If you supply oil-and-gas, midstream, or petrochemical operators anywhere along the Houston Ship Channel, you've probably seen the new wave of vendor security questionnaires. They're longer. They're stricter. And in many cases, they're no longer optional — an unsatisfactory response can cost you the renewal.
The good news: nearly every control these operators are now demanding can be implemented by a 10-to-100-person Houston small business without a Fortune-500 IT budget. The bad news: most local vendors are still in the "we'll get to it" phase.
Here's what changed, what they're asking for, and how to actually pass the audit.
Why audits got harder in 2026
The 2025 ransomware wave hit too many Houston-area operators through their vendors. Cleaning crews, inspection contractors, billing firms, and IT consultants all became entry points into much larger industrial networks. Operators learned. Insurance companies learned. Now everyone — from the largest refinery down to your direct customer — pushes the requirements one level deeper.
If you serve a Houston energy operator, your customer's security team is now asking you for written evidence that you're not the weakest link. That means real proof: documents, screenshots, attestation letters, sometimes third-party audits.
The 8 controls operators now expect
Across the questionnaires we've seen this year, these eight controls show up nearly every time:
- Multi-factor authentication on every account. Email, file storage, accounting, remote access, VPN, your line-of-business application. No exceptions for executives, no exceptions for "it slows me down."
- Endpoint detection and response (EDR), not just antivirus. The difference matters. Traditional antivirus matches known signatures. EDR watches behavior and stops what it hasn't seen before.
- Email filtering with anti-phishing and link rewriting. Most attacks still start with email. Anything less than active scanning of links and attachments is now a gap.
- Patch management with a documented cadence. "We update when we get around to it" is no longer an answer. Operators want to see a stated SLA — e.g., critical patches within 7 days.
- Backups stored off-site and tested. An untested backup is a hope, not a control. You should be able to point at the last restore test on a calendar.
- Security awareness training, recurring. Annual is the floor. Quarterly micro-trainings or simulated phishing campaigns are now common.
- An incident response plan with names and phone numbers. Who calls the insurer? Who calls the lawyer? Who calls the operator? If it's a blank stare, it's a fail.
- Privileged-access controls. No one logs into a server day-to-day with admin rights. Admin is for admin tasks only, with separate accounts.
How to meet them on a small-business budget
You don't need an enterprise security team. You need an honest assessment of where you are today and a 90-day plan to close gaps. Most of these controls are bundled into well-designed managed IT services for a flat monthly fee that's far less than a single audit failure costs.
If you're trying to do it yourself, prioritize in this order: identity (MFA + privileged access), email (filtering + training), endpoint (EDR), then backup, then documentation. Identity attacks account for the majority of breaches, so closing that gap moves the needle fastest.
A sample one-page response packet
What we ship with every Houston-area client when they ask for an attestation:
- A one-page summary letter naming the controls in place, signed by ownership
- Screenshots showing MFA enforcement, EDR rollout, and backup logs
- The incident response plan's first page (the contact tree)
- The most recent restore-test date and result
- Cyber insurance certificate
That packet has passed every operator audit we've supported in 2025 and 2026. It takes about 20 minutes to assemble once the controls are actually in place.
What to do next
If you're a Houston-area energy vendor and you can't answer those 8 questions confidently, you're not alone — but you're also one questionnaire away from a problem. Book a free 15-minute discovery call and we'll tell you exactly where you stand and what closing the gaps would cost. No pitch, no pressure.
Aspendora Technologies provides managed IT services and cybersecurity to Houston-area small businesses. Based in La Porte, we serve Houston, Pasadena, Pearland, Baytown, and the broader metro since 2010.