Compliance readiness
Compliance readiness — controls that work, and the evidence to prove it.
Compliance for a small business usually arrives as a deadline: a client’s vendor security questionnaire, a cyber insurance renewal, an auditor’s request list or a regulator’s letter. We help you get ready without the scramble — putting real security controls in place, writing policies in plain English that match what you actually do, and gathering evidence as you go. We are not auditors and we don’t certify anyone; we get you to the point where an audit, review or questionnaire is a formality rather than a fire drill.
The result
Audit-ready documentation and controls that stay in place after the review.
Who it's for
This service is for small organizations that are measured against a security framework but don’t have a compliance department. Medical and dental practices answer to the HIPAA Security Rule. Accounting and tax firms are covered by the FTC Safeguards Rule and IRS expectations for a written information security plan. Firms selling to larger companies are increasingly asked for SOC 2 reports or SOC 2–style answers. And almost everyone now fills out cyber insurance questionnaires that read like a mini-audit.
If you’ve ever stared at a 200-question security spreadsheet from a client and thought “I think we do that?”, this is for you. The accounting firm case study shows what this looks like in practice.
- Medical and dental practices needing a documented HIPAA security program and risk assessment
- CPA, tax and bookkeeping firms that need a WISP under the FTC Safeguards Rule
- Professional-services and software firms preparing for SOC 2 or client vendor-risk reviews
- Businesses renewing cyber insurance with tougher security questions
- Business associates of healthcare providers who must sign and live up to a BAA
What's included
Gap assessment against your framework
We compare your current setup to the framework you’re measured against — HIPAA Security Rule, FTC Safeguards Rule, SOC 2 Trust Services Criteria or an insurer’s requirements — and produce a prioritized list of gaps in plain English.
Security risk assessment support
HIPAA requires an accurate and thorough risk assessment; the FTC Safeguards Rule requires a written risk assessment too. We help you identify where sensitive data lives, the threats to it and the controls in place, and document the results. See our risk assessment guide.
Technical controls
We implement the controls frameworks expect: MFA, encryption at rest and in transit, access controls, logging, endpoint protection, patching, backups and secure device configuration — through our security, device management and Microsoft 365 services.
Policies written in plain English
Access control, acceptable use, incident response, backup and recovery, device and media handling, vendor management and more — short enough that staff can read them, and accurate to how your office actually works.
Written information security program (WISP)
For CPA and tax firms, a WISP that covers the elements required by the FTC Safeguards Rule and the IRS’s guidance for tax professionals.
Evidence collection as you go
Screenshots, configuration exports, access reviews, training records and backup test results gathered on a schedule — not the week before the review.
Vendor and BAA tracking
A list of vendors that touch sensitive data, which ones need a business associate agreement or contract terms, and where those documents live.
Security questionnaires
Help answering client vendor-risk questionnaires and cyber insurance applications accurately, with supporting evidence where asked.
Incident response planning
A tested plan for security incidents and breaches, including who decides what and when, and the notification timelines that apply to you.
Staff training records
Security awareness training for staff with records you can show an auditor or insurer.
SOC 2 readiness
For firms working toward SOC 2, we help design and operate the controls and evidence an independent CPA firm will test. We support readiness; the audit and report are done by the independent auditor.
How it works
Clarify what you’re measured against
HIPAA, the FTC Safeguards Rule, SOC 2, a client’s questionnaire, an insurer — sometimes several at once. We map where they overlap so you do the work once.
Gap assessment
We review your systems, policies and practices and give you a prioritized, plain-English gap list.
Remediation plan
A realistic plan with phases, owners and dates — technical fixes, policies and process changes.
Implement controls and write policies
We implement the technical controls and draft policies with you, so they match reality.
Gather evidence
We set up a simple, recurring evidence calendar: access reviews, backup tests, training, patch reports.
Support the review
We help you answer the questionnaire or work with the auditor, and fix any findings.
Keep it current
Controls drift. We review periodically and update your documentation when your office or the rules change.
For medical & dental practices
The HIPAA Security Rule applies to every covered health care provider that transmits health information electronically, regardless of size. It requires administrative, physical and technical safeguards for ePHI — a documented risk analysis, risk management, workforce training, access controls, audit controls, integrity controls, transmission security, contingency planning and more. Small practices have flexibility in how they meet these, but not whether. Our HIPAA Security Rule checklist and free HIPAA security self-assessment are good starting points.
The most common gap we see in small practices is the risk assessment: either it was never done, it was a generic template, or it hasn’t been updated since the practice changed software, moved offices or added locations. HHS’s Office for Civil Rights regularly cites missing or inadequate risk analyses in its enforcement actions. We help you complete one that reflects your actual systems and keep it current.
Vendors are the second gap. Any vendor that creates, receives, maintains or transmits ePHI on your behalf — your IT provider, cloud services, practice-management vendor, billing service — is a business associate and needs a BAA. We help you list them and check what you have. See business associate agreements: an IT guide.
As of this writing, the proposed HIPAA Security Rule update published in January 2025 has not been finalized; HHS’s regulatory agenda has pushed final action to 2027 at the earliest. We design controls that meet today’s rule and align with where the proposal is heading, so you aren’t starting from scratch if it’s finalized. Check HHS for the latest status, and see the proposed changes explained.
More on how we work with practices: IT for medical & dental practices.
Typical problems we solve
| The problem | What we do about it |
|---|---|
| A big client sent a security questionnaire and you don’t know how to answer half of it. | We help answer accurately, fix the gaps it reveals and keep a reusable answer set with evidence. |
| Your HIPAA risk assessment is a template from years ago. | A fresh assessment based on your actual systems, with a risk management plan you can act on. |
| Your tax firm has no written information security plan. | A WISP covering the FTC Safeguards Rule elements, with the technical controls behind it. See IT security for CPA firms. |
| Policies exist on paper but nobody follows them. | Rewrite them to match reality, then enforce what we can technically so policy and practice line up. |
| An auditor asked for evidence and it took weeks to find. | A recurring evidence calendar and a single place to keep it. |
| You aren’t sure which vendors need a BAA. | A vendor inventory with BAA status and owners. |
| Your insurer wants proof of MFA, EDR and immutable backups. | Implement them and provide screenshots and reports to support your application. |
Tools we use — and what they do
- Microsoft Purview
- Audit logging, retention, sensitivity labels and data loss prevention — the evidence and data-handling backbone for many frameworks.
- Microsoft Intune compliance reports
- Proof that devices are encrypted, updated and protected.
- Microsoft Entra ID
- Sign-in logs, MFA status and access reviews — key evidence for access-control requirements.
- Microsoft Defender for Business
- Endpoint protection and vulnerability reports, showing malware protection and patch status.
- Microsoft Secure Score
- A measurable view of security configuration over time.
- SharePoint
- A controlled, versioned home for policies, procedures and evidence.
Compliance readiness: frequently asked questions
Can you make us HIPAA certified?
No one can — there is no official HIPAA certification. We help you put the Security Rule’s safeguards in place and document them so you can demonstrate compliance.
Do you perform SOC 2 audits?
No. SOC 2 examinations are performed by independent CPA firms under AICPA standards. We help you get ready — designing controls, writing policies and collecting evidence — so the audit goes smoothly.
What is the FTC Safeguards Rule?
A rule under the Gramm-Leach-Bliley Act requiring many non-bank financial businesses — including tax preparers and many accounting firms — to run a written information security program: a qualified individual in charge, a written risk assessment, controls such as MFA and encryption, staff training, vendor oversight and an incident response plan. Since May 13, 2024, covered businesses must notify the FTC within 30 days of discovering a security event involving unencrypted information of 500 or more consumers. See FTC Safeguards Rule.
What’s a WISP?
A written information security plan (or program): the document that describes how your firm protects client information. The IRS expects tax professionals to have one. See WISP.
How often should a HIPAA risk assessment be done?
HIPAA requires it to be accurate and kept current rather than setting a fixed interval; most practices review it at least yearly and whenever something significant changes, like new software, a move or a security incident.
Is this legal advice?
No. We handle the technical and documentation side. For legal interpretation, breach-notification decisions or contracts, work with your attorney or compliance advisor — we’re happy to work alongside them.
How long does readiness take?
It depends on your starting point and the framework. A small practice with good basics might need a few weeks; a firm starting SOC 2 readiness from scratch is usually looking at several months before an audit period begins.
Do we have to do this every year?
Most frameworks expect ongoing compliance, not a one-time project: annual reviews, regular access reviews, training and updated risk assessments. We keep that rhythm going.
Case study · Accounting firm
An accounting firm that passes its clients' security reviews
Larger clients were asking hard security questions. We built a SOC 2–aligned environment — managed devices, strong sign-in, documented controls — and the firm passed its client security reviews with no findings to fix.
Read the full story