Protection
CMMC & HIPAA Compliance
Compliance questions usually arrive from outside: a customer, an auditor, an insurer or a prime contractor. Answering them well starts with an honest assessment of where you stand, and that's where we start.
Businesses That Need CMMC or HIPAA Compliance Support
A customer or regulator has asked what you comply with, and the honest answer is that nobody has checked.
If any of these describe your business, this service is usually the right place to start.
- You handle controlled unclassified information for a defense customer.
- You're a covered entity or a business associate under HIPAA.
- A prime contractor has passed requirements down to you.
- Your insurer or a large customer sent a questionnaire you can't complete.
Benefits of Managed Compliance
- When an assessor asks, you can show evidence.
- Questionnaires from customers and insurers get real answers.
- You know which frameworks apply to you and which don't.
- Evidence is collected as the work happens, so nobody assembles it in a panic.
Our Approach to CMMC and HIPAA Compliance
We begin with a gap assessment against the standard that applies to you, control by control. You get a plain reading of where you stand, with each gap named.
Then we build the plan. Each gap gets an owner and a place in the sequence, because most gaps depend on each other and fixing them in the wrong order wastes money.
Then we do the work and keep the evidence. Compliance is a set of things you keep doing and keep being able to prove, so we maintain that record and an assessment becomes a matter of producing it.
What Our Compliance Services Include
Gap assessment
Scored against the controls that apply to you, with a plain explanation of what each one asks for.
A plan of action
Gaps in a sensible order with what each one involves, so remediation runs to a schedule.
Policy and documentation
The written policies the standard requires, in language your staff can follow.
Technical remediation
The access controls, logging, encryption and monitoring the standard calls for, implemented in your systems as part of our cybersecurity services.
Evidence collection
The record kept current as you go. Our guide to an automated IT security policy compliance system shows how we collect that proof.
Ongoing management
Reviews and the annual work, so your position doesn't quietly decay after the first assessment.
The Compliance Process, Step by Step
- We work out what applies to youHalf of this work is finding out that two of the four frameworks somebody mentioned aren't your obligation at all.
- We assess where you standControl by control, with every answer written down and no credit for good intentions. A security risk assessment is often where this begins.
- We fix the gaps in an order you can affordSome fixes are configuration changes done in an afternoon, and some are projects. You get both lists separately, with what each item takes.
- We keep the evidence currentPolicies get reviewed and logs retained on a schedule. Evidence is captured while each control is in place, so nobody has to reconstruct it the week an assessor asks.
How CMMC and HIPAA Compliance Differ
CMMC is assessed against a defined set of practices and, at higher levels, verified by a third party, so the evidence has to be organized for someone else to read. HIPAA is built around a risk analysis you perform and safeguards you can justify, which gives you more latitude and less to point at.
We work in both. CMMC readiness is for defense suppliers, and HIPAA compliance is for medical practices and their business associates. The first conversation is usually about which one you're actually subject to.
For background, read CMMC in plain English or our guide to performing a healthcare security risk assessment. CMMC applies to manufacturers and construction companies with defense contracts, and HIPAA applies to healthcare practices and to business associates such as law firms that handle medical records.
In their words
Related Case Studies
CMMC and HIPAA Compliance FAQ
How is compliance work priced?
The assessment is a fixed quote once we know which framework applies and how many people and systems are in scope. Remediation is quoted separately, item by item, so you can stage it.
Keeping the evidence current is a monthly figure, and it's the part most companies underestimate.
How long does compliance readiness take?
It depends on the standard and how much of your business is in scope. The assessment itself usually takes a few weeks. Remediation can run from a couple of months to considerably longer if the scope is broad, and we'll give you a realistic timeline even when it's longer than you hoped.
Can you certify us?
No. Nobody who prepares you should also be the one assessing you. For CMMC, certification comes from an authorized third-party assessor. We get you ready and help you through the assessment, and keeping those roles separate protects the value of the certificate.
Do we need to do all of it at once?
No, and trying to usually stalls. The plan sequences the work, since some items are quick and some depend on others being finished first. What matters is that the plan is real and progress against it is recorded, which assessors look for in its own right.
Often paired with
Related IT Services
Protection
Cybersecurity Services
Layered protection monitored around the clock, with a team that acts on what it finds.
Learn moreDay-to-day operations
Managed IT Services
Your staff get help from people who already know your systems, and technology stops being the reason work stops.
Learn moreIn your building
Networking & Infrastructure
Business networks with current documentation and monitoring, built for the work you do on them.
Learn more