Resources
Guides
Plain-language guides to the rules organizations ask us about for compliance and security programs.
Sample reports
See the format and depth of what ALCON DTS clients receive.
All guides
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Guide
Texas Cybersecurity Safe Harbor (SB 2610)
Texas SB 2610 bars punitive damages in breach suits for businesses under 250 employees with a framework-based security program.
Guide
Texas AI Laws for Health Care Providers
What SB 1188 and HB 149 require when clinics use AI: patient disclosure, practitioner review, and U.S. storage of health records.
Guide
HIPAA Security Risk Analysis
A HIPAA security risk analysis is required for covered entities and business associates.
Guide
California Privacy (CCPA)
Who the thresholds catch, what a request path has to do, and what ALCON DTS does not decide.
Guide
CMMC for DoD Suppliers
CMMC can apply to DoD contractors and suppliers that handle FCI or CUI.
Guide
Texas Breach Notification Law
Texas law requires breach notice to individuals within 60 days and to the Attorney General within 30 days for 250 or more Texans.
Guide
Business Associate Agreements Under HIPAA
HIPAA requires a business associate agreement before a vendor handles patient information.
Guide
CIS Controls® Implementation Group 1 (IG1)
CIS Controls IG1 is 56 essential Safeguards in CIS Controls v8.1.
Guide
NIST Cybersecurity Framework 2.0
NIST CSF 2.0 organizes security into six Functions, including Govern.
Guide
Microsoft 365 Copilot Readiness
Get your Microsoft 365 environment ready for Microsoft Copilot: fix oversharing, apply sensitivity labels, confirm licenses and plan a pilot before rollout.
Guide
ePHI in Microsoft 365
Keeping patient data in Microsoft 365? See what Microsoft’s BAA covers, what you configure, and how MFA, encryption, audit logs and sharing map to HIPAA.
Guide
MFA and Conditional Access
Which MFA methods resist phishing, how Conditional Access and legacy sign-in blocking work, break-glass accounts, and how MFA maps to HIPAA, CMMC and CIS IG1.
Guide
Security Questionnaires
How to answer SIG, CAIQ, HECVAT and cyber insurance questionnaires honestly, what evidence to keep, and how ALCON DTS can help draft technical answers.
Guide
SOC 2
What a customer is asking for, who issues the report, and what ALCON DTS does not sign.
Guide
PCI DSS for Merchants
What the payment standard covers, who decides the questionnaire, and what ALCON DTS does not attest.
Guide
NERC CIP Standards
Who NERC CIP covers, how CIP-002 impact categories work, which versions are in force, what is changing through 2029 and how enforcement works.
NERC CIP ERCOT PUCT Texas grid energy utilities
Guide
Texas Grid Cybersecurity
Texas grid cyber rules: the PUCT cybersecurity monitor, Emergency Operations Plan cyber annex, ERCOT incident notice, LISPA and PUCT penalties.
NERC CIP ERCOT PUCT Texas grid energy utilities
Guide
Cyber Incident Response
The first steps to take after a cyber incident, the five CISA response phases, containment trade-offs, Texas breach notice timing and what to have ready.
incident response cyber attack cyberattack ransomware data breach security hacked compromised account business email compromise phishing malware CISA playbook plan first hour what do after containment eradication recovery NIST SP 800-61 CSF tabletop exercise backups vulnerability known exploited vulnerabilities KEV Texas notification Attorney General 521.053 FBI IC3 CIRCIA insurance evidence forensics
Next step
