Every client starts on a CIS Controls baseline. We add the framework your sector requires and keep evidence current, so an audit is a report rather than a project.
Regardless of sector or size, we implement and monitor the CIS Controls as the operational floor. It is the framework the others map onto, so doing it first reduces the work every subsequent certification requires.
Scope
18 control domains
Asset and software inventory, data protection, secure configuration, access control, and the rest of the 18 CIS control domains — implemented, not just documented.
Cadence
Continuous monitoring
Control gaps tracked in real time with alerting, rather than discovered at the next audit cycle.
Healthcare and regulated data
HIPAA, enforced continuously.
For providers, clinics, and any organization handling protected health information. We deliver the administrative, physical, and technical safeguards, and then we maintain them.
Privacy Rule
Policy and patient rights
PHI handling policies, minimum-necessary standards, and patient access-rights procedures documented and enforced.
Security Rule
Safeguards and audit trail
Access controls, unique user identification, automatic logoff, encryption at rest and in transit, audit logging, contingency planning, documented risk analysis.
Breach and BAA
Obligation management
Business associate agreement execution and tracking for every vendor touching PHI, plus breach notification procedures and incident response runbooks.
Enterprise and partner requirements
SOC 2, without stalling the deal.
SOC 2 is increasingly the gate on enterprise contracts. We run readiness, evidence collection, and auditor coordination so security review stops being the reason a deal slips a quarter.
Type I
Point in time
Assesses control design as of a specific date. Typically the faster report to obtain, and often the first step toward Type II.
Type II
Over a period
Demonstrates controls operated effectively across six to twelve months. The report enterprise procurement actually wants, and the one worth planning toward from the start.
International operations
ISO 27001 and the system behind it.
For organizations with cross-border operations, international clients, or regulatory obligations outside the United States.
ISMS design
An information security management system scoped to your actual operations and risk profile, with ownership, review cadence, and management commitment documented.
Risk treatment
Structured risk identification, analysis, and treatment planning maintained as a living register rather than a document produced once for certification.
Certification support
Gap assessment, remediation, internal audit, and coordination with your certification body through issuance and annual surveillance.
Where to start
A risk assessment tells you the gap.
Before committing to a framework it is worth knowing how far you actually are from it. We run a documented assessment against your target framework and give you the plan, whether or not you engage us to execute it.
