Cybersecurity Company in Houston

Which framework you are being held to sets the shape of a Houston security programme, and proposals are fixed-fee rather than published bands or open T and M. A scoped cybersecurity assessment is a four to eight week engagement covering control gap analysis, threat modelling, and a prioritised remediation roadmap. A HITRUST CSF readiness program for a TMC member institution is driven by whether the target is e1, i1, or r2 certification and how clean the existing evidence base is. A TSA Pipeline Cybersecurity Directive remediation program is scoped against pipeline scope and existing OT visibility. SOC 2 Type II preparation for a Houston SaaS is a well-defined, lighter scope. Managed detection and incident response retainers are scoped against coverage hours, named-analyst counts, and turnaround response commitments. Houston runs roughly in line with Dallas, slightly below Austin, and meaningfully below the Bay Area, with fixed-fee proposals rather than open T and M.

The TSA Pipeline Cybersecurity Directives have evolved sharply since Security Directive Pipeline-2021-01 and 2021-02 were issued in the months following the Colonial Pipeline ransomware event. The 2022 revision (SD02C) and the 2023 revision (SD02D) introduced concrete control objectives including network segmentation, access control, continuous monitoring, patch management, and an annual cybersecurity assessment plan submitted to TSA. We deliver gap assessments mapped directly to the current directive, segmentation designs aligned with IEC 62443 and API 1164, an Implementation Plan and a Cybersecurity Assessment Plan that satisfy the directive language, and remediation backlogs that respect the operational reality of an in-service pipeline. Houston midstream and the LNG export terminals at Sabine Pass and Freeport face the same regime and we have built repeatable deliverable templates for both.

TMC engagements are HIPAA-critical by default and most member institutions require HITRUST CSF certification on hosting and SaaS partners, with a signed Business Associate Agreement covering every subprocessor. We run HITRUST readiness against v11 and the e1, i1, or r2 assessment paths depending on client risk tier, map evidence to the MyCSF assessment objects, and coordinate directly with HITRUST authorised external assessors when validated assessments are in scope. PHI never leaves HITRUST-certified regions, audit logs are tamper-evident, encryption keys are managed via AWS KMS or Azure Key Vault with break-glass procedures, and the policy library is delivered in a format MD Anderson, Houston Methodist, or Memorial Hermann procurement reviews will accept. HHS OCR audit posture is treated as a design input, not a post-incident scramble.

Yes, this is one of our heaviest verticals. We deliver Purdue-model segmentation reviews and redesigns, IEC 62443-3-2 zone-and-conduit risk assessments, IEC 62443-3-3 system security requirement gap analysis, API 1164 SCADA security alignment, and API RP 780 security risk assessment. OT visibility usually goes through Claroty or Nozomi Networks for inventory and Dragos for ICS threat detection, with the integration scoped so OT-to-IT data flows respect the zone boundaries we just defined. We coordinate with operations and process safety leadership so segmentation does not break a permit-to-work, a hot tap, or a turnaround. Engagements with ExxonMobil supply-chain, Chevron, ConocoPhillips, SLB, Halliburton, or Baker Hughes-adjacent operators are scoped to the API recommended practice library and the TSA pipeline directives where pipelines are in scope.

TDPSA took effect July 1, 2024 and is enforced exclusively by the Texas Attorney General. For cybersecurity programs we map controller and processor roles, document reasonable security practices in line with TDPSA Section 541.103, build the data protection assessment process required for high-risk processing, and align incident response playbooks with TDPSA breach notification timelines. Where HIPAA preempts TDPSA on clinical PHI we document the preemption explicitly. The Texas Attorney General has already publicly investigated companies on AI and data practices and we treat that enforcement posture as a design constraint. Our policy library includes a TDPSA risk classification so your legal team can answer an AG inquiry without a follow-up engagement, and our incident response retainers include TDPSA notification templates.

Yes. Generation, transmission, and balancing authority entities interconnected to ERCOT fall under NERC CIP-002 through CIP-014 with FERC oversight where interstate transmission is in scope. We deliver CIP-002 asset categorisation, CIP-003 cyber security policy, CIP-004 personnel and training, CIP-005 electronic security perimeters, CIP-007 system security management, CIP-010 configuration change management, CIP-011 information protection, and CIP-013 supply chain risk management programs. Evidence is structured for an audit by Texas Reliability Entity (TRE), the regional entity covering ERCOT, and we coordinate with operations technology teams so CIP boundaries do not collide with the IEC 62443 zones we may have already designed for downstream or upstream assets owned by the same parent company.

Yes. Houston federal-subcontract work, including NASA Johnson Space Center pipelines, the Lockheed Martin Houston site, and Defense Industrial Base suppliers, requires NIST SP 800-171 (Revision 2 and the forthcoming Revision 3) for Controlled Unclassified Information (CUI), plus CMMC 2.0 Level 2 third-party assessment for most prime contractors. We run System Security Plan (SSP) and Plan of Action and Milestones (POA&M) development against the 110 controls in 800-171 Rev 2 or the revised control set in Rev 3, scope GovCloud or Azure Government residency for CUI workloads, and coordinate with a CMMC Third-Party Assessment Organization (C3PAO) when certification is on the roadmap. ITAR and EAR controls are layered where the underlying technical data is export-controlled.

Houston operators have learned the Colonial Pipeline lesson, and incident response retainers carry tabletop, named-analyst, and turnaround coverage commitments that did not exist before May 2021. Our retainers include named on-call coverage with CST primary hours, integration with your existing SIEM and SOAR (Splunk ES and SOAR, Microsoft Sentinel, CrowdStrike Falcon Complete, Arctic Wolf), quarterly tabletop exercises that include both IT and OT teams in the same room, ransomware playbook drills, and TSA pipeline directive incident reporting templates. We coordinate with outside counsel for breach notification under TDPSA, HIPAA Breach Notification Rule, or state-by-state requirements depending on the affected data, and produce after-action reports in a format internal audit and the board will accept without rewrite.