Compliance, translated into things you can actually do

Compliance work usually arrives as a document. A cyber-insurance questionnaire, a funder's security requirements, a prime contractor's flow-down clause, an auditor's findings list. It is written in a language nobody in your building speaks, and it is due in three weeks.

We translate that into a list of things to actually do, in a sensible order, and then help you do them.

What we help with

CMMC. Increasingly unavoidable for manufacturers doing defense or defense-adjacent work.

Cyber-insurance questionnaires. These have become substantially stricter. Insurers now ask detailed questions about MFA, endpoint protection, backup isolation, and email authentication, and answering optimistically is a genuinely bad idea, because a claim can be denied over it. We help you answer accurately and close the gaps the questionnaire exposes.

HIPAA. For healthcare practices and the organizations that handle their data: risk assessments, safeguards, and documentation.

Funder and grant requirements. Nonprofits increasingly face security requirements from funders, including HUD-related obligations. These are often written for much larger organizations and need interpreting for your scale.

Client and contractual security requirements. When a large customer sends a security questionnaire and it is now a condition of the contract.

Pen-test remediation. When a test produced a list of findings and you need someone to actually work through it.

How we approach it

We start with where you actually are. Compliance work built on an assumption about your environment is compliance work you will redo. Establishing current posture first also produces the documentation most frameworks require anyway.

We prioritize by real risk, not by checklist order. Frameworks are written to cover every organization, so they contain items that matter enormously for you and items that are close to irrelevant. We tell you which is which. Treating all of it as equally urgent is how compliance projects stall.

We document as we go. With most frameworks, the evidence that you did the thing is nearly as important as doing it. Undocumented good practice fails an audit.

We do not sell fear. Compliance is a business requirement with a deadline and a budget. It is not an emergency and we are not going to manufacture one to accelerate a decision. If a requirement is less urgent than it looks, we will tell you, even though that is not in our short-term interest.

The security work underneath it

Compliance frameworks mostly ask for the same underlying controls, which is why doing the work well satisfies several at once: multi-factor authentication and conditional access, endpoint detection and response, disk encryption, email authentication (SPF, DKIM, and DMARC), security awareness training for staff, monitoring and log retention, tested and isolated backups, and documented access control including proper offboarding.

We are vendor-agnostic across all of it and recommend what fits your environment and budget.

A note on how compliance gets sold

A lot of security and compliance selling in this industry runs on fear, and it works, which is why it persists. We think it produces bad decisions: organizations buy tools they do not need while leaving basics unaddressed, because the tool was easier to sell than the process fix.

Our approach is to make you literate in your own environment. A large part of what our assessments do is educational. Clients come out understanding what they have, what it does, and what is actually exposed, which makes them harder to sell to. Including by us. We think that is the right trade, and after 25 years, the evidence supports it.

Getting started

Use the button above, or call (734) 929-1400. If you have a specific document in hand, send it over and we will tell you what it is actually asking for.

Related: backup and disaster recovery, and co-managed IT support if your internal team is carrying the compliance work alone.