Industry Requirements

HIPAA

Healthcare and dental practices: risk analysis, safeguards, access logging and business associate documentation.

FTC Safeguards Rule

Auto dealerships and other non-bank financial businesses: a qualified individual, a written program, penetration testing and vulnerability scanning, and an annual report to the board.

GLBA and FFIEC

Banks: information security programs and evidence for examinations.

CJIS

Public safety and local government: access control, audit logging and physical security for criminal justice information.

CMMC and NIST 800-171

Manufacturers and suppliers to the Department of Defense: readiness assessments, the remediation to close the gaps, and the documentation an assessor will ask for. Certification itself is performed by an accredited third-party assessor.

PCI DSS

Businesses that take card payments, such as dealerships, retail and medical offices: the annual self-assessment questionnaire, network segmentation and the required vulnerability scans.

FERPA

Schools: protecting student records, controlling who can see them, and keeping the access logs to show it.

Cyber insurance

Answers and evidence for insurance questionnaires and renewals: multifactor authentication, backups, endpoint detection and training records.

NIST Cybersecurity Framework

Any organization: the common standard that cyber insurers, boards and local governments recognize, used to measure where you stand and plan what comes next.

CIS Controls

Any organization without a specific regulator: a practical, prioritized set of security safeguards, and the baseline we report your progress against.