BLUE SCORPION LABS · TEXAS

Security & Compliance Information

Updated October 4, 2026

Security requirements vary by project, data type, industry, and jurisdiction. This page describes the current website and how to discuss security requirements for a proposed engagement.

Current website safeguards

• The website is delivered through Cloudflare over HTTPS.
• Consultation fields have required-field checks and length limits.
• The form uses FormSubmit’s spam-prevention process and a hidden spam-trap field.
• The public form does not request attachments, passwords, or payment information.

HTTPS protects the browser connection; it does not make ordinary email an appropriate channel for sensitive project data. Contact us to agree on a suitable transfer method before sharing confidential materials.

Discussing project security

Before an engagement, request documentation of the safeguards relevant to your work: access controls and MFA, data handling and retention, encryption, secure development, vulnerability remediation, incident handling, subcontractors, and business continuity. The applicable agreement should identify responsibilities and required controls. Specific internal controls and response time commitments are not represented by this website.

Federal, Texas, and other state requirements

Applicable requirements depend on the organization, services, data, and client location. Privacy, security, and notification obligations should be identified for each engagement. Being based in Texas does not limit obligations to Texas law. Compliance consulting services do not constitute legal advice or a blanket assurance that every federal or state requirement has been met.

Potential requirements may include applicable Texas privacy and breach-notification laws, other state privacy laws, federal requirements, and sector-specific obligations. References to HIPAA, PCI DSS, SOC 2, ISO 27001, or NIST describe possible engagement requirements or frameworks; they are not claims that Blue Scorpion Labs holds a certification or attestation.

Framework-based consulting and assessment

We can scope consulting around NIST SP 800-53 Rev. 5 security and privacy controls, ISO/IEC 27001:2022 information security management requirements, and OWASP Top 10:2025 web application risks. Applicable controls, assessment methods, evidence, responsibilities and deliverables are agreed in writing for each engagement. These references do not establish that Blue Scorpion Labs is certified, that every control is implemented, or that this website has passed a complete assessment.

NIST SP 800-53

Selected control areas can include access and authentication, audit records, secure configuration, risk assessment, incident response, system integrity, communications protection and supplier risk. Control selection and tailoring depend on the system and its requirements; a crosswalk alone does not prove equivalence or compliance. Official NIST control catalog and updates.

ISO/IEC 27001

Engagements can support information security management scope, risk assessment and treatment, control applicability, policies, evidence, management review and continual improvement. Certification requires a separate assessment by an appropriate certification body. Official ISO/IEC 27001 overview.

OWASP Top 10 testing

Authorized web application assessments can use OWASP Top 10:2025 to organize risk-based test coverage. Before testing, agree written permission, targets, exclusions, test accounts, timing, data handling and escalation contacts. Deliverables can include findings, evidence, severity, remediation guidance and retest results. Coverage should reflect application behavior and may extend beyond the Top 10. Official OWASP Top 10:2025.

Report a website security concern

Email help@bluescorpionlabs.com with the affected page, a concise description, and non-sensitive reproduction details. Do not include credentials or other people’s data. This reporting channel does not authorize penetration testing, denial-of-service testing, social engineering, or testing of client or provider systems. Request written authorization before conducting tests. No bug-bounty payment, safe-harbor promise, or fixed response time is offered here.

Incidents and client obligations

If an incident occurs, applicable notification and response duties depend on the facts, law, and client contracts. Contact us about any suspected exposure involving information submitted to this website. This contact channel is not advertised as an emergency or continuously monitored SOC hotline.