Most Houston small business owners are not technologists, and that’s fine. But in 2026, you need to be able to answer 25 plain-English questions about your cybersecurity posture — because insurers, customers, and regulators are all going to ask them.
This is the same audit we run with prospective clients. Score yourself honestly. Each question is worth one point. Below 18 means you have meaningful gaps.
Identity (5 questions)
- Is multi-factor authentication enforced on every email account, including the owner’s?
- Is MFA enforced on every remote access tool — VPN, RDP, RMM, anything that connects in from outside the office?
- Are admin accounts separate from daily-use accounts?
- When an employee leaves, is access removed within 24 hours? Documented?
- Is there a password manager in use for shared credentials?
Endpoints (5 questions)
- Does every laptop and server run modern endpoint detection (EDR), not just antivirus?
- Are operating systems and applications patched on a documented schedule?
- Is full-disk encryption enabled on every laptop?
- Are personal devices that access company email under any kind of mobile device management?
- Are USB drives controlled (whitelisted, encrypted, or blocked)?
Email (5 questions)
- Is email filtering blocking phishing and malicious attachments?
- Are SPF, DKIM, and DMARC properly configured on your sending domain?
- Does every employee take security awareness training at least annually?
- Do you run simulated phishing tests at least quarterly?
- Is there a one-click way for employees to report suspicious email?
Data and Backup (5 questions)
- Are critical files backed up daily — both on-site and off-site?
- Is Microsoft 365 (or Google Workspace) backed up by a third-party tool?
- Are backups immutable (an attacker can’t delete them with stolen credentials)?
- When was the last test-restore? Could you point at a calendar entry?
- How long would it take to restore your most critical system from backup?
Response and Recovery (5 questions)
- Do you have a written incident response plan with names and phone numbers?
- Has the plan been reviewed in the last 12 months?
- Do you have cyber insurance, and do you know what it covers?
- Do you know the first three people to call if you discover a breach?
- Has the business ever practiced an incident-response tabletop exercise?
Scoring
- 22-25: Strong posture. You’re better than most Houston SMBs we audit.
- 18-21: Decent baseline. A few gaps to close before they bite.
- 14-17: Significant gaps. A motivated attacker would find a way in.
- 10-13: At risk. Insurance is going to be expensive or unavailable.
- Below 10: You’re due for a breach. Closing these gaps should be this quarter’s priority.
What good looks like
A typical Houston small business we move from "no plan" to fully managed lands in the 22-25 range within 90 days. The first 60 of those days focus on identity (MFA enforcement, EDR rollout, email security), the last 30 on documentation (incident response plan, vendor attestations, training rollout).
The cost? For a 25-person firm, comparable to one mid-level employee’s monthly cost — and dramatically less than the cost of getting it wrong.
What to do next
If you scored below 18 and want a no-pressure conversation about how to close the gaps, book a free 15-minute discovery call. We’ll walk through your scores, talk about what would move the needle fastest, and you decide what to do from there. No pitch.
Aspendora Technologies has audited and protected Houston-area small businesses since 2010. We provide managed IT services, cybersecurity, and data backup and recovery.