Most Dallas small businesses don’t need a vCISO until someone outside the company asks them to sign for their security. That request usually comes from HIPAA, the FTC Safeguards Rule, a CMMC contract, an insurer, or a large customer.
I run Uprite, and we sell that kind of part-time security leadership as part of our vCISO services in Dallas. So read this with my bias in mind. Still, plenty of small companies in the Dallas area can go without a vCISO, and I’d rather say so plainly than sell a retainer nobody uses.
Census counts 158,493 employer locations in the Dallas-Fort Worth metro with fewer than 20 people. Texas expects password policies and staff training from them, and an IT provider can usually handle that. That changes when you hold patient files, tax returns, loan files, or defense data. It also changes when an insurer or a big customer wants your program in writing and wants a person to sign it. That person is the real reason to hire a vCISO.
What does a vCISO do that your IT provider doesn’t?
vCISO stands for virtual chief information security officer. You hire a senior security person for part of a month instead of a full salary. The vCISO decides which risks the owners accept and writes the security program. They also stand behind the answers your company gives to regulators, insurers, and customers.
Here’s how that splits in practice. Take a 35-person insurance agency in Richardson. Its IT provider patches laptops, runs backups, and turns on multi-factor login. Then a carrier sends a renewal application with 40 questions, and one asks whether the agency tests restores every quarter. Somebody has to know the true answer and sign the form. If nobody at the agency can do that, a vCISO is useful. If the office manager can, you probably don’t need one yet.
How many Dallas businesses are small enough to skip one?
Most of them. Census publishes employer location counts by size class in its County Business Patterns data. Its 2023 release shows 189,739 locations in the Dallas-Fort Worth-Arlington metro. That covers Dallas, Collin, Denton, Tarrant, and the counties around them. We matched each size band to the tier it falls under in Texas law.
| Employees at the location | DFW metro locations | Share | What Texas chapter 542 asks for |
|---|---|---|---|
| Fewer than 20 | 158,493 | 83.5% | Password policies and employee cybersecurity training |
| 20 to 99 | 25,585 | 13.5% | CIS Controls Implementation Group 1 and other moderate steps |
| 100 to 249 | 3,831 | 2.0% | Alignment with a recognized security framework |
| 250 or more | 1,830 | 1.0% | Outside the safe harbor entirely |
Senate Bill 2610 set up these tiers, and it took effect on September 1, 2025. It applies to businesses with fewer than 250 employees. If your program met your tier when a breach happened, the law bars exemplary damages in a lawsuit over that breach. The middle tier points to CIS Implementation Group 1, a set of 56 basic safeguards. A 60-person firm has to show those were in place, and that takes dated records.
One caution about the numbers. Census counts locations, not companies. A 7-person branch of a national bank sits in the top row next to a 7-person dental office. Only one of them has a security team at headquarters. The dental office has its own HIPAA duties and probably nobody assigned to them.
The signature test
Headcount is a weak signal on its own. A better question is whether anyone outside your company needs a named person to vouch for your security. If the answer is yes, you need someone who can check the facts before signing, at any size.
The table lists the documents we see most often in the Dallas area. We took the location counts from the same Census release.
| Document | Who has to stand behind it | Small-firm exception? | DFW locations in the group |
|---|---|---|---|
| HIPAA security official designation | A named official at each covered practice | None | 4,077 dental offices and 6,620 physicians’ offices |
| FTC Safeguards Rule program | A Qualified Individual | Under 5,000 consumers, some documents drop but the Qualified Individual stays | 3,263 accounting and tax offices, 231 mortgage brokers, 381 new car dealers |
| CMMC affirmation in SPRS | A senior company official, every year | None | Every DoD supplier with a CMMC clause |
| Cyber insurance application | An officer who signs the answers | None | Any company buying a policy |
| Customer security questionnaire | Whoever your contract names | Set by the customer | Suppliers to larger companies |
Medical and dental practices
HIPAA’s 45 CFR 164.308 requires each covered provider to name a security official, whatever its size. In the Dallas metro, 3,907 of the 4,077 dental locations have fewer than 20 people. So do 5,986 of the 6,620 physicians’ offices. In most of those offices the official is the practice manager, who also runs payroll and the front desk. That can work. The weak spot is review. In a small office, nobody may be checking the manager’s risk analysis. Our page on healthcare IT services in Dallas covers the systems side.
CPA offices, mortgage brokers, and car dealers
The FTC treats more businesses as financial institutions than most owners expect. Its definition in 16 CFR 314.2 names tax preparers, mortgage brokers, and dealerships that lease cars. Each one needs a Qualified Individual under 16 CFR 314.4. The small-firm rule in 16 CFR 314.6 helps firms holding information on under 5,000 consumers. Those firms don’t have to produce a written risk assessment, run the required testing, write an incident response plan, or send a yearly report to the board. They still have to name the person.
Dealers are the odd group here. Of the 381 new car dealer locations in the metro, 277 have 20 or more employees. A dealership with finance and insurance staff on Interstate 35 or LBJ is a bigger security job than a 4-person tax office. CPA firms sit at the other end. 3,074 of the 3,263 accounting locations have fewer than 20 people, and most of them can meet the rule with a partner as the named person plus a written plan. Our guide to a WISP for Dallas CPA firms walks through that plan.
Defense suppliers
Lockheed Martin builds the F-35 in Fort Worth, and small machine shops and engineering firms across the metro sit in that supply chain. Since November 10, 2025, DoD contracts can carry the CMMC clause. Under 32 CFR 170.22, a senior official affirms compliance in SPRS after each assessment and once a year after that. It’s filed with the federal government under that person’s name. We’d want that official to see the evidence, not take a verbal yes from the IT vendor. Our CMMC compliance page for Dallas explains the levels.
Insurers and big customers
No law makes a cyber insurance application a security document. It becomes one when you sign it. The carrier asks about multi-factor login, backups, and email filtering, and an officer of your company attests to the answers. If a claim comes in and an answer turns out to be wrong, the claim is at risk. Our cyber insurance renewal checklist for DFW lists the questions carriers are asking this year.
Customer questionnaires work the same way, just with a contract instead of a policy. A supplier to a large Plano or Irving company might get a 200-row spreadsheet before a renewal. Someone has to answer it honestly. If your answers are guesses, a few hours of vCISO time on that one document is cheaper than losing the contract.
Could you just hire a security person instead?
You could try. BLS data shows 7,080 information security analysts in the Dallas-Fort Worth metro as of May 2025, with mean pay of $133,790. There are 29,416 employer locations in the 20 to 249 range. That’s about 4 locations for each analyst in the whole metro. Banks, hospital systems, and airline and telecom headquarters hire from the same pool.
An analyst also isn’t an executive. An analyst runs tools and reviews alerts. The person who signs a CMMC affirmation or an insurance application usually sits higher. According to the BLS, IT and information systems managers in DFW earn a mean of $185,720. For a 50-person firm, that’s a full salary for work that rarely fills a full week. Our vCISO cost guide for Dallas shows what part-time hours run instead.
What do DFW breach filings tell us?
Any breach that affects 250 or more Texans goes on a public list kept by the Texas Attorney General. We pulled the public breach list on November 13, 2026. It had 92 notices from organizations based in DFW-area cities, posted between April 1, 2025, and November 10, 2026. Seventy came from the Dallas side of the metro.
Health care providers filed 29 of the 92. The rest included retailers, law firms, school districts, a landscaping company, an engineering firm, and 2 insurance agencies. Half the notices covered more than 2,987 Texans, and 24 notices covered fewer than 1,000. These aren’t only big hospital breaches. A lot of them are small organizations with ordinary client lists.
The dates are the part we’d look at first. 80 notices list both a start date and a discovery date. In 38 of them, more than 90 days passed before the organization found the breach. Half took longer than 77 days. The filers report those dates themselves, so treat them as rough. Under Texas Business and Commerce Code section 521.053, you have 30 days after you determine a breach happened to notify the Attorney General if 250 or more Texans are affected. Finding breaches sooner is mostly a monitoring job for your IT or security provider. Deciding in advance who makes the call, who counts the affected Texans, and who files is a leadership job.
Three of the notices came from hospice offices in Dallas, Richardson, and Hurst that share the same breach start date. That pattern usually means one incident at a parent company or a shared system. A small business can end up in the same position through a shared vendor. Someone at your company should know which vendors hold your client data and what your contracts say they owe you after a breach.
When can a Dallas company skip the vCISO?
We tell owners they can skip it for now when all of these are true.
- You have fewer than 20 employees.
- You don’t hold patient records, tax returns, loan files, or defense data.
- No insurer, lender, or customer has asked you to sign a security answer.
- Your IT provider can show you dated proof of multi-factor login, tested restores, and patching.
If that’s you, start with free material. NIST’s Small Business Quick-Start Guide is short enough for an owner to read in an afternoon. CISA offers free Cyber Hygiene vulnerability scanning to critical infrastructure organizations, and health care counts. It runs nonstop against your internet-facing addresses and sends a report every week. UTSA also runs a statewide small business cybersecurity center with free advising hours. Call first to confirm it’s still taking new companies.
What should you buy at each stage?
Find the row closest to your situation. If 2 rows fit, use the lower one.
| Your situation | What we’d start with |
|---|---|
| Fewer than 20 staff, no sensitive records, and no outside requests | Keep your current IT provider and work through NIST’s quick-start guide |
| Under 20 people with patient, tax, or loan data | A named internal owner and an outside risk assessment once a year |
| An insurance renewal or customer questionnaire you can’t answer | A short vCISO project on that one document |
| 20 to 99 people | A monthly vCISO retainer built around CIS Implementation Group 1 |
| 100 to 249 people, or a CMMC Level 2 contract | An ongoing vCISO plus managed security monitoring |
| 250 or more people with monthly audits | Price a full-time CISO against a vCISO |
This is our own rule of thumb, not a regulation. A company with 15 staff that’s close to landing its first big corporate customer should move down a row. For what these options cost locally, see our breakdown of cybersecurity costs in Dallas.
Next steps for Dallas owners
If one of the bottom 3 rows describes you, our managed security services in Dallas run the monitoring and tools a vCISO will ask about. Dental practices can start with our Dallas dental IT support page. If you’re in the top row, keep this page and come back when you hire employee number 20 or get your first security questionnaire.
Questions Dallas owners bring to the first call
Can my managed IT provider be my vCISO?
Sometimes, if it has a security lead who isn’t also the person fixing your printers. Ask for a sample written program and the name of whoever signs it. Then ask what happens when their own work is the thing that failed, because a vCISO should be able to tell you the truth about your provider.
We’re a 12-person CPA office in Plano. Is the FTC small-firm exemption enough?
It covers the paperwork, not the person. Under 5,000 consumers you can skip 4 documents, but you still need a Qualified Individual and a written program. Most offices that size name a partner and get outside help once a year.
Who should sign our cyber insurance application?
An officer who has seen proof of each answer. If the form asks about multi-factor login on email and remote access, someone should check both before signing.
Does the vCISO need to be based in Dallas?
Not for most of the work, since policies, questionnaires, and vendor reviews happen online. Local helps for an on-site tabletop exercise or a board meeting. It also helps when a Dallas customer or insurer wants to meet the person behind the answers.
What should we have after 90 days with a vCISO?
Expect a written risk assessment, fixes sorted by cost and by how much risk each removes, a program the owners have signed, and an incident plan that names who calls whom in the first hour. You should also have a short list of the vendors that hold your sensitive data, with what each contract says about breaches. If what you get is a thick template with your logo on it and nothing specific to your systems, push back.
How big do we have to be before a full-time CISO pays off?
Past roughly 250 employees, or once audits and customer reviews arrive every month. IT managers in DFW average $185,720 a year, according to the BLS, and a CISO usually earns more than that. Below that size, part-time leadership is normally the better use of the money.
Tell us which row of the table fits your company. We’ll give you a straight answer on whether a vCISO fits your Dallas business, and if it doesn’t, we’ll say so and point you to the free options.
Speak to a vCISO
