Compliance
Regulatory Compliance for organizations that need a current program
Identity, devices, email, and backups operated with the program in mind. You keep the obligation. We run the controls.
Who it’s for
IT operated for the rule set you have to meet
Most organizations do not have one program. A clinic has HIPAA and an insurer questionnaire. A manufacturer has a customer security packet and Texas Cybersecurity Safe Harbor (SB 2610). A defense supplier has CMMC on top of the same identity, devices, and email everyone else runs.
Regulatory Compliance is the work of running those systems so the answers come from the live environment, not a binder that drifted. You keep the assessor and the attestation. We run the controls and sit with you when a customer, insurer, or regulator asks how the work is done.
HIPAA program writing lives on HIPAA Consulting. Day to day clinic support lives on Healthcare IT. The tighter security layer lives on Secure IT. This page is the map across programs.
Programs
Programs we support
The review names which programs apply and what the live environment already supports. Common work includes HIPAA, Texas Cybersecurity Safe Harbor, CMMC, PCI DSS, NIST CSF, the FTC Safeguards Rule, and customer or insurer questionnaires.
HIPAA
Accounts, devices, mailbox controls, and backups run with patient information in mind. Sign-in, privileged access, encryption, and restore paths have to match the HIPAA program the practice already owes.
BAAs are executed where our services require them. See HIPAA Consulting for the written program and the evidence file.
Texas Cybersecurity Safe Harbor
Least privilege, endpoint protection, email authentication, and device monitoring stay on the systems your team uses, with MFA available as an add-on on any plan. Those are the controls the statute is asking Texas firms to show.
See Texas Cybersecurity Safe Harbor for the safe-harbor page.
CMMC
Identity, devices, and email are hardened for a defense-supply assessment. The same controls a customer already runs for office IT become the evidence the assessor will walk through.
You keep the assessment. We run the controls and sit with you when the assessor asks how the systems are operated. Defense suppliers can start with our CMMC and NIST SP 800-171 compliance services and our cybersecurity services.
PCI DSS
Card data stays in the smallest possible footprint. Systems that do not need card data stay out of that footprint.
Identity and endpoints around what remains stay tight so the card environment is not the whole office.
NIST Cybersecurity Framework
Identify, protect, detect, respond, and recover mapped to accounts, devices, mail, and backups. Leadership gets a picture of what is already in place and what should change first.
Gaps become a work plan on Secure IT or a defined project.
Customer and insurer questionnaires
Answers come from the live environment: MFA, encryption, backups, logging, and admin access. The packet matches how the systems actually run.
Leadership can show that picture to a customer or a carrier without rebuilding it from memory.
FTC Safeguards Rule
Access, device standards, encryption, and incident handling stay in the same support relationship. The rule expects those controls to be operated, not only written.
That work sits with helpdesk and devices so the program does not drift from the environment.
How it works
How the program works
This work usually sits on Secure IT. It can also sit on a defined engagement through Managed IT Services or Co-Managed IT when you keep your own IT function.
Identity and access
Sign-in and admin rights stay tight. Least-privilege admin roles live in the directory the organization already runs, including Microsoft 365 or Google Workspace. We configure Conditional Access in your Microsoft 365 tenant, and multi-factor authentication is available as an add-on on any plan.
Joiner, mover, and leaver changes stay current so unused access does not sit open. Guest and vendor access is part of the same picture when those accounts can reach business information.
Endpoints
Windows, macOS, iPhone, and iPad used for work stay updated, protected, and encrypted where they handle business or regulated information. A lost or unmanaged device is treated as something to close, with our expert team behind it.
Hardware work in the office sits on the managed IT band that includes on-site support.
Email authentication
Inbound filtering, mailbox permissions, forwarding, and authentication stay current on the mail system the organization already runs.
That is where phishing and quiet data movement still show up, and where programs hold or fail in practice.
Logging and backups
You know what is logged, what is backed up, who can restore, and what back to work looks like when something fails.
Patient information is restored only into approved systems. Evidence and recovery stay part of the operating rhythm, not a scramble.
Written procedures
Procedures describe the environment the organization operates today: who approves changes, how the system list stays current, and how BAAs are kept where HIPAA applies. Staff can find them.
That supports your obligation. You stay accountable for the program.
How compliance works with us
- Requirements (HIPAA, CMMC, FTC Safeguards Rule, Texas SB 2610)
- Controls run in everyday support
- Evidence file kept current
- Ready for your assessor, insurer, or customer
What you receive
Evidence that stays ready for your assessor
- Requirements mapped to the systems your team uses
- Risk analysis or assessment for your rule set
- Remediation roadmap with owners and dates
- Written policies and procedures
- Evidence file kept current in your compliance workspace
- Technical answers for customer and insurer questionnaires
See a sample HIPAA risk analysisSee a sample cybersecurity assessment
Compare
Which path fits
A review of your needs and growth plans shows where the program work should live.
Co-Managed IT
Your IT function stays. We take or share the controls the program needs.
Remote IT
$100–$150 / user / month
Remote-first helpdesk, endpoints, and email. A technician can be dispatched when needed.
Unlimited remote supportManaged endpoint protection (antivirus or EDR)24/7 system health monitoringVendor managementMonthly serviceQuarterly business reviews
Total IT
$150–$250 / user / month
Remote support plus a technician in the office when the request needs it.
Everything in Remote ITOn-site supportCybersecurity awareness trainingBusiness continuity planningManaged detection and response (MDR)
Secure IT
$250–$400 / user / month
Everything in Total IT with tighter security and compliance built into the same support.
Everything in Total ITvCISO serviceBusiness continuity solutionEmail monitoringEmail phishing security testingCybersecurity framework guidance
Resources
Guides
Plain-language guides to the rules organizations ask us about for compliance and security programs.
Next step
Start with a review
A review of your needs and growth plans looks at which programs apply, what the environment already supports, and where the organization is going. You leave knowing whether HIPAA Consulting, Secure IT, or Co-Managed IT is the next step.
