Compliance support for HIPAA, PCI DSS, NIST CSF, GDPR, LGPD, and CMMC

Why compliance shapes the technical work

Most businesses don’t go looking for a compliance program. It shows up attached to something else: a payer contract, a prime contractor passing requirements down the supply chain, a payment processor asking for your PCI paperwork, a cyber insurance renewal that now wants proof, or a big customer with an eleven-page security questionnaire.

It’s tempting to treat that as paperwork. That doesn’t work, because the questions are technical. Who has admin access, and when was that last reviewed? How are backups protected from ransomware? How long do you keep logs? What happens to someone’s accounts when they leave on a Friday afternoon?

So we treat the framework as a spec. We set up the controls first, then write the documentation from what’s running.

Not sure where you stand?

Start with one of our six free checklists: IT Hygiene, NIST CSF, HIPAA, PCI DSS, GDPR, or LGPD. Each takes about five minutes, and we email you a report with your score and a suggested fix for every gap. It costs nothing. Use the report to fix things yourself, give it to your current IT provider, or bring it to us.

HIPAA Security Rule safeguards

If your business handles patient information, you have administrative, physical, and technical safeguards to meet. The technical safeguards are where managed IT does most of the work.

• Access control. Unique logins, role-based permissions, emergency access procedures, automatic logoff, and encryption of stored data.
• Audit controls. Logging on every system that holds patient information, kept long enough to support an investigation.
• Integrity and transmission security. Encryption in transit, protection against unauthorized changes, and controlled ways to share data with outside parties.
• Contingency planning. Backups, disaster recovery, and emergency operations, with restores that have been tested.
• Risk analysis. Written down, dated, and revisited, with fixes tracked until they’re done.

PCI DSS for businesses that take card payments

If you accept credit or debit cards, your payment processor expects you to follow PCI DSS. For most small and mid-sized businesses that means filling out a Self-Assessment Questionnaire (SAQ) each year, and often running quarterly external vulnerability scans. The work that makes those easy:

• Scope. Finding every system that stores, processes, or sends card data. The fewer systems in scope, the less there is to secure and document.
• Segmentation. Keeping payment systems on their own network so office computers, guest Wi-Fi, and everything else stay out of scope.
• The right SAQ. There are several versions, and the right one depends on how you take payments. We help you pick it and answer it accurately.
• Core controls. Multi-factor authentication, logging, patching, secure configurations, and access reviews on the systems that are in scope.
• Quarterly scans. We coordinate with your approved scanning vendor and fix what the scans find.

We don’t sign off on your compliance. That’s done through your SAQ or, for larger merchants, by a Qualified Security Assessor. We do the technical work and help you put together answers you can back up.

NIST Cybersecurity Framework 2.0

NIST CSF is the most practical shared language for describing how secure you are to a board, an insurer, or a large customer. Version 2.0 added a Govern function, and that’s where most small and mid-sized businesses have the biggest gap.

You end up with a picture of where you are now, a target that fits your risk tolerance and budget, and a plan to get from one to the other.

GDPR for businesses serving the EU

The EU’s General Data Protection Regulation covers businesses established in the EU and businesses anywhere else that offer goods or services to people there. If you have customers in Portugal, Ireland, Germany, or elsewhere in the EU, it likely applies. We handle the technical and operational side:

• Records of processing. Mapping what personal data you hold, why, where it lives, and who receives it.
• Security of processing. MFA, role-based access removed promptly when people leave, encryption, and backups with an offline copy and a tested restore.
• Processors and transfers. Listing every vendor that processes data for you, so agreements and transfer mechanisms can be put in place.
• Breach readiness. A written plan, logging that shows what happened, and the ability to report to the authority within 72 hours.

LGPD for businesses with people in Brazil

Brazil’s Lei Geral de Proteção de Dados follows the same logic as GDPR, with its own rules: an appointed Encarregado, a documented legal basis for each processing activity, answers to access requests within 15 days, and incident reports to the ANPD within three business days. It applies to companies outside Brazil too, whenever they offer goods or services to people there. We support businesses in Brazil remotely, in Portuguese or English, and the technical controls largely overlap with GDPR, so work on one helps with the other.

CMMC for the defense supply chain

Manufacturers and contractors handling controlled unclassified information (CUI) are assessed against the practices in NIST SP 800-171. Getting ready covers three things: scope, implementation, and evidence.

• Working out which systems, people, and facilities touch CUI, and drawing a boundary you can defend
• Putting the technical practices in place: access control, audit logging, configuration management, identification and authentication, incident response, media protection, and system integrity
• Helping with your system security plan and plan of action and milestones (POA&M)
• Gathering evidence in the format assessors expect, before your assessment is booked

How a compliance program runs

1. Scope and gap assessment. We inventory your environment, compare it to the framework, and rank each gap by risk and cost to fix.
2. Remediation plan. A written plan with owners, order, and budget, so the riskiest gaps close first.
3. Implementation. The technical work: tightening accounts, logging, encryption, backup redesign, network segmentation, device coverage, and access reviews.
4. Evidence collection. Asset records, access review logs, restore test results, policy sign-offs, and configuration exports, gathered as we go instead of in a last-minute rush.
5. Reassessment. A regular check-in so problems get caught early and the next audit is routine.

Compliance is a skill set, not an industry

The discipline is the same whether it’s HIPAA at a clinic, PCI DSS at a retailer, GDPR or LGPD at a company with customers abroad, CMMC at a machine shop, SOC 2 questions from an enterprise customer, or an insurer asking for proof of multi-factor authentication before renewal. If you’re being asked to prove your security instead of just describe it, let’s talk.