Compliance Services
Prove it, don't just claim it
Regulators, insurers and partners want evidence that your data is protected. Our Compliance plan pairs technical safeguards with written policies, continuous monitoring and audit-ready documentation.
Why it matters
What's at stake for your business
The rules are specific
HIPAA, the FTC Safeguards Rule, FINRA and CMMC each spell out controls, documentation and notification duties.
Evidence matters
In an audit or after an incident, what counts is what you can show, not what you believe is in place.
It never stops
Compliance is an annual cycle of review, training and updates, not a one-time project.
What's included
Everything Compliance Services covers
Gap assessment and risk analysis
A review against your framework with a prioritized remediation roadmap.
Policies and procedures
Written for your framework and your organization, not generic templates.
Security controls
Access controls, MFA, encryption, endpoint protection, logging and email security.
Continuous monitoring and SIEM
Security events detected and responded to, with logs retained as evidence.
Training
Simulated phishing and security training with documented completion tracking.
Vendor risk
Third-party and vendor risk assessment and documentation.
Audit preparation
Evidence collection and reporting for exams and attestations.
Incident response and annual review
Procedures that meet each framework's notification rules, reviewed every year.
How it works
How we deliver it
- 01
Assess
We identify which frameworks apply and measure the gaps.
- 02
Remediate
Controls are implemented and policies written, highest risk first.
- 03
Monitor
Continuous monitoring and training keep you compliant day to day.
- 04
Prove
Evidence is collected all year, so audits and questionnaires are straightforward.
Is it right for you?
A strong fit if…
- You handle patient, financial, card or defense information
- You've been asked to complete a security questionnaire or audit
- You're not sure which regulations apply to your business
- Your written policies are missing or out of date
Not sure? A free assessment reviews your environment and tells you plainly what you need and what you don't.
How it's delivered
We don't sell services one at a time. This service is delivered through our plans, priced on your actual devices, users and servers, so you only pay for what you have.
- Monitoring Proactive monitoring and protection, with support when you need it. Built for businesses with in-house IT.
- Managed A fully managed IT department: help desk, security, backup and vendor coordination.
- Compliance Everything in Managed, plus the monitoring, training and reporting regulated industries need.
A free assessment tells you which plan fits and gives you an exact monthly quote.
Get a free assessmentWhere do we start if we are not sure which regulations apply to us?
Start with what data you handle: patient records, financial or tax data, card payments, defense information or personal data of customers. Each points to a framework. The industry picker on our compliance section shows the usual ones, and a free assessment confirms exactly what applies to your business and where your gaps are.
What does a medical or dental practice need to be HIPAA compliant with its IT?
The HIPAA Security Rule requires a documented risk analysis, written policies, access controls, audit logging, encryption where appropriate, workforce training, backup and contingency plans, and business associate agreements with vendors that touch patient data. Compliance is ongoing, not a one-time checklist. Our Compliance plan covers the risk analysis, the technical safeguards and the documentation you need if you are ever audited.
Does the FTC Safeguards Rule apply to accounting firms and tax preparers?
Yes. Tax preparers, accountants, mortgage brokers and many other non-bank financial businesses are covered under the Gramm-Leach-Bliley Act. The rule requires a written information security program, a qualified person in charge of it, a risk assessment, MFA, encryption of customer information, and reporting certain breaches to the FTC. We build and maintain that program for you.
What do FINRA and SEC rules expect from a financial advisory firm's IT?
Regulators expect written cybersecurity policies, protection of customer information, email and record retention, vendor oversight and an incident response plan. The SEC's amended Regulation S-P also requires a program for detecting and responding to unauthorized access to customer information and notifying affected customers. Our Compliance plan maps controls and documentation to these requirements so you are ready for an exam.
We are a defense subcontractor. What do NIST 800-171 and CMMC mean for us?
If you handle controlled unclassified information (CUI) for the Department of Defense, your contracts require the NIST SP 800-171 security controls, and CMMC is the program that verifies them. Start with a gap assessment against the controls, then a system security plan and a remediation roadmap. We perform the assessment and implement the technical controls, monitoring and documentation.
Get started
Let's find out where your technology stands
Start with a free assessment. We'll review your environment and give you straight answers, with no obligation.
Harrisburg office
5520 Derry Street
Harrisburg, PA 17111
Mon–Fri 8am–6pm · Sat 10am–5pm