Compliance is mostly security you can prove
Whether it's HIPAA for a medical practice, CMMC for a defense contractor, the FTC Safeguards Rule for a lender or accountant, or a 12-page cyber insurance questionnaire, the questions are similar: Who can access sensitive data? Is it encrypted? Is multi-factor authentication enforced? Are devices patched? Are backups tested? Is staff trained? What happens if there's a breach?
We map those requirements to Microsoft 365, Intune, Defender and Purview controls, many of which you're already paying for, then switch them on, document them and collect the evidence auditors and insurers ask for.
Frameworks we support
- HIPAA security rule safeguards for healthcare practices and business associates.
- CMMC and NIST SP 800-171 readiness for defense contractors handling controlled unclassified information. We implement and document controls and prepare you for your assessment; we're not a certified third-party assessor.
- FTC Safeguards Rule for financial services firms, including tax preparers, auto dealers and mortgage brokers.
- PCI DSS scope reduction and controls for businesses that take card payments.
- Cyber insurance application and renewal questionnaires, answered accurately and backed with evidence.
Policies people actually follow
We write short, practical policies, such as acceptable use, access control, incident response and data retention, that match how your systems are really configured. No 80-page binder that contradicts your setup.