred. The required contents include a detailed description of the breach or misuse, the number of Texas residents affected at the time of notice, the number already notified directly, measures taken, measures intended to be taken, and whether law enforcement is investigating. The Attorney General's data breach reporting page confirms the 250-resident threshold and the 30-day deadline, and notes that since September 1, 2023 reports must be submitted electronically.

The public listing. Section 521.053(j) requires the Attorney General to post a public listing of breach notices received, updated not later than the 30th day after receipt, with an entry removed by its first anniversary if the person reported no further breaches in that year. This is the part clients do not see coming. A reportable breach becomes a searchable public record.

What is sensitive personal information. Section 521.002(a)(2) covers an individual's name combined with an unencrypted Social Security number, driver's license or other government identification number, or financial account or card number together with the security code or password that would permit account access, plus information identifying an individual that relates to physical or mental health, health care, or payment for health care. The broader category of personal identifying information in Section 521.002(a)(1) reaches mother's maiden name, unique biometric data such as fingerprints or iris images, and unique electronic identification numbers.

Penalties. Section 521.151 provides a civil penalty of at least $2,000 and not more than $50,000 for each violation. Under Section 521.151(a-1), a person who fails to take reasonable action to comply with the individual notice duty faces not more than $100 for each individual owed notice, accruing for each consecutive day of failure, capped at $250,000 for all individuals owed notice after a single breach. The Attorney General may also seek injunctive relief and recover expenses including attorney's fees, court costs, and investigatory costs.

Disposal matters too. Business and Commerce Code Section 72.004 requires a business disposing of a record containing a customer's personal identifying information to make that information unreadable or undecipherable, naming shredding and erasing as methods, with a civil penalty of up to $500 per record. Contracting with a records disposal specialist is a compliance route. Note that financial institutions and insurance covered entities are carved out of that section.

The size threshold trap. The Texas Data Privacy and Security Act in Chapter 541 generally applies to a person that processes or sells personal data and is not a small business as defined by the U.S. Small Business Administration, subject to Section 541.107. Chapter 521 has no size threshold whatsoever. So a business comfortably below the privacy act's main obligations carries the full breach notification duty, the full Attorney General reporting duty, and the full penalty exposure.

Prepare a useful cyber application

The GAO's cyber insurance research addresses limited loss data, ransomware, and changing terms. Its historical market figures are not current Texas prices, so do not use them to predict this renewal.

Prepare annual revenue, industry, headcount, record types and approximate volume, prior incidents, and critical systems. Describe outsourced IT and cloud dependencies as well as your own equipment. A retailer processing cards and a firm holding health records need different questions even at similar revenue.

Ask for prices at more than one limit and retention while keeping other assumptions fixed. Confirm whether the retention applies to response services, defense, and damages, and whether different coverages use different retentions. A cheaper option may quietly remove business interruption or reduce an extortion sublimit.

Answer security questions from evidence. If an answer depends on an IT provider, obtain confirmation. Do not describe multifactor authentication as universal when it covers email but not remote access or administrator accounts. Application accuracy matters to underwriting and a later claim.

The controls that move the number

Underwriters price what you can document. The federal guidance is a reasonable proxy for what good looks like, and it is free.

CISA's cyber guidance for small businesses is direct about multifactor authentication: ensure it is mandated using technical controls, not faith, enable it for all system administrator accounts, and verify the enrollment numbers rather than assuming them. It identifies FIDO authentication as the only widely available phishing-resistant option. On patching, it calls keeping systems patched one of the most cost-effective practices to improve your security posture, says to prioritize the Known Exploited Vulnerabilities catalog, and to enable automatic update mechanisms where possible. On backups, perform and test them, and it is critical to regularly test partial and full restores. On endpoints, remove administrator privileges from user laptops and enable disk encryption. On people, all staff must be formally trained. And on incident response, the plan is your action plan before, during, and after an incident, to be reviewed quarterly and after every security incident or near miss.

The FTC's small business cybersecurity basics adds automatic updates, offline or cloud backups, encryption of devices and media containing sensitive personal information, multifactor authentication for sensitive network areas, router hygiene including changing default credentials and disabling remote management, strong passwords of at least 12 characters, limiting failed login attempts, recurring employee training, and having a plan for saving data, running the business, and notifying customers after a breach.

A business that can answer those questions with evidence is a different risk from one that cannot, and that difference shows up in both availability and price.

Reading two cyber quotes that look identical

Compare the following using each proposal's actual schedule and wording:

• Limits and sublimits: extortion, social engineering, fraudulent transfers, notification, and recovery may not all have the headline limit. Check whether a sublimit is part of, or additional to, the aggregate.
• Retention and coinsurance: find out when your contribution applies and whether you also pay a percentage of a covered loss. A lower premium can shift more expense back to you.
• Business interruption: distinguish your own network outage from an outage at a cloud, payment, or other dependent provider. Check the waiting period, restoration period, and how lost income is measured.
• Exclusions: read war, infrastructure, physical damage, prior-incident, and security-condition provisions. Their labels alone do not reveal the exceptions or scope.
• Standalone versus endorsement: either structure can have its own limit or restrictions. Compare the actual terms rather than assuming one label is always broader.
• Defense and response: identify who appoints counsel and response vendors, whether advance consent is needed, and whether their costs reduce the limit.

Keep a written list of differences beside the premiums. If a quote excludes the event you are most worried about, a matching dollar limit does not make it equivalent.

Turn the quote into an incident plan

Obtain the insurer's reporting contact, notice triggers, and consent requirements for legal, forensic, or payment commitments. Keep this information outside the network you may lose access to.

Separate first-party response expenses from liability to others. Check vendor outages, fraudulent transfer instructions, and extortion individually because they may have separate triggers or sublimits. Regulatory fines are not automatically insurable.

The filing exemption does not remove other insurance laws or prove that every published average is invalid. It makes the actual policy and coverage schedule essential to a fair comparison.

Checklist before you buy

• Is the quote a standalone cyber policy or an endorsement sharing a package limit?
• What are the sublimits, specifically for ransomware, extortion, and social engineering or funds transfer fraud?
• Is there coinsurance on ransomware, and at what percentage?
• Is first party business interruption included, is dependent business interruption included, and what is the waiting period?
• Do defense and response costs erode the limit?
• Are there war, critical infrastructure, or physical damage exclusions, and what do they actually reach?
• Is the insurer admitted or surplus lines, and do you understand that a surplus lines insurer is outside guaranty association protection?
• Does the policy fund the Texas notification obligations, including Attorney General reporting when a breach reaches 250 Texas residents?
• Does it respond to a vendor's breach of data you own, and does your vendor contract require immediate notice the way Section 521.053(c) does?
• Can you document multifactor authentication, tested backups, patching, and an incident response plan, since those are what the underwriter is pricing?

Frequently asked questions

What determines cyber insurance cost in Texas?

Business size, records, industry, security controls, limits, retention, and coverage choices affect a quote. This guide has no verified current Texas premium dataset.

Does general liability cover data breaches?

Do not assume it does. Check any cyber endorsement and dedicated policy for response costs, privacy liability, interruption, exclusions, and sublimits.

How quickly must affected people be notified?

Chapter 521 generally requires notice without unreasonable delay and within 60 days of determining the breach, subject to stated exceptions. Counsel should identify all applicable laws and deadlines.

When is Texas Attorney General reporting required?

For a qualifying breach involving at least 250 Texas residents, electronic reporting is due as soon as practicable and no later than 30 days after determination. Obtain legal advice promptly.

Does a package endorsement share every other limit?

Not necessarily. It can have its own limit or share one. Confirm its sublimits, retention, interruption coverage, and incident-response terms.

Does a filing exemption mean no insurance rules apply?

No. Commercial cybersecurity is exempt from specified filings, but other applicable statutes and rules remain. Read the proposed policy rather than inferring its coverage.

Where Argo fits

Bring current coverage, a description of the data and systems you use, and confirmed security-control information so Argo can compare cyber proposals and reporting requirements.

Request a business insurance quote to compare your options.

This is general information about insurance and is not legal advice. Statutory obligations depend on the facts of the incident, coverage varies by carrier and form, no premium figure here applies to any specific business, and the policy issued controls. Consult a Texas attorney on breach response obligations.