Free Cybersecurity Help on the Central Coast: An Honest List

Why this page exists

Jacob Keith runs a one-person security firm in Lompoc, and part of being useful is telling people when they do not need to pay him. A lot of good security knowledge is free. The trick is knowing which program fits your business and where each one stops.

Keith Systems is not a member of, partner of or referral source for any program listed here. This is simply the list Jacob would want a friend in Santa Maria or Arroyo Grande to have.

Free counseling and training

EDC SBDC (Small Business Development Center). Serves Santa Barbara and Ventura counties with free one-on-one business counseling. From October 1, 2026 through April 7, 2027, it is running a free small-business cybersecurity webinar series. Two October sessions worth a look: "Fast Cybersecurity Tips for Smart Business Owners" (Tuesday, October 13, 2026, 10:00 am) walks through what to do the second you suspect a bad click, and "Safe Tech, Safe Business: Evaluating Online Tools & AI for Privacy" (Thursday, October 22, 2026, 1:00 pm) covers choosing online and AI tools without leaking client data. Both are free and online; check the EDC events calendar for registration. Our own phishing click checklist pairs well with the first one. One session is aimed at accountants and covers the written information security program (WISP) required under the FTC Safeguards Rule and GLBA. Census County Business Patterns (2023) counts about 214 accounting, tax and payroll firms in Santa Barbara County and about 149 in San Luis Obispo County, so that session is relevant to a lot of local offices. If you are in San Luis Obispo County, ask the SBDC network which center serves your area.

SCORE Santa Barbara County. Free volunteer business mentoring. Mentors are generalists, so cybersecurity depth varies by person. SCORE is a good place to think through budgets, vendor contracts and how security fits your business plan.

Golden State APEX Accelerator. Free government-contracting counseling for small businesses in Santa Barbara, San Luis Obispo, Ventura and Kern counties. If you sell to primes near Vandenberg Space Force Base, or want to, this is where to get help understanding contract clauses, registrations and the Supplier Performance Risk System (SPRS). Counseling helps you understand obligations. It does not carry out the technical NIST SP 800-171 work for you. For that side, see CMMC readiness for defense suppliers.

Free federal services and tools

CISA Cyber Hygiene Vulnerability Scanning. CISA offers free, recurring scans of internet-facing systems, with regular reports, to eligible organizations. That includes government entities and public and private critical infrastructure organizations, and water and wastewater systems are part of critical infrastructure. Small community water systems and water districts on the Central Coast should look into it. CISA decides eligibility, so if you are unsure whether your organization counts, ask them. Details are on CISA's Cyber Hygiene services page.

EPA cybersecurity help for water systems. EPA offers free cybersecurity assessments and technical assistance to drinking water and wastewater utilities, including small systems. If you operate a small water system, search EPA's water sector cybersecurity pages and pair that help with CISA scanning.

CISA resources for small businesses. CISA publishes free, plain guidance, including Cyber Essentials for small business leaders, phishing and MFA guidance, and the Known Exploited Vulnerabilities catalog, which is useful for asking your IT provider whether specific flaws are patched. Start at cisa.gov.

FTC small business cybersecurity materials. The FTC has free small-business cybersecurity guides, along with plain-language guidance on the Safeguards Rule for tax preparers, accountants and other financial-type businesses.

HHS for medical and dental offices. HHS publishes HIPAA Security Rule guidance and a free Security Risk Assessment Tool. It is a reasonable starting point for a small practice. The current Security Rule is what is enforceable today. The proposed 2025 overhaul is not yet a compliance deadline.

NIST. Defense suppliers can read NIST SP 800-171 Rev. 2 and its assessment guide free at csrc.nist.gov.

What about grants?

Here is the honest answer. The Cal OES State and Local Cybersecurity Grant is for local governments and tribes only, not private businesses. Jacob looked for direct cybersecurity grants for private small businesses at CalOSBA and the SBA and found none.

Be careful with anyone who promises "grant-funded" security for a private business. Ask for the exact program name and confirm it with the agency. If you run a nonprofit, church or district, see nonprofits, churches and districts. Local government agencies can ask Cal OES directly about eligibility.

What free help does well, and where it stops

Free programs are excellent for education, baselines, templates and understanding what rules apply to you. Attend the webinars. Read the FTC and CISA guides. Many owners find they can handle the first round of fixes themselves.

Free help usually stops short of three things:

• Someone actually reviewing your network, accounts, firewall rules and written policies
• Written findings tied to your specific setup, prioritized for your budget
• Documentation you can stand behind when an insurer, a prime contractor or HHS asks questions

When paid help makes sense

Consider paying for a scoped review when:

• Your cyber insurance questionnaire asks about MFA, endpoint detection, tested backups or an incident response plan, and you cannot answer honestly. See the insurance questionnaire guide.
• Your practice has never done a HIPAA risk analysis, or the last one is years old. See HIPAA security risk analysis.
• You handle controlled unclassified information for a defense contract and must affirm a score in SPRS.
• Your tasting room, ag office or clinic has printers, thermostats, point-of-sale terminals, cameras and door controllers on the same network as payroll. See connected device network security.
• You had a near miss and realized nobody knows the California 30-day breach notification rule.

A sensible order

1. Attend an SBDC webinar or read the FTC and CISA small business basics.
2. Turn on MFA for email, admin accounts and banking. The Microsoft 365 security checklist helps.
3. If you sell to the government, talk to the APEX Accelerator. If you run a water system, contact CISA and EPA.
4. If you still need someone to review your actual setup, book a free security consult or call (805) 800-8163. Jacob will tell you if a free resource fits better.