What are the opening hours?

Monday 8am - 6pm Tuesday 8am - 6pm Wednesday 8am - 6pm Thursday 8am - 6pm Friday 8am - 6pm

Briggs I.T. Services

Name: Briggs I.T. Services
Address: The Woodlands, TX, US
Telephone: +1 832-304-1850

Home
United States
The Woodlands, TX
Briggs I.T. Services

Texas SMB Compliance & Cybersecurity for Law Firms, RIAs, CPA Firms and Tax Preparation Practices | The Woodlands, TX | CIS Controls Supporter

10/30/2026

The old advice was to watch for bad spelling in a phishing email. What happens when the attacker has an AI writing assistant too?

NIST's Generative AI Profile, AI 600-1, addresses it in §2.9, Information Security. It names two primary risks. G*I could lower the barriers for, or ease automated exercise of, offensive cyber capabilities. And it expands the attack surface, because G*I itself is vulnerable to attacks like prompt injection or data poisoning.

On the first, NIST says offensive capabilities advanced by G*I may augment attacks such as hacking, malware, and phishing.

The profile is voluntary and requires nothing of your practice. Its one specific link to Texas law is narrow: under Tex. Bus. & Com. Code §552.105(e)(2)(D), a defendant may not be found liable for a violation it discovers through an internal review process while substantially complying with the most recent version of the profile or another recognised AI risk framework.

What is required already sits elsewhere. For a business completing income tax returns, the FTC Safeguards Rule, 16 CFR §314.4(e)(1), requires security awareness training for your personnel, updated as necessary to reflect risks identified by your risk assessment.

Want the plain-English map of what a Texas tax practice owes? Type briggssocial.com/tax into your browser, or email [email protected] and we will send it over.

https://briggssocial.com/tax

10/30/2026

A client waiting in your lobby asks for the Wi-Fi password. Which network do they end up on: the one your staff use for tax returns, or a separate one?

IRS Publication 5708, the IRS template for a Written Information Security Plan, lists Wi-Fi access among the policies it suggests every plan include, and gives sample wording:

A. Wireless access points will use strong encryption. Firm Wi-Fi will require a password. If open Wi-Fi is made available for clients, it will be on a different network and Wi-Fi node from the firm's private, work-related Wi-Fi.

B. Devices with wireless capability, such as printers, all-in-one copiers, fax machines, and smart TVs, will have default factory passwords changed to firm-assigned passwords. If that is not done, the device is disabled from wireless capability or replaced with a non-wireless device.

That wording is the IRS's suggestion, not a rule. What is required, for a business completing income tax returns, is the written plan itself: the FTC Safeguards Rule, 16 CFR §314.3(a), requires a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your firm.

Want the plain-English map of what a Texas tax practice owes? Type briggssocial.com/tax into your browser, or email [email protected] and we will send it over.

https://briggssocial.com/tax

10/30/2026

Quick question for Texas tax practices thinking about the state's cybersecurity safe harbor: do you have to choose a single framework?

No. Tex. Bus. & Com. Code §542.004(b)(1) says a program conforms if it conforms to a current version of, or any combination of current versions of, the frameworks the statute lists. Those include the NIST Cybersecurity Framework, NIST special publications 800-171 and 800-53, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the Secure Controls Framework, SOC 2 Type 2, and other similar industry frameworks.

For a business subject to it, §542.004(b)(2) also counts the current version of Title V of the Gramm-Leach-Bliley Act, the federal law behind the FTC Safeguards Rule, which covers tax preparation firms.

Two things to keep straight. First, the safe harbor is optional. A firm that meets Chapter 542 can bar exemplary damages in a lawsuit arising from a breach, and that is all it does. Section 542.005 says the chapter creates no duty and no private cause of action. Second, conforming to a framework is only one of the program requirements in §542.004(a); the program also has to match the firm's size band.

We keep a plain-English guide to what a Texas tax practice owes. Grab it at briggssocial.com/tax , or email [email protected] and we will send it over.

https://briggssocial.com/tax

10/29/2026

An AI drafting tool puts a made-up citation in a brief, and someone catches it before filing. Then what? Is the near miss written up, or forgotten by Friday?

NIST's Generative AI Profile, AI 600-1, treats the follow-up as governance. Action GV-1.5-002: "Establish organizational policies and procedures for after action reviews of G*I system incident response and incident disclosures, to identify gaps; Update incident response and incident disclosure processes as required."

Three parts: a standing policy for the review, a look for gaps, and an update to the process afterwards.

The legal status, plainly. The profile is voluntary. It requires nothing of your firm.

Its one specific link to Texas law is narrow. Under Tex. Bus. & Com. Code §552.105(e)(2)(D), part of the Texas Responsible AI Governance Act, a defendant may not be found liable for a violation it discovers through an internal review process while substantially complying with the most recent version of that profile or another recognised AI risk framework. It is tied to discovering the problem, not to adopting the framework.

Want the plain-English map of what a Texas law firm owes? Type briggssocial.com/law into your browser, or email [email protected] and we will send it over.

https://briggssocial.com/law

10/29/2026

Heads up to Texas CPA firms: after a data breach, the list of people you may need to tell is longer than your clients.

IRS Publication 4557, Safeguarding Taxpayer Data, suggests considering notice to consumers, to law enforcement where the breach may involve a crime, and to the credit bureaus and other businesses that may be affected. It also suggests that practitioners who experience a data loss contact the IRS and the states. These are steps the publication tells you to consider, not rules on their own.

Texas law makes some of it mandatory. Tex. Bus. & Com. Code §521.053(h) says that if you are required to notify more than 10,000 people at one time, you must also notify each nationwide consumer reporting agency of the timing, distribution and content of the notices, without unreasonable delay.

And separately, the Texas State Board of Public Accountancy's rule 22 TAC §501.75(d) requires a CPA in client practice to notify an affected client in writing immediately on becoming aware of a loss of, or loss of control over, the confidentiality of client records.

Working out who goes on that list is easier before an incident than during one.

We keep a plain-English guide to what a Texas CPA firm owes. Grab it at briggssocial.com/cpa , or email [email protected] and we will send it over.

https://briggssocial.com/cpa

10/28/2026

If the owner of an advisory firm is also its board, who reports to whom on security, and does it have to be in writing?

For a state-registered adviser at or above the FTC rule's size line, yes. 16 CFR §314.4(i) requires your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body. If no such body exists, the report goes, timely, to a senior officer responsible for your information security program.

The report has two required parts. The first, (i)(1): the overall status of the information security program and your compliance with this part. The second, (i)(2), covers material matters such as risk assessment, service provider arrangements, results of testing, security events, and recommendations for changes.

Scope first, though. The rule covers investment advisers that are not required to register with the SEC (§314.1(b)). SEC-registered advisers answer to the SEC under Regulation S-P, so confirm which side your firm is on.

And size. §314.6 says (i) does not apply to a financial institution maintaining customer information on fewer than five thousand consumers.

Want the plain-English map of what a Texas RIA owes? Type briggssocial.com/ria into your browser, or email [email protected] and we will send it over.

https://briggssocial.com/ria

10/28/2026

Quick question for Texas law firms: when a new laptop arrives, is there a written standard for how it gets set up, or does it depend on who unboxes it?

Texas statute asks for reasonable procedures to protect the sensitive personal information you hold. Bus. & Com. Code §521.052(a) requires a business to implement and maintain them, including any appropriate corrective action. How your devices and software are configured can be one of those procedures.

The CIS Critical Security Controls (CIS Controls) describe a way to make that repeatable. CIS Safeguard 4.1 reads: "Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard."

Note the scope: portable and mobile devices, non-computing and IoT devices, and servers, as well as the operating systems and applications on them.

The CIS Controls do not obligate your firm to anything. They are one method you can choose.

We keep a plain-English guide to what a Texas law firm owes. Grab it at briggssocial.com/law , or email [email protected] and we will send it over.

The CIS Critical Security Controls (CIS Controls) are a product of the Center for Internet Security, Inc. (CIS). Briggs IT Services, LLC is a CIS Controls Supporter.

https://briggssocial.com/law

10/27/2026

Texas law firms: a signed document arrives by email, or a file comes back from an AI tool. How would your firm check that it is what it claims to be?

NIST's Generative AI Profile, AI 600-1, treats that as something to measure. Action MS-1.1-002: "Integrate tools designed to analyze content provenance and detect data anomalies, verify the authenticity of digital signatures, and identify patterns associated with misinformation or manipulation."

Four jobs in one line: where content came from, what looks out of place, whether a signature is genuine, and signs of manipulation.

Now the legal status, plainly. The profile is voluntary. It requires nothing of your firm.

It has one specific link to Texas law. Under Tex. Bus. & Com. Code §552.105(e)(2)(D), part of the Texas Responsible AI Governance Act, a defendant may not be found liable for a violation it discovers through an internal review process while substantially complying with the most recent version of that profile or another recognised AI risk framework.

That is narrow. It is tied to finding the problem yourself, through your own review. Adopting the framework on paper is not a shield.

Want the plain-English map of what a Texas law firm owes? Type briggssocial.com/law into your browser, or email [email protected] and we will send it over.

https://briggssocial.com/law

10/27/2026

Heads up to Texas law firms: Rule 1.15 is not only about keeping client money in the right account. It also tells you how fast you have to tell the client about it.

Texas Disciplinary Rule of Professional Conduct 1.15(b) says that when a lawyer receives funds or other property in which a client or a third person has an interest, the lawyer shall promptly notify them. The lawyer shall also promptly deliver whatever they are entitled to receive, except as the rule, the law or an agreement with the client permits otherwise. And if they ask, the lawyer shall promptly give a full accounting.

That last part depends on paragraph (a). It requires complete records of trust account funds and other client property, kept for five years after the representation ends.

So the question for a firm is a practical one. If a client asked tomorrow for a full accounting of what you have held for them, could you produce it promptly from records that are complete and still intact?

We keep a plain-English guide to what a Texas law firm owes. Grab it at briggssocial.com/law , or email [email protected] and we will send it over.

https://briggssocial.com/law

10/26/2026

Your paralegal emails a client's file to the wrong address. Your IT contractor leaves a backup drive unencrypted. Under the Texas rules, whose problem is that?

Two Texas Disciplinary Rules work together here.

Rule 8.04(a)(1): a lawyer shall not violate these rules, knowingly assist or induce another to do so, or do so through the acts of another, whether or not the violation occurred in the course of a client-lawyer relationship.

Rule 5.03 covers nonlawyers employed or retained by or associated with a lawyer.
(a) A lawyer with direct supervisory authority over the nonlawyer shall make reasonable efforts to ensure the person's conduct is compatible with the lawyer's professional obligations.
(b) A lawyer is subject to discipline for that person's conduct, if it would violate the Rules if done by a lawyer, where the lawyer orders, encourages, or permits it; or where the lawyer is a partner or has direct supervisory authority and, knowing of the misconduct, knowingly fails to take reasonable remedial action.

The official comment to 5.03 points to the obligation not to disclose information relating to the representation as a particular subject for instruction and supervision.

Want the plain-English map of what a Texas law firm owes? Type briggssocial.com/law into your browser, or email [email protected] and we will send it over.

https://briggssocial.com/law

Address

The Woodlands, TX

Opening Hours

Monday	8am - 6pm
Tuesday	8am - 6pm
Wednesday	8am - 6pm
Thursday	8am - 6pm
Friday	8am - 6pm

Telephone

+1 832-304-1850

Website

https://briggsitservices.com/

Alerts

Be the first to know and let us send you an email when Briggs I.T. Services posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.