GRC for Houston Small Business: Are You Managing to a Standard?

Myth: a business with a firewall, endpoint protection and backups already meets a standard.

The fact: a security standard is a list of outcomes the business measures itself against, and tools are only one way to reach some of them. NIST says it plainly in CSF 2.0: "The CSF does not prescribe how outcomes should be achieved." A Houston business can own every tool on the market and still have no standard.

The difference shows up in the questions an insurer or customer asks next. Tools answer "do you have endpoint protection?" A standard answers "how do you know it is on every laptop, who checks, and when did they last check?" The first question has a yes-or-no answer. The second needs a written scope, a score and an owner, which is what governance means in practice.

NIST made that layer explicit in February 2024. CSF 2.0 added a sixth function, Govern, defined as the organization's "cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored." Identify, Protect, Detect, Respond and Recover describe the security work. Govern describes who decides what that work must achieve.

Our position: the tools a small business already pays for are usually fine. What is missing is the sheet of paper that says which standard those tools serve, so the tools can be checked against something other than the vendor's dashboard.

Myth: governance, risk and compliance programs are built for enterprises, and a 25-person CPA practice or construction firm is too small to need one.

The fact: the two standards a Houston small business is most likely to use were written with small organizations in mind, and Texas law now scales its expectation by headcount. NIST describes CSF 2.0 as designed for organizations "from the smallest schools and nonprofits to the largest agencies and corporations."

The Center for Internet Security goes further. CIS calls Implementation Group 1 "essential cyber hygiene" and "an emerging minimum standard of information security for all enterprises," built from a foundational set of 56 safeguards in CIS Controls v8 and v8.1. Fifty-six is a number a small business can work through with its IT provider, one safeguard at a time.

Texas wrote the sizing into statute. Texas SB 2610, effective September 1, 2025, covers business entities in Texas with fewer than 250 employees that hold sensitive personal information, and it sets a different expected program by size band:

• Fewer than 20 employees: password policies and employee training.
• Between 20 and 99 employees: CIS Controls Implementation Group 1.
• Between 100 and 249 employees: a recognized framework such as NIST or the ISO/IEC 27000 series.

For a Katy, Sugar Land or west Houston business in the middle band, the legislature has already chosen the starting standard: start with IG1, score all 56 safeguards, and move up to NIST CSF 2.0 as headcount or customer demands grow.

Myth: a business outside HIPAA, PCI DSS or CMMC has no reason to follow any framework.

The fact: Texas SB 2610 gives an unregulated Texas business a reason that has nothing to do with an auditor. A business with fewer than 250 employees that maintained a conforming program cannot be hit with exemplary damages after a data breach, and Texas law defines exemplary damages to include punitive damages.

The protection has three limits worth knowing before relying on it. The program has to be in place "at the time of the breach," so a program built afterward does not count. Compensatory damages and regulatory enforcement are not affected. And SB 2610 creates no private cause of action of its own, so it works as a shield in a lawsuit, not a credential to display.

The timing clause is the part most owners miss. A standard adopted the week after a ransomware event protects nothing about that event, which makes "we'll formalize it later" the one plan SB 2610 rewards least. The full statute walk-through lives in the CinchOps guide to the Texas SB 2610 safe harbor.

Myth: a set of downloaded policy templates, signed once and filed, means the business follows a standard.

The fact: NIST measures how a business manages a standard, not whether it owns the paperwork. CSF 2.0 describes four Tiers, Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4), and Tier 1 reads like the binder on the shelf: strategy "managed in an ad hoc manner."

Managing to a standard is a loop. NIST's own method is to write a Current Profile of what the business achieves today, a Target Profile of what it intends to achieve, then "analyze the gaps between the Current and Target Profiles, and create an action plan." A binder covers the first page of that loop at best.

A four-question test separates a binder from a managed standard. A business that can answer all four out loud is managing to a standard; a business that reaches for a folder is not there yet.

• Which standard does the business follow, by name and version (CIS Controls v8.1 IG1, NIST CSF 2.0)?
• When was the business last scored against it, and where is that score kept?
• Who owns the gap list, and what is the next due date on it?
• Could the business show all of that the day after a breach, dated before the breach?

The fourth question carries the most weight in Texas, because SB 2610 asks whether the program existed "at the time of the breach." A dated score and a dated gap list answer it. An undated binder does not.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

A standard only works when the daily operations feed it evidence. CinchOps runs 24/7 threat monitoring and keeps immutable, verified backups covering laptops, servers, Microsoft 365 and Google Workspace, and both produce the records a CIS or NIST score depends on.

• The CIS Controls service works through the 56 IG1 safeguards for businesses in the 20 to 99 employee band.
• The NIST Cybersecurity Framework service builds Current and Target Profiles for firms that have outgrown IG1.
• CTO and CIO services keep the gap list owned and reviewed between audits.
• Cybersecurity and managed IT support run the daily controls the standard measures.
• Industry work covers CPA firms, law firms and construction across the Houston and Katy areas.

The next time a questionnaire asks which framework the business follows, the answer should be a name, a version and a date. If the honest answer today is "a good IT guy," that is the right week to pick the standard, because Texas only credits the program that existed before the breach. Talk to CinchOps about which one fits.