A cybersecurity risk assessment for a Dallas company runs 2 to 6 weeks, and an outside firm will charge roughly $2,800 to $25,500 for it. You get a rated list of risks, each with an owner and a fix. It’s also where our vCISO services in Dallas begin.
This guide is for Dallas owners, CFOs, and practice managers who’ve been asked for one and aren’t sure what they’re buying. The request tends to come from a cyber insurance renewal, a bank or health system you trade data with, or a defense prime’s supplier portal. Each of those wants a slightly different job. Whatever scope you agree to sets the price and the calendar. Uprite includes a free first review in our cybersecurity services in Dallas, and near the end we explain where that free review stops and paid work starts.
Expect a written inventory of your systems, data, and vendors, a rating for each risk, and a ranked fix list. A 50-person Dallas office should budget 2 to 4 weeks and 40 to 60 hours of assessor time, or roughly $5,600 to $12,700 at public market rates. Medical, financial, and defense suppliers need a written version. The scope item buyers miss most often is the list of vendors that hold their data.
What is a cybersecurity risk assessment?
A cybersecurity risk assessment looks at the systems, data, people, and outside vendors your company runs on, then rates what could go wrong with each one. Every risk gets a likelihood, an impact, an owner, and a planned fix. The finished product is a risk register, and it’s the document insurers and auditors ask to see.
Assessors borrow their method from NIST Special Publication 800-30, which breaks the job into preparing, conducting, communicating, and maintaining the assessment. Version 2.0 of the NIST Cybersecurity Framework files the same work under Risk Assessment, outcomes ID.RA-01 through ID.RA-10. That last one covers checking critical suppliers before you sign with them. In Dallas it turns out to matter a great deal, and the breach data further down shows why.
What’s in scope, and what changes the price?
Two Dallas firms can quote the same “risk assessment” and price jobs 3 times apart. Scope explains nearly all of that gap. These 6 factors move the hours, roughly in the order we see them matter.
| Scope factor | Lighter job | Heavier job |
|---|---|---|
| Headcount and devices | Under 25 users on company laptops | 100 or more users, plus personal phones that get company email |
| Locations | 1 office in Dallas or Plano | Several sites, a warehouse, or remote staff across Texas |
| Cloud tenants | One Microsoft 365 or Google Workspace tenant | 2 or more tenants left over from an acquisition |
| Vendors with access | A handful of SaaS apps | Payroll, billing, EHR, or loan software vendors plus an outside IT firm with admin rights |
| Regulated data | No patient, card, tax, or defense records | Patient charts, loan files, tax returns, or controlled defense information |
| Prior work | A current asset list and written policies | Nothing written down since the last IT person left |
Ask every bidder to note which level they priced for each row. A cheap quote often skips vendors and cloud tenants, and those are the 2 areas the Dallas breach filings argue for most. Penetration tests, phishing simulations, and a signed letter for a third party usually sit on separate lines, so check for them before you compare totals.
What do Dallas breach filings say about scope?
Texas businesses must tell the Attorney General about any breach touching 250 or more Texans, and the AG publishes them in a public breach notice list. Our copy of that list is dated November 9, 2026. From it we took every notice the AG posted between November 7, 2025 and November 6, 2026 for an organization headquartered in Dallas, Plano, Irving, Richardson, Frisco, Denton, and other cities in the Dallas-Plano-Irving metro division. Fort Worth and Arlington weren’t counted. That left 68 notices out of 276 notices from Texas-based organizations that year, about 1 in 4.
Social Security numbers showed up in 54 of the 68 notices. Medical information appeared in 41. Yet only 23 filers called themselves medical providers. The other medical records came from a landscaping company, a mechanical contractor, a commercial real estate firm, 2 law offices, 2 universities, and a county government, among others. Employers keep that kind of data in benefits files, injury claims, and leave paperwork, and they rarely think of it as medical data.
So the inventory step can’t stop at the records your industry is known for. A useful assessment searches HR shares, mailboxes, and scanned files for every kind of sensitive record, wherever it ended up.
Vendors deserve the same attention. The biggest notice on the Dallas list covered 354,289 Texans. It came from a Plano software vendor that serves banks and credit unions, and the people affected were customers of those banks, not of the vendor. Another notice came from a Prosper mortgage services firm reporting for the lenders it works with. If a vendor holds your customers’ data, it belongs in your assessment. ID.RA-10 exists for exactly this case.
Size is worth a look too. Half the notices covered fewer than about 3,540 Texans. Thirty-eight of the 68 involved fewer than 5,000 people, and 18 involved fewer than 1,000. Breaches under 250 Texans never reach the list, so small incidents are undercounted.
How long does a risk assessment take in Dallas?
A company of about 50 people should expect 2 to 4 weeks between the kickoff call and the readout. Assessor time runs 40 to 60 hours. Everything else on the calendar is waiting on interviews, admin exports, and vendor answers. Those figures are our planning estimates. No standard sets them.
| Week | What happens | What we need from you |
|---|---|---|
| Week 1 | Scope letter, kickoff call, document request | An org chart, an office list, a vendor list, and an admin contact |
| Weeks 1 to 2 | Interviews, account and device exports, a search for sensitive data | 30 to 60 minutes each with the owner, finance, and whoever runs IT |
| Week 3 | Threat and gap analysis, risk ratings | Quick answers to follow-up questions |
| Week 4 | Readout and edits | 1 hour with leadership, then sign-off on the fix list |
A company under 25 people with one office often wraps up in 1 to 2 weeks. Past 100 people, or with patient, loan, or defense data in scope, 4 to 6 weeks is realistic. Two delays show up again and again. An outside IT provider is slow to grant read access, or a software vendor can’t say where its backups live.
The clock that starts after a breach
Texas law gives a business 60 days after it determines a breach happened to notify the people affected. It gets 30 days to notify the Attorney General when 250 or more Texans are involved. Both deadlines are in Section 521.053 of the Business and Commerce Code. In the Dallas filings, the median gap between the discovery date a company reported and the day the AG posted its notice was 35 days. The middle half ran from 28 to 81 days.
Thirty days isn’t long to work out whose data sat on which system. A company with a current risk register already has that map. A company without one builds it in the middle of the incident, often with outside counsel billing by the hour. That’s the most practical reason we know to finish the assessment before you need it.
What does a cybersecurity risk assessment cost a Dallas company?
Cost tracks hours. We priced 3 company sizes with our hour estimates and 2 public rate sources. The first dollar column is what a Dallas employer pays for an hour of an in-house security analyst’s time. Column 2 shows what outside risk assessment specialists charge federal buyers.
| Company profile | Assessor hours | In-house cost (BLS, Dallas-Fort Worth) | Outside firm (GSA rates, middle 50%) |
|---|---|---|---|
| Fewer than 25 staff at a single office | 20 to 30 | $1,840 to $2,760 | $2,810 to $6,360 |
| 25 to 99 staff across 1 or 2 locations | 40 to 60 | $3,680 to $5,510 | $5,620 to $12,720 |
| 100 to 249 staff, multiple locations, or regulated records | 80 to 120 | $7,350 to $11,030 | $11,230 to $25,450 |
Our in-house number begins with the May 2025 wage survey from BLS, the Occupational Employment and Wage Statistics program. The Dallas-Fort Worth-Arlington metro had 7,080 information security analysts, with a mean wage of $64.32 an hour. Benefits and payroll taxes come next. The June 2026 Employer Costs for Employee Compensation release puts private-industry pay at $32.82 an hour in wages and $46.89 an hour all in, so total cost runs about 1.43 times the wage. Put together, an analyst hour costs a Dallas employer about $92. That’s roughly 6% above San Antonio, where the same job averages $60.49.
For outside rates we used GSA’s CALC labor rate data as of November 5, 2026. A search for risk assessment labor categories that need no security clearance found 59 rates across 21 contractors. Half of those rates sit between $140.38 and $212.07 an hour, and the median is $174.30. Those are ceiling rates for federal buyers, so a Dallas commercial quote can land above or below them.
Hours climb with each extra Microsoft 365 tenant, each vendor holding admin rights, and each regulation that needs its own mapping. They drop when you already keep an asset list and written policies. Year 2 usually costs less than year 1 because the inventory carries over. Our cybersecurity cost in Dallas breakdown covers what the fixes and monitoring that follow tend to run.
Which Dallas companies need a written risk assessment?
Plenty of companies order one because an insurer asked. These 4 groups have a rule behind the request. We’re an IT firm, not a law firm, so ask your attorney which ones reach your business.
Medical, dental, and home health practices
The HIPAA Security Rule at 45 CFR 164.308 requires every covered practice, large or small, to assess the risks to its electronic patient records accurately and thoroughly. HHS doesn’t mandate a format, but its risk analysis guidance spells out the elements an acceptable one includes. With 23 medical providers on the Dallas breach list in one year, this is the group we’d move first. Our healthcare IT services in Dallas page covers the day-to-day side.
Lenders, CPAs, tax preparers, and wealth firms
Under the FTC Safeguards Rule, 16 CFR 314.4 makes a written risk assessment the foundation of the security program. It must say how risks get rated, and the firm has to repeat it periodically. Section 314.6 lifts the written part for firms holding data on fewer than 5,000 consumers. You still have to do the assessment itself. Five financial services companies made the Dallas list this year. Our financial services cybersecurity guide for Dallas goes deeper.
Defense suppliers
If your Dallas shop touches covered defense information, the DFARS 252.204-7012 clause sends you to NIST SP 800-171, and its requirement 3.11.1 asks for risk to be assessed periodically. DFARS 252.204-7019 adds a time limit. The summary score you post in SPRS can’t be more than 3 years old when you bid. The Defense Department paused CMMC Phase 2 third-party assessments on July 13, 2026, but self-assessments and the 7012 clause still apply. Our CMMC compliance in Dallas page explains how to scope the systems involved.
Any Texas business with fewer than 250 employees
Senate Bill 2610 added Chapter 542 to the Business and Commerce Code on September 1, 2025. It shields a business from exemplary damages after a breach if a qualifying security program was in place when the breach happened. Each size tier has its own bar. A firm with fewer than 20 people needs password rules and staff training. At 20 to 99 people, the standard becomes CIS Controls Implementation Group 1. At 100 to 249, it’s a recognized framework like NIST CSF. Your best evidence is a dated assessment, and our Texas SB 2610 compliance guide walks through each tier.
Can a vulnerability scan or free tool replace it?
A vulnerability scan lists known weaknesses on your devices. A penetration test tries to exploit them. An assessment uses the results of both, then decides which problems would actually hurt your business. We compare the 2 tests in penetration testing vs vulnerability scanning.
Free help exists, and some of it’s good. CISA’s Cyber Hygiene services include free weekly scans of internet-facing systems for critical infrastructure organizations. The HHS Security Risk Assessment Tool is built for small medical offices. If you have fewer than 20 employees and no regulated data, our guide on how to conduct a cybersecurity risk assessment will get you to a usable first draft on your own.
What tools can’t do is tell you why a system matters. A scanner will flag an unpatched file server. It won’t know that server holds 6 years of employee benefits paperwork, which on the Dallas list is exactly the kind of record that ends up in a breach notice.
How does Uprite handle risk assessments in Dallas?
Our first step is a free security assessment. It checks endpoint protection, missing patches, and firewall and VPN firmware, and you get back a ranked list of risks. There’s no obligation to hire us afterward.
That free review isn’t a signed document a regulator, insurer, or prime contractor will accept. The formal version, with every risk rated, owned, and dated, is part of our vCISO work, and we quote it from the scope. To judge that kind of quote, see what a vCISO costs in Dallas. Smaller firms can start with our take on whether a Dallas small business needs a vCISO. Ongoing coverage after the assessment falls under our managed security services in Dallas.
What should you ask a Dallas risk assessment firm before you sign?
Get written answers to these 7 questions before you compare prices.
- Which framework will you map us to, and why that one?
- Did you price our vendors and every cloud tenant, or only the office network?
- How will you find medical, tax, and HR records outside the systems we name?
- Who does the work, for how many hours, and who steps in if that person leaves?
- What dates will you commit to, and what do you need from us to hold them?
- Is new scanning or testing included, or is it a separate line?
- If we switch providers, do we keep the report and the evidence behind it?
Questions 2 and 3 come straight from the Dallas filings above. Question 7 matters because the report is worth the most after a breach, and that’s also when provider relationships tend to end.
Questions Dallas owners ask about risk assessments
How many weeks should a Dallas company set aside?
Usually 2 to 4 weeks for a company of about 50 people, with 40 to 60 hours of assessor time. A small single-office firm can finish in 1 to 2 weeks. Larger or regulated companies should plan on 4 to 6.
What does one cost for a mid-sized Dallas company?
A company with 25 to 99 employees usually lands near $5,600 to $12,700 at public market rates. Across all sizes the range is about $2,800 to $25,500. Uprite’s first security assessment is free.
Do our vendors need to be part of it?
Yes, any vendor that stores your data or has a login to your systems belongs in it. The largest Dallas-area breach notice in the past year came from a software vendor, and the Texans affected were its clients’ customers.
Is a risk assessment required by Texas law?
Not as a standalone rule for most private companies. Chapter 542 does reward a documented program after a breach, and HIPAA, the FTC Safeguards Rule, and DFARS require an assessment from medical, financial, and defense businesses.
How often should we repeat it?
Once a year suits most companies. Repeat it sooner after a breach, an acquisition, a new core system, or losing the person who ran IT. Later rounds go faster because the inventory already exists.
What happens after the assessment?
You work the fix list from the top. Some items are quick setting changes, and others need new tools or a budget line. Many Dallas companies hand the list to a vCISO or a managed security provider who tracks it every quarter.
Tell us your headcount, your offices, and any compliance rules you follow. Our Dallas team will run a free security assessment and send back a ranked fix list. Hiring us afterward is up to you.
Book your free Dallas assessment
