Security assessments for regulated small businesses in Texas.
If you run a law firm
The risk that matters most right now is business email compromise aimed at your trust account. The FBI's Internet Crime Complaint Center has tracked this pattern for years: an attacker gets into an email thread around a real estate closing, waits for wiring instructions to come up, and sends a replacement account number that looks like it came from you or the title company. The money doesn't come back. Rule 1.15 makes safekeeping client trust funds a direct duty, not a technicality. Model Rule 1.1 requires staying competent in the technology used to do it, and Rule 1.6(c) requires reasonable efforts against unauthorized access. None of the three is a suggestion. See how this gets fixed before the wire goes to the wrong account.
If you're a tax preparer, mortgage broker, or title company
The FTC classifies you as a financial institution under the Gramm-Leach-Bliley Act if you prepare taxes, broker mortgages, arrange auto financing, run a collection agency, handle real estate closings, or work as a non-SEC investment adviser, whether or not you'd describe your own business that way. The Safeguards Rule (16 CFR 314) applies directly: a written security program, access controls, and vendor oversight are requirements, not suggestions. The failure mode is usually a third-party integration nobody audited: in late 2025, a credit-pull platform used by over 20,000 dealerships leaked 5.8 million people's Social Security numbers from financing applications, and the dealers who used it were still on the hook for a vendor they never vetted. See how this gets fixed before someone else's vendor breach becomes your compliance problem.
If you run a medical or dental practice
HIPAA's Security Rule (45 CFR 164.308, 164.310, 164.312) requires a documented security risk analysis and real administrative, physical, and technical safeguards for patient data, regardless of practice size. It's built to scale down to a small office, not exempt one. The realistic failure mode isn't sophisticated: a staff member clicks one phishing link, an attacker sits unnoticed for weeks, then locks the entire patient record system at once. A multi-provider clinic went through exactly that in 2025, three weeks undetected, then a full ransomware lockout affecting thousands of patients in a single day. See how this gets fixed before three unnoticed weeks become a full lockout.
How this works
First
Gap Assessment
A structured review of your firm against the NIST Cybersecurity Framework, and against HIPAA or PCI DSS where either applies to what you handle. I look at email authentication, access controls, backup configuration, and whether logs get reviewed. You get a findings report and a fix list ranked by risk, not a document nobody reads.
Then
Hardening & Setup
Fixing what the assessment found. Typically: email authentication (DMARC, SPF, DKIM), tightening access controls so the right people have the right logins and no one else does, verifying backups actually restore, and setting up monitoring so something is watching after I leave.
Ongoing
Monthly Advisory
Once things are fixed, someone still has to watch them. That's log review, a monthly report you can actually read, and a direct line to call when something looks wrong. Not a ticket queue. Me.
What a finding actually looks like
This is an anonymized excerpt from a real Gap Assessment report, edited so no firm can be identified. It's here to show the kind of work product the assessment actually produces.
Finding 4.2: Email authentication not enforced
- Domain checked
- [client-firm].com (redacted)
- Observation
- No DMARC record published. SPF present but set to ~all (soft-fail, not enforced). No DKIM selector found on the primary mail flow.
- Why it matters
- Anyone can send email that appears to come from [client-firm].com. A message that looks like it's from the managing partner, asking a client to wire funds to a new account, will pass through most spam filters unblocked.
- Fix
- Publish a DMARC record at p=quarantine, move SPF to -all once every legitimate sending source is confirmed, and enable DKIM signing on the mail provider. About two to three hours of work with access to DNS.
- Framework
- NIST CSF, Protect function (data security, identity management).
About Stephen
Stephen Matthews founded SCM Technologies, LLC in April 2024, after several years working front-line SOC and MDR operations: triaging alerts, investigating incidents, and being the person who actually reads the logs when something looks wrong.
SCM Technologies is Stephen. There's no tier-one help desk between you and the person who wrote your findings report, and no one else who picks up the phone when you call next month. If that's the wrong fit for a larger firm with its own IT department, it's worth knowing up front.
Contact
Reach out directly at stephenmatthews@scm-technologies.com, or use the form below.