Compliance comes down to controls you can prove
Most compliance rules ask the same core question: can you show that sensitive data is protected? That means access controls, multi-factor authentication, encryption, patching, backups, training and logs, plus the written policies that describe them. We put those controls in place, keep them running and keep the evidence ready.
HIPAA for medical and dental offices
We provide HIPAA compliance training for staff and support the systems and controls behind your risk analysis or audit: encryption, MFA, access reviews, backups and audit logs. Your practice, or a qualified assessor you choose, performs the risk analysis itself. We make sure what it finds can be fixed.
CMMC preparation for defense suppliers
Defense suppliers that handle Federal Contract Information or Controlled Unclassified Information need to meet CMMC Level 1 or Level 2, which follows NIST SP 800-171. We help you prepare: scoping, a gap review, a plan of action, policies and the security controls themselves. We do not perform the formal assessment or certify companies; that is done by an authorized assessment organization. Our CMMC Level 2 preparation guide explains the steps.
FTC Safeguards Rule for accounting and tax firms
Tax preparers and many financial firms fall under the FTC Safeguards Rule, which requires a written information security program, MFA, encryption and staff training. We put the technical controls in place and help you document them.
Controls you can show
Insurers, auditors and large customers increasingly ask for proof. We keep documentation current, export reports on demand and help you answer security questionnaires accurately.
What we do, and what stays with others
Compliance work involves several roles, and it helps to be clear about ours. We put the technical controls in place, run them every day and produce the evidence that they work. Your organization owns its policies and decisions. For HIPAA, your practice or an assessor you choose performs the risk analysis, and we implement the controls it calls for. For CMMC, a certified third-party assessment organization performs the formal assessment, and we help you prepare for it. Your attorney advises on legal duties. Keeping those roles clear avoids gaps and avoids paying twice for the same work.
Cyber insurance is a compliance framework too
For many small businesses, the strictest security requirements now come from their cyber insurer rather than a regulator. Applications ask about MFA on email and remote access, endpoint detection and response, backups kept separate from the network, security training and patching. A wrong answer can lead to a denied claim. We help you put each control in place and answer the questionnaire accurately. See our guide to cyber insurance security requirements.
Evidence that holds up
An auditor or insurer will not take “we do that” on trust. Evidence means records: MFA enrollment reports, patch reports, backup test results, training completion, access reviews, device encryption status and a log of security incidents and how they were handled. We collect these as part of normal work, so preparing for a review is a matter of exporting reports rather than a scramble.
Ready for a breach, not just an audit
Most regulations and every state require notice when personal information is exposed. Good controls, such as encryption and logging, can mean the difference between a non-event and a notice to thousands of people. Our guide to data breach notification laws explains the deadlines by state and the federal rules that sit on top.
Rules we help clients meet
- HIPAA for medical and dental practices and the businesses that handle patient data for them.
- The FTC Safeguards Rule for tax preparers, CPA firms, mortgage brokers and other non-bank financial businesses.
- CMMC and NIST SP 800-171 for defense suppliers that handle federal contract information or CUI.
- SEC Regulation S-P for registered investment advisers and broker-dealers.
- PCI DSS basics for offices that take card payments, such as keeping card data off ordinary workstations.
- State privacy and breach laws, including the Texas, California, Colorado and Washington rules that apply to customer data.
Getting started
We start with a gap review against the rule that applies to you, then turn it into a ranked list of fixes, a timeline and the evidence each control will produce.
Where we work
We support compliance for businesses in 20 major US cities and other US cities, as part of full managed IT.