// Compliance Readiness

Compliance that
actually holds up.

We don't hand you a checklist and call it a day. We assess your environment against the framework, remediate the gaps, build the evidence, and stand next to you in the audit room.

// Supported Frameworks

Four frameworks.
One engagement team.

Compliance frameworks overlap significantly. We align your program to multiple frameworks simultaneously wherever controls are shared.

AICPA · Trust Services Criteria
SOC 2 Type II
High demand

SOC 2 Type II tells your customers that your controls around security, availability, and confidentiality have been audited and verified over a defined observation period — not just documented and hoped for.

Security (required)AvailabilityConfidentialityProcessing IntegrityPrivacy
WHAT WE DO
  • Readiness assessment against TSC criteria
  • Gap identification & remediation roadmap
  • Control design, documentation & implementation
  • Vendor & auditor selection guidance
  • Evidence collection system setup
  • Audit support & auditor liaison
NYDFS · 23 NYCRR Part 500
Part 500
Regulatory mandate

The New York Department of Financial Services Cybersecurity Regulation applies to all entities licensed or registered under NY banking, insurance, and financial services law. The 2023 amendments expanded requirements significantly.

CISO designationWritten cybersecurity policyRisk assessment (annual)MFA requirementsPenetration testingIncident notification (72hr)
WHAT WE DO
  • Part 500 gap assessment & compliance mapping
  • vCISO to fulfill CISO requirement
  • Risk assessment documentation
  • Policy & procedure development
  • MFA deployment & privileged access controls
  • Annual certification preparation
Center for Internet Security
CIS Controls v8
Best practice baseline

CIS Controls v8 provides 18 control families and 153 safeguards representing the most effective actions to reduce cyber risk. Implementation Groups (IG1–IG3) let you prioritize based on your risk profile.

Inventory & control of assetsData protectionSecure configurationAccess control managementAudit log managementIncident response
WHAT WE DO
  • IG1/IG2/IG3 gap assessment
  • Implementation Group scoping
  • Technical control implementation
  • Safeguard tracking & measurement
  • CIS-RAM risk assessment
  • Ongoing control monitoring & reporting
NIST · Cybersecurity Framework 2.0
NIST CSF

The NIST Cybersecurity Framework provides a flexible, risk-based approach to managing cybersecurity risk. CSF 2.0 adds a sixth function — Govern — and expands applicability to organizations of all types.

GovernIdentifyProtectDetectRespondRecover
WHAT WE DO
  • Current state assessment against all six functions
  • Target profile definition for your risk tolerance
  • Gap analysis & prioritized implementation plan
  • Profile documentation & governance structure
  • Integration with CIS Controls for technical execution
  • Continuous improvement tracking
HHS · 45 CFR Parts 160 & 164
HIPAA Security Rule
Healthcare mandate

The HIPAA Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards for ePHI. For dental and healthcare organizations, this covers every system that touches patient data — including imaging, scheduling, billing, and communications.

ADMINISTRATIVE
  • Risk analysis & management
  • Workforce training
  • Access management policies
  • Contingency planning
PHYSICAL
  • Facility access controls
  • Workstation use policies
  • Device & media controls
  • Secure disposal procedures
TECHNICAL
  • Access controls & MFA
  • Audit log management
  • Encryption at rest & in transit
  • Automatic logoff policies
WHAT WE DO
  • HIPAA Security Rule gap assessment
  • Risk analysis documentation (required)
  • Technical safeguard implementation
  • BAA review & vendor management
  • Workforce training program
  • Breach notification readiness
  • Audit log deployment & monitoring
  • ePHI data flow mapping
// start here

Know where you stand
before the auditor does.

We start every compliance engagement with a plain-English gap assessment. You'll know exactly what you're missing and what order to tackle it in.

Schedule Free Assessment