A cybersecurity risk assessment in San Antonio usually takes 2 to 6 weeks and costs about $2,800 to $25,500 from an outside firm, and it ends with a ranked list of risks and fixes. We use the same review to start our vCISO services in San Antonio.
We wrote this for owners and office managers who have been told to get one. Sometimes the request comes from an insurer. Sometimes it comes from a prime contractor at Joint Base San Antonio, or from a hospital that shares patient data with you. Scope changes with the reason, and so do the calendar and the price. Uprite runs a free security assessment as part of our cybersecurity services in San Antonio. We explain where that free review stops near the end of the post.
You get a written list of what you have, what could go wrong with it, and what to fix first. For a 50-person company, plan on 2 to 4 weeks. Outside firms spend 20 to 120 hours on the work. At public labor rates that comes to about $2,800 to $25,500. Defense suppliers, medical offices, and tax or lending firms need a written version. Texas law also rewards companies that can show a dated one.
What does a cybersecurity risk assessment cover?
A cybersecurity risk assessment is a review of the systems, data, and vendors a company depends on. For each one it asks what could go wrong, how likely that is, and how much it would hurt. The result is a risk register. Each risk gets a rating, an owner, and a fix.
NIST supplies the method. NIST Special Publication 800-30 splits the work into 4 steps. You prepare, you run the assessment, you share the results, and you keep them current. NIST’s Cybersecurity Framework 2.0 puts the same work in its Risk Assessment category. That category runs from ID.RA-01, logging the weak spots in your assets, to ID.RA-10, vetting key suppliers before you buy.
Scope is where quotes differ the most. Two firms can both say “risk assessment” and price very different jobs. This table shows what’s normally included and what often shows up as a separate line.
| Area | Usually in scope | Often quoted separately |
|---|---|---|
| People and process | Interviews with the owner, office manager, and IT contact, plus a review of written policies | Phishing tests and staff training |
| Systems and accounts | Laptops, servers, Microsoft 365 or Google Workspace, line-of-business apps | A full device-by-device configuration audit |
| Data | Where Social Security numbers, patient records, card data, or defense files live | Data discovery software that crawls every share |
| Vendors | The outside companies that hold your data or can log in to your systems | Security questionnaires sent to each vendor |
| Technical testing | Results from scans you already run | New vulnerability scans and penetration tests |
| Reporting | Risk register, ranked fix list, short summary for leadership | A signed letter for a regulator, insurer, or prime contractor |
Ask each firm to mark these rows yes or no in writing. That one page makes 3 quotes comparable.
How long does a cybersecurity risk assessment take in San Antonio?
Plan on 2 to 4 weeks from kickoff to the final meeting for a company with about 50 employees. The hands-on work is 40 to 60 hours. Everything else is waiting for interviews, exports, and answers from vendors. These are our planning figures. No standard sets them.
| Phase | Calendar time for about 50 people | What you provide | What comes back |
|---|---|---|---|
| Scoping call and kickoff | 2 to 3 days | Headcount, locations, the rules you answer to, an IT contact | A scope letter and a document request list |
| Data collection | 1 to 2 weeks | Interviews, admin access or exports, current policies, vendor list | An asset and data inventory |
| Analysis and rating | About 1 week | Answers to follow-up questions | Threats, control gaps, and a rated risk register |
| Readout | 1 meeting, then 2 to 3 days for edits | Time with the owner or leadership team | A ranked fix list, a summary, and a date for the next review |
Smaller and larger companies move on different clocks. Under 25 people with one office, 1 to 2 weeks is normal. From 100 to 249 people, or with defense or patient data in scope, plan on 4 to 6 weeks.
We see the same delays again and again. An outside IT provider takes a week to grant read access. A practice management or ERP vendor is slow to say where it stores backups. The person who knows the network is on vacation. For defense work, deciding which systems touch controlled files can take longer than the assessment itself. You can cut a week by sending the vendor list and admin contacts before the kickoff call.
How current does the assessment need to be?
Dates matter after the report too. Each rule that asks for a risk assessment has its own clock. A report from 2023 may not count for a 2026 contract bid or a 2026 breach claim.
| Rule or situation | How current it must be | Who it applies to |
|---|---|---|
| DFARS 252.204-7019 | The NIST SP 800-171 assessment score in SPRS can be no more than 3 years old, or less if the solicitation says so | Defense contractors and subcontractors that handle covered defense information |
| FTC Safeguards Rule, 16 CFR 314.4(b)(2) | Additional risk assessments are required periodically | Tax preparers, CPA firms, mortgage brokers, auto dealers that arrange financing |
| HIPAA Security Rule | No fixed interval. HHS treats risk analysis as an ongoing process | Medical and dental practices and their business associates |
| Texas Business and Commerce Code Chapter 542 | The program has to be in place at the time of the breach | Texas businesses with fewer than 250 employees that hold sensitive personal data |
The DFARS clock is the strictest one in the table, and it’s the one we get asked about most in San Antonio. DFARS 252.204-7019 says an offeror needs a current assessment to be considered for award. Current means no more than 3 years old. The score in the federal Supplier Performance Risk System isn’t the same thing as a risk assessment. But requirement 3.11.1 of NIST SP 800-171 asks you to assess risk periodically, so the two are usually done together.
A note on CMMC. On July 13, 2026, the Pentagon paused the Phase 2 third-party assessment schedule. Self-assessments under Phase 1 and the DFARS 7012 requirements didn’t stop. Our CMMC scoping guide for San Antonio covers which systems count.
What do San Antonio breach filings say about scope?
Texas requires a notice to the Attorney General when a breach affects 250 or more Texans. That office publishes the notices in its data security breach report. We pulled the list on November 9, 2026. We kept the 25 filings posted from November 7, 2025 to November 6, 2026 by organizations based in San Antonio and nearby cities, including New Braunfels, Converse, Floresville, and Windcrest.
Medical information appeared in 17 of the 25. So did health insurance information. Social Security numbers appeared in 16, and driver’s license numbers in 13. Only 9 filers were healthcare providers. The rest included law offices, 2 school districts, a health plan, a bank, and a county government. Several of the non-medical filers still lost medical records.
That has a direct effect on scope. A law office or an employer may hold medical records from claims, leave requests, or benefits files. If the assessment only looks for the data your industry is known for, it can miss what actually gets taken. The inventory step should search for every kind of sensitive record, in every system.
Vendors belong in scope too. Four dental practices in the San Antonio area filed notices with the same discovery date in May 2026, and the AG posted all four on the same day. The filings don’t name a cause. A shared date like that often points to a common vendor or management company. That’s the case ID.RA-10 is meant to cover.
The breaches were not small, and they were not huge either. Median size was 3,394 Texans. Fifteen of the 25 affected fewer than 5,000. The list leaves out breaches under 250 Texans, so the real count is higher.
How much does a cybersecurity risk assessment cost in San Antonio?
Price follows hours. We priced 3 company sizes using our own hour estimates and 2 public rate sources. Our first dollar column is an employer’s cost for a San Antonio security analyst. Column 2 uses the rates outside risk assessment specialists charge the federal government.
| Company profile | Planning hours | Labor floor (BLS, San Antonio) | Market range (GSA, middle half) |
|---|---|---|---|
| Under 25 employees, 1 office | 20 to 30 | $1,730 to $2,590 | $2,810 to $6,360 |
| 25 to 99 employees, 1 or 2 sites | 40 to 60 | $3,460 to $5,190 | $5,620 to $12,720 |
| 100 to 249 employees, several sites, or defense or patient data | 80 to 120 | $6,910 to $10,370 | $11,230 to $25,450 |
Here is the floor math. BLS Occupational Employment and Wage Statistics for May 2025 count 1,350 information security analysts in the San Antonio-New Braunfels metro. Their mean wage is $60.49 an hour. BLS Employer Costs for Employee Compensation for June 2026 show private employers paying $46.89 in total compensation for every $32.82 in wages. That’s a ratio of 1.43. So one analyst hour costs an employer about $86.
Our market range comes from GSA’s CALC labor rate data, pulled November 5, 2026. Risk assessment titles with no clearance requirement returned 59 rates from 21 vendors. The median was $174.30 an hour, and the middle half ran from $140.38 to $212.07. These are ceiling prices for federal buyers. Commercial quotes in San Antonio can land above or below them.
A few things push a quote up. More people and more locations mean more accounts and devices to review. Acquisitions add hours when they leave you with a second Microsoft 365 tenant. Defense files, patient data, and tax records add a compliance mapping step. New scanning adds technical hours. A signed letter for a third party adds review time. Good records cut hours. A current asset list and written policies shorten interviews, and year 2 usually costs less than year 1.
Which San Antonio companies need a written risk assessment?
Many companies get one because an insurer or customer asks. Four groups have a rule behind the request. Uprite isn’t a law firm, so check with counsel on how each one applies to you.
Defense contractors and subcontractors
San Antonio has a large defense supply chain around Joint Base San Antonio. Companies that handle covered defense information work under DFARS 252.204-7012, which points to NIST SP 800-171. Requirement 3.11.1 asks for a periodic assessment of risk to operations, assets, and people from the systems that hold that information. Your scored self-assessment also has to stay inside the 3-year window above.
Medical and dental practices
45 CFR 164.308 requires an accurate and thorough assessment of the risks to electronic protected health information. HHS doesn’t prescribe a format. Its risk analysis guidance lists what any method must cover. We go through the local details in HIPAA cybersecurity requirements in San Antonio.
Tax, accounting, and lending firms
The FTC Safeguards Rule at 16 CFR 314.4 bases the whole security program on a risk assessment. It has to be written and has to include criteria for rating risks. Section 314.6 drops the written requirement for firms with customer information on fewer than 5,000 consumers. The assessment itself still has to happen.
Any Texas business under 250 employees
Chapter 542 of the Business and Commerce Code came from Senate Bill 2610, in effect since September 1, 2025. It bars exemplary damages after a breach if the business can show it had a qualifying security program in place at the time. Under 20 employees, the bar is password policies and staff training. From 20 to 99, it includes CIS Controls Implementation Group 1. From 100 to 249, the program has to conform to a recognized framework such as the NIST Cybersecurity Framework. A dated assessment is the easiest way to show where you stood and when. Our Texas SB 2610 compliance guide covers each tier.
Is a vulnerability scan or a free tool enough?
A scan finds known weak spots on your systems. A penetration test tries to use them. A risk assessment takes both as inputs and decides which problems matter most to your business. We compare the first two in penetration testing vs vulnerability scanning.
Some free help is worth using. CISA offers Cyber Hygiene services at no cost to critical infrastructure organizations, including weekly scans of public IP addresses. Small medical offices can use the HHS Security Risk Assessment Tool. A company under 20 people with no regulated data can follow our guide on how to conduct a cybersecurity risk assessment and get a usable first pass.
The tools don’t know your business. Scanners can flag an old server. They can’t tell you that the server holds 3 years of payroll files and backs up to a contractor’s laptop. Someone has to ask those questions and write down the answers. If no one inside your company has time for that, read whether a small San Antonio business needs a vCISO and how a vCISO differs from a vCIO.
How does Uprite run a cybersecurity risk assessment in San Antonio?
We start with a free security assessment. We look at your environment, find what’s exposed, and give you a list of risks in priority order. You don’t have to hire us afterward.
The free review isn’t a signed document for a regulator, insurer, or prime contractor. That formal version, with each risk rated, owned, and dated, is part of our vCISO work. We price it by scope. Our breakdown of what a vCISO costs in San Antonio shows how to check that kind of quote. The tools and monitoring that often follow are priced in cybersecurity cost in San Antonio, and ongoing coverage falls under our managed security services in San Antonio.
What should a San Antonio risk assessment proposal include?
Before you sign, check that the proposal answers these 7 points in writing.
- The framework it follows, such as NIST CSF 2.0, CIS Controls IG1, NIST SP 800-171, or the HHS elements.
- The hours, the person doing the work, and who covers if that person leaves.
- A start date, a readout date, and what you have to deliver for those dates to hold.
- Whether new scanning is included or priced on its own line.
- A sample risk register and fix list from a past job, with names removed.
- Who signs the report, and whether a prime contractor or insurer will accept that signature.
- Who keeps the report and the evidence if you change providers.
Points 3 and 7 are the ones buyers skip. A missed readout date can push you past a bid deadline. A report that lives only in a provider’s portal can be gone when the contract ends, and that’s the moment a court or an insurer may ask for it. If you’re also choosing an ongoing security lead, our ranking of the best vCISO providers in San Antonio scores five local firms.
Risk assessment questions San Antonio companies ask
How long does a cybersecurity risk assessment take for a 50-person company?
Plan on 2 to 4 weeks from kickoff to readout. The hands-on work is 40 to 60 hours. Most of the calendar time goes to interviews, admin access, and answers from software vendors, so sending your vendor list early saves time.
What does a risk assessment cost in San Antonio?
About $2,800 to $25,500 at public labor rates, depending on size. For 25 to 99 people with 1 or 2 sites, expect about $5,600 to $12,700 for 40 to 60 hours. Uprite’s first security assessment is free.
We’re a defense subcontractor. How old can our assessment be?
Under DFARS 252.204-7019, the NIST SP 800-171 assessment score you post in SPRS can be no more than 3 years old. Some solicitations set a shorter window. The CMMC Phase 2 pause in July 2026 didn’t change this rule.
Does a small medical or dental office need one?
Yes. HIPAA requires every covered practice to assess the risks to its electronic patient records, whatever its size. HHS offers a free Security Risk Assessment Tool that suits a small office.
How often should we redo it?
Once a year works for most companies. Redo it sooner after a breach, a merger, a new core system, or the loss of the person who ran IT. Follow-up reviews are faster because the inventory already exists.
Is a penetration test the same thing?
No. A penetration test shows whether someone can break into specific systems. The risk assessment covers the whole business and uses test results as one input. If you’ve never done either, start with the assessment.
Send us your headcount, your locations, and the rules you answer to. We will run a free security assessment for your San Antonio company and give you a ranked list of what to fix first, whether you hire us or not.
Request a free risk assessment
