Service 05 · Compliance
Compliance is faster when the security is already built in.
Every client runs on our standard, so compliance work focuses on scoping, documentation and evidence instead of rebuilding your environment.
Defense contractors
If you handle Federal Contract Information or Controlled Unclassified Information, CMMC sets the bar. CMMC Level 2 is built on the 110 security requirements of NIST SP 800-171 Rev. 2, and the SPRS scores and affirmations you submit need to be accurate.
DoD requirements continue to evolve. We track the changes and keep your program aligned, whether you self-assess or prepare for a third-party assessment. Read our update on the CMMC Phase 2 pause.
How we help
- Scoping where FCI and CUI live
- Gap assessment against NIST SP 800-171
- System Security Plan and POA&M
- Remediation across endpoints, network, identity and Microsoft 365
- SPRS score support and evidence collection
- Assessment preparation and ongoing monitoring
Healthcare
The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information, starting with a documented risk analysis.
HHS has proposed the largest update to the Security Rule since it was written. See what the proposed changes mean for practices.
How we help
- Security Rule risk analysis
- Administrative, physical and technical safeguards
- Policies and procedures
- Access controls, audit logging and encryption
- Workforce security awareness training
Retail and payments
If you store, process or transmit cardholder data, PCI DSS applies. Good segmentation is the fastest way to shrink what has to be assessed.
How we help
- Cardholder data environment scoping
- Network segmentation
- Self-assessment questionnaire support
- MFA and access control
- Coordination of required vulnerability scans
Everyone else
Insurers now ask detailed questions about MFA, backups, endpoint protection and training before they quote or renew a policy.
How we help
- Accurate answers to insurance questionnaires
- Evidence that the controls you claim are in place
- Incident response planning
From first scope to steady state.
A clear path your leadership can fund and your team can follow.
- 01
Scope
Define the systems, data and people in scope.
- 02
Assess
Measure every requirement against how you actually operate.
- 03
Remediate
Close the gaps, most of which our standard already covers.
- 04
Document
Plans, policies and evidence written to match reality.
- 05
Maintain
Continuous monitoring so you stay compliant after the assessment.
Common questions
Do you perform CMMC certification assessments?
No. Certification assessments are performed by authorized third-party assessment organizations (C3PAOs). We help you prepare: scoping, gap assessment, remediation, documentation and evidence.
What is an SPRS score?
The Supplier Performance Risk System score summarizes how many NIST SP 800-171 requirements you have implemented. Contractors submit it to DoD, and it needs to reflect reality, because inaccurate submissions carry False Claims Act risk.
How long does it take to get ready?
It depends on your scope and starting point. Because our standard already covers most technical controls, clients on our baseline typically spend more time on documentation and evidence than on remediation.
Do you provide policies and procedures?
Yes. We write policies and procedures that match how your business actually operates, which is what assessors look for.
The rest of the standard
Every service is secured the same way, so they work better together.
Not sure where you stand?
Start with a gap assessment. You'll get a clear picture of where you are and what it takes to close the gaps.