A Houston business with fewer than 20 employees and no regulated data usually doesn’t need a vCISO every month. At 20 employees, or once a customer, insurer, or regulator wants a named person who owns security, it usually does.
Census data puts 136,371 employer locations in the Houston metro under 20 people and 24,281 in the 20 to 249 range, which is where the pressure starts. We sell vCISO services in Houston to that range. If you’re one of the 136,371, keep your money.
Under 20 employees, Texas only asks for simplified measures, and a free program or a few hours of advice often covers it. A vCISO starts to pay off at 20 or more employees, with regulated customer data, when a customer or insurer wants your security program on paper, or when nobody on staff can say who makes the call in the first hour of a breach. The 5 questions near the end sort you out.
What does a vCISO do for a small company?
A vCISO is a virtual chief information security officer, an outside executive hired for a few hours a month. Think of the owner of a 60-person distribution company who needs someone to accept or reject a risk like an unsupported server, sign off on the written security program, decide which vendors get into client files, and explain all of it to the owners every quarter. Those are decisions an IT provider shouldn’t make alone.
None of that is technical work. A vCISO won’t patch a server or reset a password, which is why the role goes on top of a managed IT provider and doesn’t replace one. Some buyers expect otherwise, sign a retainer, and discover that nobody is managing the firewalls, which is a bad week to learn it. What it costs is a separate question, and our guide to vCISO cost in Houston answers it. I’m only asking here whether you need one at all.
How many Houston businesses are small enough to skip one?
County Business Patterns is the Census Bureau’s 2023 count of employer locations by headcount, and it lists 162,045 locations across the 10 counties of the Houston metro. That runs from Harris and Fort Bend out to Waller and San Jacinto. The table below sets each size class against the tier it falls under in Texas SB 2610.
| Employees at the location | Houston metro locations | Share | What Texas chapter 542 asks for |
|---|---|---|---|
| Fewer than 20 | 136,371 | 84.2% | Simplified measures, such as password policies and employee training |
| 20 to 99 | 21,091 | 13.0% | Moderate measures, including CIS Controls Implementation Group 1 |
| 100 to 249 | 3,190 | 2.0% | A program that conforms to a recognized framework |
| 250 or more | 1,393 | 0.9% | No safe harbor under chapter 542 |
Locations aren’t companies. A 12-person branch of a 400-person firm lands in the smallest row, and its parent has a bigger problem than the table suggests. A 9-person medical billing office sits in the 84% and answers to HIPAA anyway.
The Bureau of Labor Statistics counted 2,110 information security analysts in the metro in its May 2025 wage data for Houston. Even if every one of them worked for a company in the 20 to 249 range, that’s 11.5 locations per analyst, and it’s the best case, since plenty of those analysts work for much larger employers. A 60-person firm posting a full-time security job competes with them for the same few people, so renting a slice of one is the realistic move.
Which 5 situations mean a Houston company needs a vCISO?
Any one of these is enough to start the conversation, and if 2 show up in the same year you’re already late. That cutoff is our own rule of thumb and not a standard.
| Situation | What it looks like in Houston | Why it calls for a vCISO |
|---|---|---|
| You hire employee number 20 | A growing engineering, accounting, or distribution firm crosses the line in chapter 542 | CIS Controls IG1 has 56 safeguards, and somebody has to put them in place and date the records |
| You hold regulated data | Tax and accounting files, patient charts, mortgage or dealership records | The FTC Safeguards Rule and HIPAA each ask for a named person |
| A customer or insurer wants your program in writing | A vendor questionnaire, a contract exhibit, or a cyber insurance renewal | Someone with authority has to answer and sign |
| Nobody owns the security decisions | Your IT provider runs the tools, but no one decides which risks the company accepts | Choices about risk belong to a business leader, not to a help desk |
| A breach or audit is close | Ransomware last quarter, a regulator letter, or a lender review | Texas gives you 30 days to report once you determine a breach occurred |
Start with regulated data. The FTC’s 16 CFR 314.6 lets a business holding customer information on fewer than 5,000 consumers skip the written risk assessment, the testing, the incident response plan, and the annual report. A small bookkeeping office may qualify. A payroll or tax shop with 8,000 clients can’t. HIPAA has no size exemption at all, since 45 CFR 164.308 tells every covered entity and business associate to assign a security official, whether it’s a small clinic or a large one.
The breach row has a deadline. Section 521.053 of the Business and Commerce Code requires a report to the Attorney General when a breach involves at least 250 Texas residents, as soon as practicable and no later than the 30th day after you determine it happened. Whether you’re past 250 is a call somebody has to make in hour one with the facts half known, so pick that person before the breach, not during it.
The first row is SB 2610, in effect since September 1, 2025. A Texas business under 250 employees that had a qualifying program in place when it was breached can’t be hit with exemplary damages, and the program has to fit its headcount tier. CIS describes Implementation Group 1 as essential cyber hygiene. Picture a 35-person engineering firm in the Energy Corridor where the office manager does IT between invoices, and then ask who documents 56 safeguards and dates every record.
When can a small Houston company skip the vCISO?
Plenty of them can. If all 4 of these describe you, a vCISO would cost more than it returns right now.
- You have fewer than 20 employees.
- You don’t hold data covered by the FTC Safeguards Rule, HIPAA, or a similar named rule.
- No customer, lender, or insurer has asked for your security program in writing.
- Your IT provider already enforces multi-factor authentication, tested backups, and patching, and can show you the records.
We sell this service, and I’d still tell a 14-person company in that position to put the money into getting the basics done properly. A retainer would mostly pay for a recurring meeting.
Start with the free material. NIST published a Small Business Quick-Start Guide for CSF 2.0 that a non-specialist can follow. UTSA’s Texas Small Business Cybersecurity Assistance Center launched in November 2024 on a 2-year, $1 million SBA grant and gives Texas small businesses up to 40 hours of vCISO help at no cost, with the University of Houston’s small business development center as a partner. Two years from late 2024 isn’t far off, so call and confirm it’s still enrolling before you plan around it.
It cuts the other way at the top. Past 250 employees chapter 542 gives no safe harbor, and your customer contracts and insurer set the bar. A company that already has a full-time CISO needs a vCISO only to cover a vacancy or a specific project.
Who owns what, the vCISO or the managed IT provider?
Say your IT provider runs multi-factor authentication, patching, and backups, and a customer asks whether your security program is written down. The provider can supply evidence, but it can’t accept a risk on your behalf, and the table splits the jobs along that line.
| Job | vCISO | Managed IT or security provider |
|---|---|---|
| Write and own the security program | Owns it | Supplies technical facts |
| Run multi-factor authentication, patching, and backups | Checks that it’s done | Does the work |
| Watch alerts and respond overnight | Sets the escalation rules | Does the work, if you buy managed security |
| Answer customer and insurer questionnaires | Owns the answers | Provides evidence |
| Report to owners or the board | Writes and presents it | Provides the data |
| Accept a risk the company will live with | Recommends | Not its decision |
We run managed security services in Houston, and our vCISO works on top of that stack, so the person writing your program and the analysts watching your alerts share 1 set of records. You can buy a vCISO without us. Just know the work is only as good as the evidence your IT provider hands over.
What’s a 5-question test for your company?
Count your own answers this week, and be honest on the last 2.
- Do you have 20 or more employees, counting part-timers?
- Do you store data covered by a named rule, like consumer financial records or patient records?
- In the past 12 months, has a customer, lender, or insurer asked to see your written security program?
- Is there nobody on staff who could say, in the first hour of a breach, whether Texas residents must be notified?
- Would you struggle to hand an investigator dated records of your last risk review and your last staff training?
Give yourself a point per yes. On 0 or 1, stay with your IT provider and the free resources above. On 2 or 3, buy a project, meaning a first risk assessment and a written program, or a small block of advisory hours. On 4 or 5, start a monthly retainer. It’s a rough screen and not an audit, and I’d expect it to misjudge a few companies in each direction.
Where should you go from here?
If you scored 2 or higher, our vCISO cost in Houston guide shows what the hours run in this metro, and our ranking of vCISO providers in Houston compares 7 firms with Houston offices, Uprite included, with the re-scores where we lose. If you scored lower, work through our cybersecurity checklist for Houston small businesses and retake the test when you hire employee number 20.
Questions Houston owners ask before hiring a vCISO
Do I need a vCISO if I already have an IT provider?
Not necessarily. If your provider already writes the security program, makes the risk calls, and answers your customers’ questionnaires, you already have what a vCISO would give you. Few small providers do all 3, and a provider that only runs the tools is doing half the job.
We have 12 employees. Are we too small?
Probably, unless you hold regulated data. Texas wants simplified measures at that size, mostly password policies and staff training, and the free UTSA program, if it’s still enrolling, can cover a good part of that without hiring anyone.
Does a customer’s security questionnaire mean we need one?
No, a single one doesn’t, but a pattern does. One form gets answered with your IT provider’s help and an afternoon. A run of them in a year, or one that asks for a written program, a named owner, and an incident response plan you don’t have, is a different situation, and the answers need somebody with authority behind them. That somebody doesn’t have to be full time.
Can a vCISO keep us out of a lawsuit after a breach?
Not entirely, because nothing prevents every breach or every suit. What SB 2610 offers is narrower. If a Texas business under 250 employees had a documented program in place when the breach happened, exemplary damages are off the table, though compensatory damages aren’t. Dated records are what prove it, so a program that exists only in someone’s head earns nothing.
Is the free Texas program worth using first?
Yes, if you qualify and it’s still enrolling. Up to 40 hours of UTSA’s help is a reasonable way to get a company under 20 people through its first policies and a training plan, which is most of what chapter 542 asks at that size. Confirm the current terms with the center first.
When does a company outgrow a vCISO and need a full-time CISO?
Usually somewhere around 80 hours a month, which is where a full-time hire starts to cost less than the retainer. Multiple sites, an active audit, and heavy contract demands tend to push you there sooner. The Houston math behind that break-even is in our cost guide.
Answer the 5 questions above and send us your score. We’ll tell you whether a vCISO fits your Houston business, and if the answer is no, we’ll say so and point you to the free options.
Speak to a vCISO
