Cybersecurity & Compliance in Central Texas
Engineer Austin secures small and mid-sized organizations across Central Texas with a fixed baseline of controls on every managed account and machine, read-only assessments that produce numbered findings and a risk register, and advisory compliance support for HIPAA, CJIS, PCI and Texas SB 2610. We help you build and document the program; we do not sell attestations.
Baseline controls on every account and machine
Not add-ons. These are configured during onboarding for every organization we manage, and the complete configuration is delivered to you in writing. No single control stops every attack, so the controls are layered: each one is there to catch what the one before it missed.
- MFA enforced at account creation. Microsoft Authenticator first, a second method for recovery, SMS only on request. No account goes live without it.
- Conditional Access. Full access limited to compliant, Intune-managed devices where licensed; personal phones get the Outlook and OneDrive apps only.
- Legacy authentication blocked. ActiveSync, IMAP and POP disabled, so a stolen password cannot bypass MFA.
- Endpoint detection and response. Microsoft Defender for Business or a third-party EDR on every managed machine; remote-control tools you did not authorize removed.
- Email authentication. SPF, DKIM and DMARC on every domain we manage, plus anti-phishing, safe links and external-sender banners; see email security and filtering for the deeper layer.
- Firewall hardening against a written standard. Administration access tightly restricted, inbound forwards limited to a safe-list, unused services off, configuration backed up before every change.
- Encryption on every managed machine. BitLocker with recovery keys escrowed; new machines run Windows 11 Pro with TPM 2.0 and Secure Boot.
- Automatic screen lock. Screens lock after a short idle period, enforced by policy on every managed machine rather than left to each user.
- Printers, copiers and networked office devices. Firmware kept patched, default passwords changed, and the devices placed on their own network segment.
- Security awareness training. The state-certified program for Texas local governments, with enrollment tracked, or a simulated-phishing platform, plus live sessions for your staff on current threats.
- Password practice consistent with current NIST guidance. Banned-password lists, self-service reset, mailbox audit logging, no forced expiration.
- Retired equipment disposed of securely. Storage in a retired computer, server, copier or drive is wiped or physically destroyed, with a disposal record you keep.
Assessments and health checks
A security assessment is a measurement, not a sales call. We look first, write down what we found, and change nothing until you approve the sequence.
Read-only first
Nothing changes during the review. We capture firewall policy, switching, DHCP and DNS, Active Directory identities and privileged groups, Group Policy, domain-controller health, backup state, a security-log window and a live workstation inventory.
Findings and risk registers
Every finding is numbered and severity-rated, with a recommendation and an owner. A risk register scores likelihood and impact. A separate list sets out the decisions only you can make.
A 30-day sequence, approved in writing
Low-risk fixes first, disruptive work in after-hours windows, logging before anything that depends on evidence. Nothing starts until you sign off.
Scripted, logged, reversible remediation
Every change has a timestamped script, a log and a rollback script. Accounts are disabled, not deleted. Settings are read back after they are saved, and the change log goes into your report.
Penetration testing and vulnerability scanning. When your framework, insurer or board asks for a penetration test, we agree the scope and rules of engagement in writing, run the test, and fold the results into the same registers, so one remediation sequence covers both. Vulnerability scans run at least once a year, and quarterly where PCI applies.
The baseline moves. Our firewall standard carries a numbered pitfalls list; every entry came from a real site, and a weakness found at one is checked at all of them. Each year we re-check the baseline against current NIST and CIS guidance, and the quarterly review tells you what changed.
How AI speeds this up for you
AI assistants in our approval-gated tooling triage security logs, inventories and configuration exports and draft the findings register, so a review spends its hours on analysis rather than transcription. A member of our team checks every finding and signs off on the report, work runs in controlled sessions, and no client secret is ever pasted into a public AI tool. How we use AI.
Advisory, not attestation
We help you build, document and maintain the controls your framework expects, and we work alongside your auditor. We do not issue attestations, certifications or legal opinions, and our agreements say so.
Healthcare and HIPAA
Protected health information on its own network segments, with isolation re-tested after every firewall change. We sign Business Associate Agreements before any service that touches PHI goes live.
Law enforcement and CJIS
Networks for sheriff's offices, jails and courts designed around criminal-justice data. Staff complete current CJIS Security and Privacy training, renewed annually, with background screening, and sign confidentiality agreements.
Card payments and PCI
Point-of-sale systems segmented from staff and guest networks, scanner allow-lists maintained, and coordination with your scanning vendor so quarterly scans pass for the right reasons.
Texas SB 2610 safe harbor
A documented cybersecurity program aligned to the NIST Cybersecurity Framework or the CIS Controls, scaled to your size and quoted separately.
Texas local governments
Staff and elected officials enrolled in the state-required annual cybersecurity training, completion tracked and reported. Retention policies configured to your adopted records schedule. Where you use a DIR Regional Security Operations Center, we coordinate with it on alerts and incidents: the RSOC monitors, we coordinate.
Breach notification and credentials
If we confirm a breach involving your data in our custody, you receive prompt written notice, as set out in our agreement. Your credentials never sit on general-purpose servers, our platforms require MFA, and no data leaves the United States without your consent.
Other frameworks. Public and private data can also fall under IRS Publication 1075, FERPA, GLBA and the Texas records statutes. We advise on the controls they call for, on the same advisory basis.
One-hour response when it matters
A critical outage, an active security incident or an imminent threat is an emergency: a response within one hour and continuous effort until the threat is contained and service restored, by arrangement. We contain without destroying evidence: exposed administration planes closed, affected accounts disabled rather than deleted, configurations saved before they change, compromised credentials rotated from a written list. Afterward you receive a written account of what happened, what we changed and what remains open.
Preparation comes first: we write an incident-response plan with you, and once a year we run a tabletop exercise with your staff and, where relevant, partner agencies to test it.
What you receive
- Numbered findings register with severity, recommendation and owner
- Risk register with likelihood, impact and status
- Proposed 30-day remediation sequence and the decisions list
- Device, workstation and domain-account inventories
- Firewall hardening review with ranked findings
- Microsoft 365 security configuration in writing
- Change log with timestamped scripts and rollback scripts
- Training enrollment records and incident write-ups with root cause
Findings a licensed engineer stands behind
Engineer Austin is Texas Registered Engineering Firm F‑15739. Security findings are produced on engineering principles under a licensed engineering firm: each is numbered, rated and assigned an owner, remediation is sized to the risk rather than to a product list, and the reasoning behind any accepted risk is written down by the team member who did the work. Reports carry document control, and no report contains a password, key or token.
Who this is for: cities, counties, sheriff's offices and special districts; medical practices and home-health agencies; retailers and restaurants that take cards; and any organization that answers to an auditor, a board or a cyber insurer. Platforms we work on: Microsoft 365 and Defender, Windows Server and Active Directory, MikroTik, Fortinet, Zyxel and Ubiquiti. The baseline controls are delivered under the Managed Service Program; firewall and VLAN work is described under network engineering.
Security and compliance, answered plainly
Can you make us HIPAA, PCI or CJIS compliant?
We help you get there, but we do not certify you. We build, document and maintain the controls those frameworks expect: segmented networks, enforced MFA, encryption, logging, training and written procedures, and we answer your auditor's questions. We do not issue an attestation, certification or legal opinion, and our agreements say so plainly.
Will a security assessment disrupt our staff?
No. The review is read-only: nothing changes on your systems while we capture configurations, identities, patch state, backup state and a security-log window. Remediation goes into a written 30-day sequence that you approve first. Disruptive work is scheduled after hours, and every change is scripted and logged with a rollback.
What is Texas SB 2610 and how do you help with it?
Texas SB 2610 offers qualifying businesses a safe harbor from certain damages after a data breach when they maintain a documented cybersecurity program aligned to a recognized framework such as the NIST Cybersecurity Framework or the CIS Controls. We build and document that program as a separately quoted project, scaled to your size. Whether your organization qualifies is a question for your counsel, not for us.
What happens if we have a security incident?
Call us. Security incidents and imminent threats receive a one-hour response, by arrangement, and continuous effort until the threat is contained. We preserve evidence while we contain it, and afterward you receive a written account of what happened, what we changed and what remains open.
Do you do penetration testing?
Yes. We scope the test in writing first: which systems, which methods, the testing window and who to call if something looks wrong. You receive a report with numbered findings ranked by severity, and the fixes go into the same remediation sequence as the rest of your findings. A retest after remediation confirms what was closed.
We inherited a firewall from a previous provider. Will you keep it?
Often, yes. We audit it read-only against our written standard first: security services paid for but never enabled, logs held only in memory, administration exposed to the internet, missing MFA, stale rules. You get ranked findings and a sequenced plan. If renewing its licenses costs more than replacing it with our standard equipment, we say so with both options priced. We work on MikroTik, FortiGate, Zyxel and UniFi.
Do you provide 24-hour security monitoring?
No. We do not offer a security monitoring service. Every managed machine runs endpoint detection and response as part of the baseline controls, and a suspected incident gets the one-hour emergency response by arrangement. If your insurer or framework requires a staffed security operations center, we will tell you what to look for in a provider and work alongside the one you choose.
Start with a written assessment.
Tell us what you have and what is not working. Someone from our team, not a salesperson, replies within one business day by email or phone, and brings in our engineer when your request needs one. The assessment report is yours to keep whether or not you buy anything.