Which Compliance Rules Apply to a Houston Small Business?

The data you hold and the customers you serve decide the list. Headcount does not.

A Houston small business falls under a compliance rule because of the data it holds or the customer it serves, whatever its headcount. Patient records bring HIPAA, card payments bring PCI DSS, tax and lending work brings the FTC Safeguards Rule, and Department of Defense contracts bring CMMC.

Most regulated businesses answer to more than one. A CPA practice in Sugar Land that takes card payments and carries a cyber policy has three sets of requirements before any customer sends a questionnaire. In onboarding audits, CinchOps regularly finds Houston businesses that prepared for one rulebook and never noticed a second one applied.

The table below lists 8 rulebooks a Houston business commonly meets, the event that brings each one into play, and the party that asks for proof.

Two rows on that map are not laws. SOC 2 is a report a customer asks for, and the NIST Cybersecurity Framework is voluntary. Both still decide contracts, because a buyer or an insurer can make either one a condition of doing business.

For Houston medical, dental and specialty practices, and the firms that serve them.

HIPAA is the federal law that protects patient health information, and its Security Rule requires administrative, physical and technical safeguards for electronic records. The law applies to healthcare providers in Houston and to their business associates, which includes an IT provider with access to systems that hold patient data.

The U.S. Department of Health and Human Services says a practice may share patient data with a vendor only after it obtains a written business associate agreement. Ask any IT provider for that agreement before granting access. CinchOps signs one with its healthcare clients. After a breach, HIPAA sets a clock: affected individuals are notified within 60 days of discovery, and a breach involving 500 or more people is reported to HHS within the same 60 days.

The IT work under HIPAA is specific. CinchOps performs and updates the security risk analysis, encrypts patient data at rest and in transit, gives every person a unique login with least-privilege access, and keeps the evidence ready for an Office for Civil Rights request. Details are on the HIPAA compliance for Houston healthcare page.

For any Houston business that takes credit or debit cards, at a counter, online or over the phone.

PCI DSS is the payment card industry's data security standard. The standard applies to every business that stores, processes or transmits cardholder data, whatever its size, and PCI DSS v4.0.1 has been the only active version since the PCI Security Standards Council retired v4.0 on 31 December 2024.

Scope decides the cost. Every system that can reach card data falls inside the assessment, so the cheapest PCI project is the one that shrinks that set first. CinchOps maps where card data enters, moves and rests, then segments payment systems away from the office network so fewer machines are in scope.

Card brands also set their own clocks. Visa's current guidance requires a suspected or confirmed compromise to be reported within 3 calendar days. The scanning, monitoring and documentation an acquiring bank asks for are covered on the PCI DSS compliance for Houston businesses page.

For Houston software, services and data-handling firms selling to larger customers.

SOC 2 is an independent auditor's report on a service organization's controls, built on 5 trust services categories: security, availability, processing integrity, confidentiality and privacy. No law requires SOC 2. Houston businesses meet it when a customer's vendor-risk team asks for the report as a condition of a contract.

An IT provider cannot issue a SOC 2 report, and neither can the business being audited. A CPA firm examines the controls and writes the opinion. What an IT provider does is run the technical controls the auditor will test, such as access reviews, patching, monitoring and backup, and produce the records that show each one happened on schedule.

Most of the effort is evidence. A control that ran every week but left no record counts for nothing in an audit. The split between what your company owns and what your IT provider owns is laid out in what SOC 2 requires from your Houston IT provider.

For Houston manufacturers, fabricators and engineering firms in the defense supply chain.

CMMC is the Department of Defense program that verifies contractors protect federal contract information and controlled unclassified information. Level 1 of CMMC carries 15 security requirements, and under 32 CFR 170.14 the Level 2 requirements are identical to NIST SP 800-171 Revision 2.

A Houston machine shop does not need a contract with the Pentagon to be covered. The requirement flows down from a prime contractor to its suppliers, and it arrives with the data: a controlled drawing in an inbox puts the systems that store it in scope. CMMC has been phasing into defense contracts since November 2025, and the rollout schedule has shifted along the way, so read the clause in your own contract before planning around a published date.

CinchOps starts by defining where contract data lives and keeping that boundary small, then assesses the environment against NIST SP 800-171 and documents every gap in a system security plan. The CMMC compliance for Houston DoD contractors page covers the process, and this guide for Houston manufacturers covers the cost question.

For any Houston business that needs a recognized structure for its security program.

The NIST Cybersecurity Framework is a voluntary guide from the National Institute of Standards and Technology for managing cybersecurity risk. CSF 2.0, released February 26, 2024, is organized around 6 functions: Govern, Identify, Protect, Detect, Respond and Recover, and it is written for organizations of every size.

Texas gives a small business a reason to adopt one. Texas SB 2610, in effect since September 1, 2025, bars exemplary damages in a breach lawsuit against a business with fewer than 250 employees that maintained a conforming cybersecurity program. The bar rises with size: password policies and training below 20 employees, CIS Controls Implementation Group 1 from 20 to 99, and a recognized framework such as NIST from 100 to 249. The protection has to be in place before the breach, and compensatory damages are not affected.

CinchOps maps a client's real environment to the 6 functions, ranks the gaps, and then operates the controls month after month. See NIST Cybersecurity Framework for Houston businesses and the plain-language walkthrough of Texas SB 2610.

For Houston tax preparers, CPA practices, lenders and other covered financial firms.

The FTC Safeguards Rule requires covered financial institutions to keep a written information security program. Federal Trade Commission guidance names tax preparation firms among them, and the rule requires multi-factor authentication for anyone accessing customer information, plus encryption of that information on your systems and in transit.

The rule also names a person. A Qualified Individual owns the program and reports to the board at least annually. Since May 2024, a security event involving the unencrypted information of 500 or more consumers must be reported to the FTC no later than 30 days after discovery.

Houston accounting practices have ground to make up. In the CinchOps Houston Area Security Index, CPA practices ranked last of 5 industries, with a 1.32 GPA and 55.5% earning a failing grade on external signals. CinchOps builds the written program, puts the named controls in place and supports the Qualified Individual role. See FTC Safeguards Rule compliance for Houston businesses.

For every Houston business that carries a cyber policy or holds personal data on Texans.

Cyber insurance is a contract, and its application works as a security questionnaire: the carrier asks which controls are in place and relies on the answers. Texas law adds a breach notice duty. Individuals are notified within 60 days, and the Texas Attorney General within 30 days when at least 250 Texas residents are affected.

An application answered from memory is a liability. Answering yes to a control that is not fully deployed gives a carrier grounds to contest a claim later. CinchOps puts multi-factor authentication on email, remote access and privileged accounts, deploys monitored endpoint detection, keeps immutable offsite backup copies, and backs each answer with evidence. The cyber insurance readiness for Houston businesses page covers the controls underwriters ask about first.

The Texas statute carries its own penalties, from $2,000 to $50,000 per violation. Notice decisions belong with an attorney and the insurance carrier. The IT provider's part is knowing, quickly and with logs to prove it, what was accessed and when.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

No IT provider can make a business compliant alone, and one that says otherwise is selling a logo. CinchOps is not a law firm, an audit firm or a CMMC assessor. The work splits three ways, shown below.

• Compliance services bring the rulebooks together: one team runs the controls behind HIPAA, PCI DSS, CMMC, NIST CSF and the FTC Safeguards Rule, and keeps the evidence.
• Through managed IT support, a named engineer who knows your network keeps patching, access and device standards current, the routine work every framework checks.
• Cybersecurity services add 24/7 threat monitoring, so the detection and response sections of a questionnaire have a real answer.
• Business continuity and disaster recovery keeps immutable, verified backup copies offsite, the control ransomware and insurers both test first.
• Industry pages cover the rulebooks by vertical: CPA firms, manufacturing and wealth management.
• Local coverage runs from Houston and Katy to Sugar Land and The Woodlands.

CinchOps works on Zero-Zero-Zero terms: no long-term contracts, no hidden fees, no cancellation penalties. If a questionnaire, a renewal form or a contract clause just landed on your desk, start with the list of rules that apply and work backward from the proof each one wants. Then talk to CinchOps about the IT half.