What are the opening hours?

Monday 8:30am - 5pm Tuesday 8:30am - 5pm Wednesday 8:30am - 5pm Thursday 8:30am - 5pm Friday 8:30am - 5pm

https://chrmanagedservices.com/

CHR Managed Services, Houston, TX (2026)

11/02/2026

If you could only do three things to protect a small business, what would they be? 🔒

Here’s Trent Martin, our VP of IT's, list, same one he's had for years:

1. MFA. Put another step between an attacker and your accounts.
2. End user education. Make sure your team knows what to watch for and feels comfortable reporting something suspicious.
3. Advanced endpoint protection. Protect the devices people use every day.

What’s your top 3? ⬇️

10/31/2026

Your technology can only do so much. When a scam gets through, your people make the call.

In the final part of our Cybersecurity Awareness Month series, we cover employee awareness and why one-time onboarding training isn't enough anymore. We also recap all 21 questions every business should ask its IT provider. ⬇️

Employee Awareness: Your People Are Your Last Line of Defense

We've spent the past eight articles on the systems and processes that protect your business: backups, monitoring, email security, access controls, dark web monitoring, testing, documentation, and compliance. Every one of them matters.

But there's one part of your security that no tool fully covers: the people who use your systems every day.

Attackers know it's often easier to fool a person than to break through a firewall. That's why so many attacks start with a convincing email, an urgent phone call, a fake login page, or a text that looks like it came from the boss. When something does get past your technical defenses, the person who receives it is the one who decides what happens next.

That makes your employees either your biggest vulnerability or one of your strongest defenses. The difference is training.

21. Are employees trained regularly to recognize scams, or was security awareness a one-time thing during onboarding?

In many businesses, security training happens once. A new hire watches a video or clicks through a slideshow during their first week, signs a policy, and never hears about it again. Months or years later, that same person is expected to spot a carefully crafted scam that looks nothing like the examples they saw on day one.

That approach doesn't hold up, for a few reasons.

Scams keep changing. Phishing emails used to be easy to spot, with obvious typos and strange requests. Today, attackers use AI to write polished, personalized messages. They impersonate vendors, executives, banks, and delivery services. They use text messages, phone calls, QR codes, and even voice cloning. Training from two years ago doesn't prepare anyone for what's landing in inboxes now.

People forget. Security habits are like any other skill. Without regular practice, they fade, especially when people are busy, distracted, or under pressure to get things done quickly. Attackers count on that.

One click is enough. It only takes one employee entering a password on a fake page, opening a malicious attachment, or approving a fraudulent payment to start a serious incident. In a smaller business, that one person might also have access to finances, customer data, or key systems.

What effective training looks like
Strong security awareness programs don't rely on one annual session. They build habits over time:

Short, regular training that covers current threats in a few minutes at a time, instead of a long session once a year

Simulated phishing tests that send realistic fake scam emails to employees, so they can practice spotting them in a safe setting
Immediate, constructive feedback when someone clicks, focused on learning instead of blame

A simple way to report suspicious emails, calls, or messages, along with a clear message that reporting is always the right call

Tracking and reporting that show whether the business is improving over time and where extra training is needed

The goal isn't to catch people making mistakes. It's to build a culture where employees feel confident pausing, questioning a request, and speaking up when something feels off.

What a good answer sounds like: "Every employee gets ongoing training throughout the year, we run regular phishing simulations, and we can show you the results and how they've improved." Ask how new threats are added to the training, how often simulations happen, and what happens when someone fails one.

Why This Matters More for SMBs
Small and mid-size businesses run on trust and teamwork. People wear many hats, move quickly, and want to be helpful. Those are great qualities for a business, and they're exactly what attackers try to take advantage of.

The good news is that training is one of the most affordable, high-impact investments an SMB can make. A team that knows what to look for can stop an attack before any other defense has to.

Bringing It All Together
Over the course of this series, we've walked through 21 questions every business should be able to ask its IT provider:

• Backup and Business Continuity: Can you recover quickly, with tested backups attackers can't reach?
• Monitoring, Patching and Endpoint Protection: Is someone watching, updating, and protecting every device?
• Email and Phishing Defense: Are threats stopped before they reach the inbox?
• Access, Passwords and Identity: Is MFA enforced, offboarding complete, and admin access limited?
• Dark Web and Credential Exposure: Would you know if your passwords were stolen?
• Vulnerability and Pe*******on Testing: Have your defenses actually been tested?
• Documentation and Vendor Accountability: Do you own the keys to your own systems?
• Compliance and Cyber Insurance: Can you prove you're protected?
• Employee Awareness: Are your people prepared to recognize and report a scam?

These questions aren't meant to make you an IT expert. They're meant to help you tell the difference between a provider who is actively protecting your business and one who is quietly hoping nothing goes wrong.

Cybersecurity Awareness Month ends this week, but attackers don't take the rest of the year off. If your current provider can't answer these questions clearly and confidently, it's worth a conversation. Let's talk:

10/30/2026

You have cyber insurance. But would your claim actually get paid?

Part 8 of our Cybersecurity Awareness Month series covers compliance and cyber insurance: two questions that show whether your business can prove it's protected when an insurer, auditor, or customer asks. ⬇️

Compliance and Cyber Insurance: Can You Prove You're Protected?

Many small and mid-size businesses carry cyber insurance and assume it will cover them if something goes wrong. Many also know they have some regulatory requirements to meet, but aren't sure exactly what those requirements are or whether they're being met.

Both come down to the same issue: it isn't enough to say you're protected. You need to be able to prove it.

Insurers and regulators increasingly expect specific security controls to be in place and documented. If an incident happens and you can't show that those controls existed, the consequences can include denied claims, fines, lost contracts, and damaged customer trust, all on top of the cost of the incident itself. These two questions show whether your security setup will hold up when someone asks for proof.

19. Would our current security setup satisfy the requirements of our cyber insurance policy if we ever needed to file a claim?

Cyber insurance applications have become much more detailed. Insurers commonly ask whether you use multi-factor authentication, endpoint detection and response, tested and isolated backups, security awareness training, and regular patching. Many of these are the same topics we've covered earlier in this series.

The answers on that application matter. If a business states that certain controls are in place and an investigation after an incident shows otherwise, the insurer may reduce or deny the claim. Often the person who filled out the application was a business owner or office manager doing their best, not the IT provider who actually knows what's in place.

What a good answer sounds like: "We've reviewed your policy requirements and your application, and we can confirm each control is in place, with documentation to back it up." Your provider should be part of the renewal process every year, not hearing about the policy for the first time after an incident.

20. Are we meeting the specific compliance requirements that apply to our industry (HIPAA, PCI, CMMC, FTC Safeguards, etc.), and can that be proven with documentation?

Many SMBs are subject to security regulations without fully realizing it. A few common examples:

HIPAA applies to healthcare providers and many of the businesses that handle patient information for them.

PCI DSS applies to businesses that accept, process, or store credit card payments.
CMMC applies to companies that do work for the U.S. Department of Defense, including many subcontractors.

The FTC Safeguards Rule applies to a wide range of non-bank financial businesses, such as tax preparers, mortgage brokers, and auto dealers that offer financing.

Each one has its own requirements, and nearly all of them expect documented policies, risk assessments, and evidence that security controls are actually working. "We think we're compliant" doesn't hold up in an audit or after a breach.

What a good answer sounds like: "Here are the regulations that apply to your business, here's where you stand against each requirement, and here's the documentation that proves it." If there are gaps, your provider should be able to explain them in plain language and lay out a plan to close them.

Why This Matters More for SMBs
Larger companies usually have compliance teams and risk managers watching these details. Smaller businesses often don't, which means requirements can slip through the cracks until an audit, a contract review, or an insurance claim brings them to light. The good news is that many of the controls insurers and regulators ask for overlap with each other. Getting your security foundation right, and documenting it, protects your business, your coverage, and your customers all at once.

If your current provider can't answer these questions clearly and confidently, it's worth a conversation. Let's talk:

Next in the series: Employee Awareness. Follow along all month as we work through the questions every business should be asking.

10/29/2026

If your IT provider disappeared tomorrow, could your business keep running?

Part 7 of our Cybersecurity Awareness Month series covers documentation and vendor accountability: two questions that show whether you own the keys to your own systems or whether they're locked away with someone else. ⬇️

Documentation and Vendor Accountability: Who Holds the Keys If Your IT Provider

Most of this series has been about outside threats like ransomware, phishing, and stolen passwords. This article is about a risk many business owners never think about: what happens if your relationship with your IT provider ends?

Providers go out of business, get acquired, lose key staff, or simply stop being a good fit. Sometimes the person who knows how everything works is a single technician who retires, moves on, or becomes hard to reach. If all of the knowledge about your systems lives in that person's head or in a system only they can access, your business has a serious single point of failure.

For small and mid-size businesses that rely fully on an outside provider, this can be one of the biggest hidden risks there is. These two questions show whether your business is protected or dependent.

17. If our IT provider disappeared tomorrow, does someone else have documented access to every password, system, and configuration needed to keep the business running?

Think about everything your business runs on: email, your domain name, your website, firewalls, Wi-Fi, servers, cloud applications, backups, phone systems, and line-of-business software. Each one has admin credentials, settings, and license details. If you lost access to that information tomorrow, how long would it take to rebuild it?

For many businesses, the honest answer is "a very long time," and some things, like domain ownership or admin access to key accounts, can be painful and slow to recover. During that time, you may be unable to make changes, fix problems, or respond to a security incident.

What a good answer sounds like: "Every critical system, credential, and configuration is documented, stored securely, and accessible to a designated person at your company." Someone on your side, such as an owner or trusted manager, should know how to reach that information in an emergency. Ask when the documentation was last updated.

18. Do we own our own IT documentation and data, or is it locked inside a vendor's private system?

Some providers keep client documentation in their own proprietary tools and never share it. Everything may be well organized, but if you can't get to it, it isn't really yours. Some contracts even make it difficult or costly to get your information back when you leave.

The same applies to your data and accounts. Your domain, your Microsoft 365 or Google Workspace tenant, your software licenses, and your backups should be registered to your business, not to your IT provider. Otherwise, switching providers can turn into a slow and expensive untangling process.

What a good answer sounds like: "Your documentation, data, accounts, and licenses belong to you. You can get a full copy of your documentation at any time, and it's handed over in full if you ever move to another provider." A provider who is confident in their service shouldn't need to lock you in.

Why This Matters More for SMBs
Smaller businesses often depend on one provider, or even one person, for everything IT-related. That trust is important, but it shouldn't come at the cost of control. Clear documentation and ownership keep your business resilient no matter what happens to any single vendor, and they make it easier to recover quickly from an incident, because everything needed is already written down.

A good IT partner wants you to have this level of visibility. Transparency is a sign of a provider who is confident in the value they deliver.

If your current provider can't answer these questions clearly and confidently, it's worth a conversation. Let's talk: chrsolutions.com/cybersecurity/

Next in the series: Compliance and Cyber Insurance. Follow along all month as we work through the questions every business should be asking.

10/21/2026

Your defenses look good on paper. But have they ever been tested?

Part 6 of our Cybersecurity Awareness Month series covers vulnerability and pe*******on testing: two questions that show whether your IT provider is actively finding gaps or just assuming everything is fine. ⬇️

Vulnerability and Pe*******on Testing: Find the Gaps Before Attackers Do

Over the past five articles we've covered backups, monitoring, email security, access, and credential exposure. Every one of those defenses matters, but there's a simple question underneath all of them: do they actually work?

The only way to know for sure is to test them. That's where vulnerability scanning and pe*******on testing come in.

A vulnerability scan is an automated check that looks for known weaknesses, such as missing patches, outdated software, open ports, and misconfigured settings. A pe*******on test goes further. A trained security professional actively tries to break in, the same way a real attacker would, to see how far they can get.

Attackers are already probing small and mid-size businesses for weak spots, often with automated tools that scan thousands of targets at once. Testing lets you find those weak spots first, while fixing them is still cheap and quiet. These two questions show whether your provider is testing your defenses or just assuming they hold.

15. When was the last time our network was actually tested the way a real attacker would try to break in?
Many businesses have never had a pe*******on test. Others had one years ago and haven't repeated it, even though their environment has changed a lot since then. New employees, new cloud apps, remote work, and new devices all open up new possible ways in.

A security setup that looks solid on paper can still have gaps. One misconfigured firewall rule, a forgotten test server, or an old account with a weak password can be all it takes. Real-world testing finds the problems that checklists miss.

What a good answer sounds like: A specific date for your last test and a regular schedule going forward. Vulnerability scans should run often, ideally continuously or at least monthly. Pe*******on tests should happen at least once a year and after major changes to your systems. If the answer is "we've never needed one" or "I'm not sure," that's a gap worth closing.

16. Do we get a plain-English report of vulnerabilities and a plan to fix them, or just a clean bill of health with no detail?

A test is only valuable if it leads to action. Some providers hand over a one-line summary that says everything looks fine. Others deliver a dense technical report full of jargon that nobody on your team can understand or act on. Neither one actually makes your business safer.

A useful report explains what was found, why it matters to your business, and how serious each issue is. Then it gives you a prioritized plan to fix the problems, starting with the ones that carry the most risk.

Be wary of a perfect result with no detail. Almost every environment has something that can be improved. A report with no findings might mean the test wasn't thorough, not that everything is secure.

What a good answer sounds like: "You'll get a clear report that explains each finding in business terms, ranks them by risk, and includes a remediation plan with timelines. We'll walk you through it and confirm each fix once it's done." Ask to see a sample report if you haven't received one before.

Why This Matters More for SMBs
Smaller businesses often assume they're too small to need this kind of testing, or that it's only for large companies with big security budgets. In reality, attackers look for easy targets, and untested environments are often the easiest. Regular testing gives you a clear, honest picture of where you stand and a roadmap for getting stronger, so you aren't counting on luck.

If your current provider can't answer these questions clearly and confidently, it's worth a conversation with us: chrsolutions.com/cybersecurity/

Next in the series: Documentation and Vendor Accountability. Follow along all month as we work through the questions every business should be asking.

10/20/2026

Is your business keeping up with technology, or just keeping up with the problems it creates? 🔒

From cybersecurity threats to outdated IT systems, businesses have plenty to think about. Our Managed IT & Cybersecurity team is hitting the road to talk it through.

📍 HHCC Data Summit | Houston, TX | October 20
Susan will be connecting with business leaders on technology challenges and solutions.

📍 AZ Tech + Business Expo | Tucson, AZ | October 21
Immanuel will be talking with local business leaders about their IT challenges and what’s working.

Attending either event? Stop by and tell us what’s keeping your business up at night.

Houston Hispanic Chamber of Commerce Arizona Technology Council

10/16/2026

Who is watching your business for cyber threats when your team goes home? 🔒

Many small businesses don’t have a dedicated security team, and attackers know it. This Cybersecurity Awareness Month, come talk it through with Susan Kaufman at the Harris County Medical Society Business Expo in Houston this Saturday, October 17. She’ll share practical steps to strengthen your cybersecurity, no jargon required.

10/15/2026

Your company's passwords could be for sale right now, and you'd never know it.

Part 5 of our Cybersecurity Awareness Month series covers dark web and credential exposure: two questions that show whether anyone is watching for stolen credentials before attackers use them. ⬇️

Dark Web and Credential Exposure: Your Passwords May Already Be for Sale

In Part 4 we talked about attackers who log in instead of breaking in. That raises an obvious question: where do they get the passwords?

Often the answer is the dark web, a hidden part of the internet where stolen data is bought, sold, and traded. When a website, app, or service gets breached, the usernames and passwords taken in that breach often end up in large collections called "breach dumps." Attackers buy or download them and start testing those credentials against other systems.

Your business doesn't have to be the one that was breached for this to affect you. If an employee used their work email to sign up for a shopping site, a webinar platform, or a vendor portal that was later breached, your company's information could be in one of those dumps right now. If that employee reused the same password at work, an attacker may already have what they need to get in.

These two questions show whether anyone is watching for that exposure.

13. Are our company's credentials and domains actively monitored for exposure on the dark web?

Most businesses have no idea whether their employees' credentials have shown up in a breach. It isn't something you can check once and forget. New breaches happen constantly, and stolen data can surface months or even years after the original incident.

Dark web monitoring watches breach dumps, criminal marketplaces, and other sources for anything tied to your company's email domain. When your information appears, you get an alert, which gives you a chance to act before an attacker does.

What a good answer sounds like: "Yes, your domain is monitored continuously, and we're alerted when company credentials show up in a new exposure." Ask how often you'll see reports and what's included, such as email addresses, passwords, and any other company data that's been exposed.

14. If an employee's password showed up in a breach dump today, would anyone find out before an attacker does?

Monitoring is only useful if someone acts on what it finds. An alert that sits unread in an inbox does nothing to protect your business. Attackers move fast once new credentials become available, so the window between exposure and misuse can be short.

A strong response process turns an alert into action. That means confirming which account is affected, forcing a password reset, making sure MFA is turned on, and checking whether there's been any suspicious activity on that account already.

What a good answer sounds like: A defined process with clear ownership. "When an exposure alert comes in, we confirm it, reset the affected password, verify MFA, review recent login activity, and let you know what happened." If nobody can tell you who acts on these alerts, you aren't really protected.

Why This Matters More for SMBs
Small and mid-size businesses rarely have someone watching for this kind of exposure, which makes them easy targets for attackers who buy stolen credentials in bulk. Password reuse makes it worse. One employee using the same password for a personal account and a work account can open the door to your entire business.

Dark web monitoring paired with fast action, enforced MFA, and good password habits closes that door before someone walks through it.

If your current provider can't answer these questions clearly and confidently, it's worth a conversation. Let's talk: chrsolutions.com/cybersecurity/

Next in the series: Vulnerability and Pe*******on Testing. Follow along all month as we work through the questions every business should be asking.

10/13/2026

Attackers don't always break in. More and more, they just log in.

Part 4 of our Cybersecurity Awareness Month series covers access, passwords and identity: three questions about MFA, offboarding and admin rights that show who really has the keys to your business. ⬇️

Access, Passwords and Identity: Who Really Has the Keys?
Many attacks today don't involve breaking in. Attackers log in. With a stolen, guessed, or reused password, they can walk into your email, file storage, and business applications looking just like one of your employees.

That makes identity the new security perimeter. The question is no longer only "is our network protected?" It's "who can get into our systems, how do we know it's really them, and what can they do once they're in?"

For small and mid-size businesses, access tends to grow over time without anyone stepping back to review it. Accounts pile up, old employees linger in systems, and too many people end up with admin rights "just to make things easier." These three questions help you find out whether anyone is managing the keys to your business.

10. Is multi-factor authentication enforced on every critical system, or optional?
Multi-factor authentication (MFA) requires a second proof of identity, such as a code from an app or a prompt on your phone, on top of a password. It's one of the most effective ways to stop attackers who have stolen a password, because the password alone isn't enough to get in.

The key word in this question is enforced. When MFA is optional, some people turn it on and others don't, and attackers only need to find one account without it. It also needs to cover more than email. Remote access, financial systems, cloud applications, and admin accounts are all high-value targets.

What a good answer sounds like: "MFA is required on every critical system, for every user, with no exceptions we haven't documented." Ask which systems are covered and whether any accounts are exempt.

11. When an employee leaves the company, how quickly is their access to every system fully revoked?
Offboarding is one of the most common gaps we see. An employee leaves, their main login gets disabled, but access to a cloud app, a shared mailbox, the payroll portal, or a vendor system stays active for weeks or months. Sometimes nobody remembers the account exists at all.

Those leftover accounts are a risk whether the departure was friendly or not. A former employee may still have access they shouldn't, and an unused account that nobody watches is an easy target for an attacker.

What a good answer sounds like: A documented offboarding checklist that covers every system, not just email, and access removed on or before the employee's last day. Your provider should also be able to produce a current list of active accounts so you can confirm no former employees are on it.

12. Are administrative and privileged accounts limited to only the people who truly need them?
Admin accounts can install software, change security settings, create new users, and access sensitive data. If an attacker takes over one of these accounts, they can do almost anything, including turning off your defenses and deleting your backups.

In many smaller businesses, admin rights get handed out for convenience. The owner has them, the office manager has them, and a few employees got them years ago to install a program and never lost them. Every extra admin account is another way for an attacker to take control.

What a good answer sounds like: Admin access limited to the few people who need it, separate admin accounts used only for admin tasks (not for everyday email and browsing), MFA on all of them, and regular reviews of who has elevated access and why.

Why This Matters More for SMBs
In a smaller business, one compromised account can reach almost everything. There often aren't extra layers between an employee's login and your finances, customer data, or core systems. Enforcing MFA, cleaning up old accounts, and limiting admin rights are some of the most affordable, high-impact steps an SMB can take. They make a stolen password far less valuable to an attacker.

If your current provider can't answer these questions clearly and confidently, it's worth a conversation. Let's talk: chrsolutions.com/cybersecurity/

Next in the series: Dark Web & Credential Exposure. Follow along all month as we work through the questions every business should be asking.