Cybersecurity Compliance Requirements Texas Engineering Firms Must Meet (CMMC, ITAR, Texas Data Breach Notification Law)

Updated September 2, 2026

TL;DR: Which frameworks apply to a Texas engineering firm depends on the work it does: federal subcontracts trigger CMMC, defense-related drawings trigger ITAR, any Texas resident’s personal data triggers Texas’s breach-notification law, enterprise client contracts often require SOC 2, and healthcare, education, or EU work add HIPAA, FERPA, or GDPR. NIST CSF ties these together as a voluntary, shared vocabulary rather than a separate mandate. Most firms qualify for one or two frameworks, not all six, and this guide maps each one’s trigger, timeline, and cost.

Federal civil penalties for a single ITAR violation can exceed $1.27 million under 22 CFR 127.10, and the trigger is narrower than most engineering firms assume: one uncontrolled drawing of a defense-related part is enough.

Texas engineering firms often chase compliance requirements that do not apply to them while missing ones they already meet. This guide helps an operations leader find what applies before booking cybersecurity services for engineering companies. TechProComp’s 12-layer framework maps to several of these control families.

Which Compliance Frameworks Apply to Your Engineering Firm

Six frameworks can plausibly apply to a Texas engineering firm, but rarely all six at once. The table below maps each trigger to its framework and where this guide covers it. Work through the branches in order, since a firm can land on more than one at the same time.

The Applicability Matrix at a Glance

Trigger	Framework	Covered In
Federal subcontract work involving controlled information	CMMC	CMMC section
Defense-related drawings or technical data	ITAR	ITAR section
Personal data of Texas residents	Texas breach-notification law	Texas breach-notification law section
Enterprise or client-trust contracts	SOC 2	SOC 2 section
Healthcare facility design work	HIPAA	Industry-specific section
K-12 or university work	FERPA	Industry-specific section
EU clients or employees	GDPR	Industry-specific section

Framework	Mandatory or Voluntary	Governing Body	Typical Cost	Typical Timeline
CMMC	Mandatory for DoD subcontracts	Department of Defense	$30,000 to $200,000	9 to 18 months
ITAR	Mandatory if triggered	State Department	Registration plus remediation	Ongoing
Texas breach-notification law	Mandatory	Texas Attorney General	Incident-driven	30 to 60 days
NIST CSF	Voluntary	NIST	Internal mapping cost	Ongoing
SOC 2	Client-driven	AICPA-licensed CPA firms	$30,000 to $100,000	6 to 12 month audit window
HIPAA, FERPA, GDPR	Contract-driven	HHS, ED, EU regulators	Varies by scope	Varies by scope

Under 32 CFR Part 170, CMMC applies to firms that process, store, or transmit federal contract information or controlled unclassified information on a DoD contract. ITAR applies under 22 CFR 127.1 the moment a firm manufactures, exports, or furnishes a defense article or technical data tied to the U.S. Munitions List.

How the Decision Tree Works

Start by asking whether your firm does federal subcontract work involving controlled information. If yes, CMMC applies at a minimum of Level 1. If your firm touches a defense-controlled drawing or technical data, ITAR applies regardless of federal work.

Any Texas business holding a resident’s personal data meets Texas’s breach-notification law immediately. Enterprise clients that require third-party verification usually ask for SOC 2. Healthcare design work, K-12 or university projects, and EU clients or employees add HIPAA, FERPA, or GDPR respectively.

CMMC: Cybersecurity Maturity Model Certification

CMMC is binary and expensive, and it only applies to firms doing Department of Defense subcontract work. Under the CMMC final rule, certification requirements phase in over several years rather than landing all at once.

The complementary DFARS acquisition rule (48 CFR Part 204) is the piece that actually puts a CMMC status requirement into a solicitation. Once that acquisition rule applies to a contract, the DoD can require a self-assessed or third-party CMMC status as a condition of award, not just a promise to comply eventually.

TechProComp’s 12-layer security framework maps to the NIST 800-171 control families used in CMMC Level 2 assessments, including access control and system and communications protection.

Level 1 vs. Level 2 Requirements

Level 1 covers basic safeguarding of federal contract information under FAR 52.204-21, commonly described as 15 security requirements, though the original 2021 CMMC self-assessment guide split them into 17 separate controls. Level 2 covers controlled unclassified information and requires 110 controls organized under NIST 800-171, a substantially heavier lift than Level 1’s basic hygiene checklist.

Timeline and Cost to Get Certified

Gap assessment through certification typically runs 9 to 18 months. 2026 market data puts Level 2 certification costs at $50,000 to $200,000 or more, depending on organization size and scope. Small organizations specifically invest $140,000 to $205,000 in their first certification year on average, well above older low-end estimates.

The C3PAO assessment fee alone is only one line item inside that total. Market data on C3PAO assessment pricing puts the assessment fee by itself in a lower band than the full remediation-through-certification total, which is why a $200,000 estimate should be read as covering the whole project, not just the day the assessor shows up. A C3PAO, not an MSSP, performs the actual Level 2 certification assessment.

How an MSSP Supports CMMC Readiness

An MSSP’s role in CMMC is gap remediation, not certification. TechProComp implements the technical controls a C3PAO will later assess, then steps aside for the third-party assessment itself.

TechProComp has never dropped the ball; their customer service is outstanding. – Angelina Vasquez on Clutch

Under 32 CFR Part 170, the regulation still sets the mandatory third-party C3PAO assessment requirement for Level 2 to begin one year after the DFARS acquisition rule’s Phase 1 start date. On July 13, 2026, the Department of War suspended that Phase 2 timeline pending a 60-day program review, so no fixed date currently applies. Phase 1 self-assessment obligations remain in effect. Firms doing DoD subcontract work should treat remediation as time-sensitive regardless, since the review could reinstate a deadline on short notice.

ITAR: International Traffic in Arms Regulations

ITAR is binary, and the trigger is narrower than most engineering firms assume. It applies to firms touching defense-related drawings, technical data, or designs tied to items on the U.S. Munitions List, not to firms with federal contracts in general.

When ITAR Applies to Engineering Work

A single drawing of a controlled item can be enough to trigger ITAR, even without a formal export. Under 22 CFR 127.1, manufacturing, exporting, or furnishing a defense article or technical data requires only one occasion of doing so, and registration with the Directorate of Defense Trade Controls is required before any of that activity begins.

This catches engineering firms that never think of themselves as defense contractors. A firm that subcontracts a single component drawing for a Munitions List item, even as a minor part of a larger civilian project, falls under the same registration duty as a firm doing full-scale weapons manufacturing.

Registration, Controls, and Penalties

Firms must register with the State Department before manufacturing, exporting, or brokering defense articles. Civil penalties under 22 CFR 127.10 can reach the greater of $1,271,078 or twice the transaction value per violation, while separate criminal penalties under 22 U.S.C. 2778 top out at $1,000,000 and up to 20 years in prison. The commonly repeated “$1 million” figure understates the current civil ceiling.

Texas Data Breach Notification: The Identity Theft Enforcement and Protection Act

Texas’s breach-notification requirement is the one almost every Texas engineering firm already triggers, and the one most likely to be underestimated. It’s formally the Identity Theft Enforcement and Protection Act, codified at Texas Business and Commerce Code Chapter 521, not to be confused with Texas SB 820, a separate 2019 law that only covers K-12 school district cybersecurity policies. Most firms meet the Chapter 521 trigger through ordinary payroll, benefits, and employee records alone, long before they touch a federal contract.

Understanding the true cost of skipping this step matters here. See cost of a data breach for what a missed notification deadline adds on top of the breach itself.

Who Must Comply and When

Any Texas business that owns or licenses computerized data including a Texas resident’s sensitive personal information must comply, with no exemption for small firms. There is no minimum-employee or minimum-revenue carve-out in the statute.

Most engineering firms already hold this kind of data without thinking of it as a compliance trigger. Payroll records, benefits enrollment files, and employee Social Security numbers are exactly the sensitive personal information the statute covers, which is why a firm with zero federal contracts can still owe a breach notification.

Notification Timeline and Statute Requirements

The assignment’s original “60 days for 250 or more residents” framing conflates two separate deadlines. Individual notice is due within 60 days of determining a breach occurred, regardless of how many residents are affected. A separate, shorter 30-day deadline applies only to notifying the Texas Attorney General, and only if the breach involves 250 or more Texas residents.

NIST CSF: The Framework Behind the Others

NIST CSF is voluntary, not a regulation, but it has become the shared language that enterprise clients and insurance carriers increasingly expect. NIST CSF 2.0 was released in February 2024 and is designed for organizations of any size or sophistication.

TechProComp’s 12-layer framework maps to NIST CSF, giving the two frameworks a shared vocabulary an operations leader can use in front of a CEO or an insurance carrier.

The Six NIST CSF 2.0 Functions

The framework’s core organizes around six functions: Identify, Protect, Detect, Respond, Recover, and Govern, the function added in the 2.0 release. Together, Identify, Protect, Detect, Respond, and Recover cover the operational life cycle of managing cybersecurity risk, from knowing what needs protecting through recovering after an incident.

Govern is the newer addition, and it covers organizational context, cybersecurity strategy, and the oversight functions that senior leaders, not just IT staff, are expected to own. NIST’s own framing treats Govern as a recognition that cybersecurity is now enterprise risk on par with finance and reputation, not a purely technical concern.

How NIST CSF Maps to Other Frameworks

CMMC’s control families, SOC 2’s trust services criteria, and most cyber-insurance questionnaires all draw on NIST CSF’s vocabulary in some form. Mapping your firm’s controls to NIST CSF once means you can speak to CMMC, SOC 2, and insurance renewal conversations without re-explaining your program from scratch each time.

SOC 2: Proving Security to Enterprise Clients

SOC 2 is what enterprise B2B clients such as banks, healthcare systems, and technology companies ask for before signing a contract. Engineering firms doing sustained enterprise work should expect the question eventually, even if no client has asked yet.

What stands out the most is their exceptional responsiveness and reliability, consistently delivering on time and addressing issues proactively. – Verified User on Clutch

Type I vs. Type II Audits

A Type I audit is a point-in-time snapshot of control design. A Type II audit evaluates operating effectiveness over an observation window commonly six to twelve months long, which is why enterprise clients tend to prefer it: it proves the controls actually worked over time, not just that they existed on the day of the audit.

TechProComp is SOC 2 certified (verified March 2026). This article does not specify Type I or Type II, and a firm evaluating any MSSP’s certification claim should ask the same question directly rather than assume the stronger type.

Cost and Trust Services Criteria

A SOC 2 audit is performed by a CPA firm against AICPA’s trust services criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only criterion required on every audit, and the other four apply based on the services a firm actually provides. Initial audits commonly run $30,000 to $100,000 for mid-market companies, plus an annual renewal.

Industry-Specific Frameworks: HIPAA, FERPA, GDPR, and PCI-DSS

These frameworks apply only given a specific client type, never universally. Assuming one applies when it does not wastes budget on the wrong readiness work.

HIPAA for Healthcare Facility Design

Engineering firms designing healthcare facilities often handle protected health information inside BIM models, which can require a written Business Associate Agreement. Under HHS BAA guidance, a business associate is directly liable for unauthorized use or disclosure of that information. TechProComp provides HIPAA support for healthcare clients, not HIPAA certification, since no MSP-level HIPAA certification exists.

FERPA, GDPR, and PCI-DSS Triggers

FERPA applies when K-12 or university engineering work touches student records, which can happen through facility-access systems or enrollment data tied to a school design project. GDPR applies to firms with EU clients or EU-based employees, since the regulation follows the data subject’s location rather than the engineering firm’s own headquarters.

PCI-DSS rarely applies to this audience and is worth a brief mention only for firms that accept card payments directly. A firm that only invoices clients and gets paid by check or ACH transfer never touches cardholder data in the first place, which keeps PCI-DSS off the applicability list entirely.

How an MSSP Supports Compliance Readiness

An MSSP’s scope and a certification assessor’s scope are two different things, and conflating them causes over-promising. Clarifying the split up front saves an operations leader from having to personally evaluate a vendor’s technical claims, something most operations leaders have no training to do.

Firms comparing providers on this point should read choosing a cybersecurity provider alongside this section.

Gap Assessment to Remediation

The typical MSSP engagement runs five steps: gap assessment against the relevant standard’s controls, remediation prioritization, putting technical controls such as EDR, MFA, and SIEM logging in place, documentation preparation for the eventual audit, and ongoing control monitoring. TechProComp puts these technical controls in place across Microsoft Azure, AWS, Microsoft 365, and Cisco Meraki environments during remediation.

TechProComp’s service level and responsiveness are impressive. – Keith Kelley on Clutch

What an MSSP Does Not Do

An MSSP does not issue a CMMC certification and does not sign a SOC 2 audit opinion. A C3PAO performs CMMC assessments, and a licensed CPA firm performs the SOC 2 audit. An MSSP’s job ends at “the controls are in place and documented,” not “the certificate is issued.”

This distinction protects the operations leader as much as it protects the MSSP. If a vendor implies it can certify a firm directly, that claim is worth questioning before signing anything, since no MSSP holds that authority for CMMC or SOC 2.

When You Don’t Need Most of These Frameworks

Not every firm needs to chase every certification, and pushing a small firm toward CMMC it does not need wastes a budget cycle it could spend elsewhere.

The Lower-Risk Firm Profile

A small engineering firm, under 50 employees, doing only state or municipal work with no DoD subcontracts and no defense-adjacent drawings, may only need Texas breach-notification compliance plus a baseline NIST CSF mapping. CMMC and ITAR do not apply without a federal or defense trigger, and SOC 2 only becomes relevant once an enterprise client actually asks for it.

This is a smaller company than TechProComp’s typical client, which tends to run 80 to 150 employees with multiple locations and at least one enterprise-scale relationship already in place. The point of naming a lower-risk profile explicitly is to keep a smaller firm from spending a budget cycle on CMMC readiness it does not need yet.

Compliance Self-Assessment: 10 Questions to Ask

Answering ten direct questions gives an operations leader a prioritized compliance list before calling any vendor. Working through it privately first means walking into a vendor conversation with a recommendation already in hand, instead of hoping the vendor tells you what you need.

Firms unsure where they stand should also read signs you’re falling behind, since compliance gaps and general security gaps often show up together.

The 10 Questions

1. Do you hold federal contracts or subcontracts?
2. Is any of your work DoD-adjacent or defense-related?
3. Do you design healthcare facilities?
4. Do you work with K-12 or university clients?
5. Do you have EU clients or employees?
6. Does your data include Texas residents’ personal information?
7. Do any enterprise clients require SOC 2?
8. Do you already hold any relevant certification?
9. Have you had a recent compliance audit?
10. Is budget allocated for compliance work this year?

What Your Answers Mean

Three or more “yes” answers to questions 1 through 5 mean CMMC or ITAR readiness planning should start now, not after the next RFP arrives. A “yes” only on question 6 usually means Texas’s breach-notification law and a baseline NIST CSF mapping cover the gap.

Frequently Asked Questions

What cybersecurity compliance does a Texas engineering firm need?

It depends on the work the firm does: federal subcontract work brings in CMMC, defense-related drawings bring in ITAR, holding any Texas resident’s personal data brings in the state’s breach-notification law, and enterprise client contracts often add SOC 2, while healthcare, education, or EU work can add HIPAA, FERPA, or GDPR. Most firms qualify for one or two of these, not all six, which is why an applicability check should come before any readiness spending.

When does CMMC apply to engineering firms?

CMMC applies to firms that process, store, or transmit federal contract information or controlled unclassified information under a Department of Defense contract or subcontract. Level 1 covers basic safeguarding of federal contract information. Level 2, which requires 110 controls under NIST 800-171, applies when a firm handles controlled unclassified information. Firms with no DoD subcontract work do not need either level in most cases.

What is ITAR and does it apply to my engineering firm?

ITAR is the International Traffic in Arms Regulations, and it applies the moment a firm manufactures, exports, or furnishes a defense article or technical data tied to the U.S. Munitions List. A single uncontrolled drawing of a defense-related part can trigger it, even without a formal export or a defense contract. Firms with no defense-adjacent drawings or technical data fall outside its scope in nearly every case.

What does the Texas data breach notification law require for engineering firms?

Texas’s Identity Theft Enforcement and Protection Act, not the unrelated Texas SB 820 (a K-12 schools law), requires any business holding a Texas resident’s sensitive personal information to notify affected individuals within 60 days of determining a breach occurred, with no minimum-resident threshold. A separate, shorter 30-day deadline applies only to notifying the Texas Attorney General, and only if the breach affects 250 or more Texas residents. Most engineering firms already meet the underlying trigger through payroll and HR records.

How do I get CMMC Level 2 certified?

CMMC Level 2 certification requires meeting 110 controls under NIST 800-171, then passing a third-party assessment performed by a C3PAO, not by an MSSP. The path typically takes 9 to 18 months and costs $30,000 to $200,000, covering gap assessment, remediation, and the assessment itself. An MSSP can put the technical controls in place, but only a C3PAO can issue the certification.

Is SOC 2 required for engineering firms?

SOC 2 is not a universal requirement. It becomes relevant when an enterprise client, often in banking, healthcare, or technology, requires third-party verification of a vendor’s security controls before signing a contract. A SOC 2 audit is performed by a CPA firm against five trust services criteria, with Security as the only mandatory one. Engineering firms without enterprise B2B clients rarely need it.

Key Terminology

CMMC: The Cybersecurity Maturity Model Certification program, a Department of Defense requirement for contractors and subcontractors handling federal contract information or controlled unclassified information. It has two relevant tiers for most engineering firms, Level 1 and Level 2, with Level 2 requiring third-party assessment.

ITAR: The International Traffic in Arms Regulations, a State Department program controlling defense articles, technical data, and services tied to the U.S. Munitions List. Registration and, in some cases, a license are required before any covered activity begins.

Identity Theft Enforcement and Protection Act: The Texas statute, codified at Business and Commerce Code Chapter 521 (section 521.053), requiring breach notification to affected individuals within 60 days and to the Texas Attorney General within 30 days when 250 or more Texas residents are affected. It applies to any Texas business, regardless of size, and is distinct from Texas SB 820, an unrelated K-12 schools cybersecurity law.

NIST CSF: The National Institute of Standards and Technology’s Cybersecurity Framework, a voluntary set of six functions used as a shared vocabulary across CMMC, SOC 2, and insurance underwriting. Version 2.0, released in 2024, added the Govern function.

SOC 2: A voluntary audit standard, administered by a licensed CPA firm against AICPA’s trust services criteria, used to prove a vendor’s security controls to enterprise clients. Type I evaluates control design at a point in time, while Type II evaluates operating effectiveness over months.

C3PAO: A Certified Third-Party Assessor Organization, the only entity authorized to perform a CMMC Level 2 certification assessment. An MSSP can prepare a firm for the assessment but cannot perform or substitute for it.

Gap Assessment: A structured review comparing a firm’s current controls against a target standard’s requirements, producing a prioritized remediation list. It is typically the first step in any compliance readiness engagement.

MSSP: A managed security services provider that implements and monitors technical security controls on a client’s behalf. An MSSP supports compliance readiness through remediation and documentation but does not issue certifications or sign audit opinions.

Get a technical review of your compliance readiness across CMMC, SOC 2, and the 12-layer framework. Book a free assessment with TechProComp, and we will show you exactly where the gaps are, with no obligation.

---