Compliance
Compliance Services
Regulated organizations have to prove their security, not just have it. We run the compliance program alongside the IT.
Compliance tied to your IT, not a binder on a shelf
Because we already run your monitoring, security, backup and patching, the evidence an auditor wants comes straight from those systems: Netwrix audit reports, Huntress alerts, penetration test and scan results, backup test records and patch reports.
Industry Requirements
HIPAA, FTC Safeguards, GLBA, CJIS, CMMC, PCI DSS, NIST and cyber insurance.
What your compliance program includes
We run your program in Compliance Scorecard, a platform built for managing policies, controls and evidence across the frameworks that apply to you.
- Policy review and creation: we review your existing policies against the requirements that apply to you, then write the ones that are missing and revise the ones that are out of date, so your policies match how you actually operate.
- Employee policy acknowledgment: your staff read and acknowledge the policies that apply to them, and each acknowledgment is recorded for your auditor or examiner.
- Compliance training for employees: security awareness and compliance training, with completion tracked by employee and reported to your leadership.
- Structured access to your compliance portal: the people who need it get their own login to Compliance Scorecard, to see your policies, controls, evidence and progress at any time.
- Evidence from the systems we already run: the platform pulls evidence from tools such as Microsoft 365, so preparing for an audit is not a scramble for screenshots.
- Reporting you can hand to an examiner: progress reported against recognized frameworks such as NIST and CIS, alongside HIPAA, FTC Safeguards and GLBA requirements.
Ongoing program
- Quarterly compliance review with your leadership
- Annual policy review
- Support during audits and examinations
Compliance professional services
Need a project rather than a program? Our engineers deliver compliance work as fixed-price professional services engagements, quoted complete up front.
Assess and plan
- Gap assessments against HIPAA, FTC Safeguards, GLBA, NIST, CIS or CMMC
- Risk assessments with a prioritized remediation plan
- Cyber-insurance application and renewal support
Write and document
- Written information security programs (WISP)
- Security policies and procedures written to how you operate
- Incident response and disaster recovery plans
Prove and maintain
- Qualified individual services for the FTC Safeguards Rule
- Audit and examination preparation and support
- Incident response tabletop exercises
- Vendor risk reviews and annual board reports
Technical fixes found along the way (multifactor authentication, encryption, logging, segmentation, backup) are scoped and delivered by the same team, so the findings actually get closed.
Available to managed and co-managed clients, and as a standalone service.
Download the one-page overview
Where do you stand today?
Book a compliance readiness assessment.
Call 812-476-6662 or send us a note below.