Compliance
Let’s achieve security through compliance
Why?
IT organizations must have a thorough understanding of the compliance laws that apply to their industry. Legislation surrounding IT security is constantly evolving, and violations can bring about harsh penalties and steep fines.
When it comes down to it, most compliance frameworks have the same goal in mind…cybersecurity. From government regulation to self-imposed internal governance, we can help get you secure.
Cybersecurity Frameworks
NIST 800-53
NIST SP 800-53 defines the standards and guidelines for federal agencies to architect and manage their information security systems. It was established to provide guidance for the protection of agencies and citizens private data.
SOC 2
SOC 2 is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA), which specifies how organizations should manage customer data. The standard is based on the following Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy.
CMMC 2.0
CMMC 2.0 is the next iteration of the Department’s CMMC cybersecurity model. It streamlines requirements to three levels of cybersecurity – Foundational, Advanced, and Expert – and aligns the requirements at each level with well-known and widely accepted NIST cybersecurity standards.
HIPAA
HIPAA (Health Insurance Portability and Accountability Act) is United States legislation that provides data privacy and security provisions for safeguarding medical information. The law has emerged into greater prominence in recent years with the many health data breaches caused by cyberattacks and ransomware attacks on health insurers and providers.
PCI-DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements intended to ensure that all companies that process, store, or transmit credit card information maintain a secure environment.
HECVAT
The HECVAT is a questionnaire framework specifically designed for higher education to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a HECVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive institutional information and constituents’ PII.