Risk and compliance readiness
Compliance readiness you can back up with evidence
ACS Cyber helps small and midsize organizations prepare for HIPAA, PCI DSS, SOC 2, CMMC, NIST CSF 2.0, the CIS Controls and cyber-insurance requirements. We assess the gaps, remediate them, document your controls, prepare the evidence and support you and your legal counsel after a security incident.
- HIPAA Security Rule
- PCI DSS
- SOC 2
- CMMC
- NIST CSF 2.0
- CIS Controls
At a glance
Compliance readiness, in brief
What it is: Compliance readiness is the work of getting your security controls, policies and evidence to the point where you can answer an auditor, assessor, insurer or customer accurately. It covers gap assessment, remediation, documentation and evidence preparation.
Who it is for: Organizations with a framework, contract, regulator or insurer asking for proof, including healthcare practices, business associates, defense contractors, service providers, financial firms and law firms.
What ACS Cyber does: ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. We find the gaps, fix them with our security and IT engineers, write the policies and organize the evidence. After an incident, and with your authorization, we give your counsel the technical facts they need.
How to start: Book a free 30-minute consultation or call 1-650-300-7557. Tell us which framework, questionnaire or deadline is in front of you, and we will suggest a realistic first step.
Who decides what
- ACS Cyber: readiness, remediation, documentation and evidence preparation
- Your auditor or assessor: independent testing, attestation and certification decisions
- Regulators and contracting parties: enforcement and contract requirements
- Your legal counsel: interpretation of legal and contractual obligations, including breach notification
Is this you?
When readiness becomes urgent
Compliance work usually starts with a request from someone outside the organization.
A customer or contract asks for proof
A client sent a security questionnaire, a defense contract references CMMC and NIST SP 800-171, or a partner wants a SOC 2 report.
Your insurance renewal asks harder questions
The application asks about MFA, endpoint protection, backups and training, and you want every answer to be accurate.
Your HIPAA risk analysis is out of date
Your practice or business associate has added systems, staff or locations since the last risk analysis, and the policies no longer reflect reality.
You have just had a security incident
Counsel and your insurer are asking what data was involved and which controls were in place. You need accurate technical facts and organized evidence.
Our role, stated plainly: ACS Cyber supports readiness and remediation. Certification, attestation and compliance determinations are made by your auditor, assessor or regulator, and legal conclusions belong to your legal counsel. No provider can promise those outcomes. We help you prepare thoroughly for them.
Framework coverage
Frameworks we help you prepare for
This summary is general. Your legal counsel and auditor can confirm which obligations apply to you.
| Framework | Who it applies to | How we help |
|---|---|---|
| HIPAA Security Rule | Covered entities (health plans, healthcare clearinghouses and healthcare providers that conduct standard electronic transactions, such as insurance billing) and the business associates that handle electronic protected health information for them | Security risk analysis, gap assessment against administrative, physical and technical safeguards, remediation, policies and evidence preparation |
| PCI DSS | Organizations that store, process or transmit payment card data, or whose systems can affect its security | Scope review, gap assessment, remediation of network and access controls, policies and evidence for your assessment or self-assessment questionnaire |
| SOC 2 | Service organizations whose customers ask for an independent CPA firm’s report on their controls | Readiness assessment against the Trust Services Criteria, control design and remediation, policies, evidence collection and support between audit periods |
| CMMC | Department of Defense contractors and subcontractors that handle Federal Contract Information or Controlled Unclassified Information | Gap assessment against the CMMC requirements, including NIST SP 800-171 where Controlled Unclassified Information is involved, remediation, system security plan and policy development, and evidence preparation |
| NIST CSF 2.0 | Any organization that wants a recognized structure for managing cybersecurity risk; use is voluntary | Current and target profile assessment, a prioritized roadmap, policies and progress reporting |
| CIS Controls | Organizations that want a prioritized, practical set of safeguards, starting with essential cyber hygiene | Safeguard-by-safeguard gap assessment, remediation, configuration standards and ongoing monitoring support |
| Cyber-insurance requirements | Organizations applying for or renewing cyber insurance whose carriers ask about MFA, endpoint protection, backups, email security and training | Application review, control gap assessment, remediation and documentation that supports accurate answers |
ACS Cyber does not sell insurance or issue certifications. Coverage decisions belong to your carrier.
What’s included
What a readiness engagement covers
Engagements are scoped to the framework, the environment and the deadline you are working toward.
Gap assessment
We compare your controls, documentation and configurations with the framework’s requirements and record each gap with its business impact.
Risk analysis
A documented assessment of threats to your systems and data, which several frameworks, including the HIPAA Security Rule, expect you to perform and keep current.
Remediation
Our security and IT engineers close gaps directly: MFA, access reviews, logging, encryption, backups, endpoint protection and network segmentation.
Policies and procedures
Policies written to match how your organization actually operates, with procedures staff can follow and leadership can approve.
Evidence preparation
An organized evidence library that shows each control in operation, indexed to the framework so auditors and assessors can find what they need.
Questionnaires and applications
Support for customer security questionnaires, vendor due-diligence requests and cyber-insurance applications, based on documented facts.
Ongoing monitoring support
Periodic control checks, access reviews and evidence refreshes between audits. Add managed detection and response for 24/7 security monitoring.
Breach-notification readiness
Data inventories, logging, incident plans and documented controls that help counsel make informed, timely decisions if an incident happens.
Audit and assessment support
We help your team prepare for interviews and evidence requests. Independent judgment stays with your auditor or assessor.
Before and after an incident
Breach-notification readiness and post-incident compliance support
State breach-notification laws, the HIPAA Breach Notification Rule and many customer contracts can require you to notify affected people, regulators or partners after a breach, often within set deadlines. Whether a particular incident triggers those duties is a determination to make with your legal counsel.
Readiness is what you can control in advance: knowing where regulated data lives, keeping the logs an investigation depends on and having a plan that names counsel and your insurer.
After an incident, our in-house forensic investigation works to establish what happened and what data may have been involved. With your authorization, we share those facts and supporting evidence with your counsel and insurer, prepare the technical material counsel requests for notification decisions, and remediate the gaps the incident exposed.
If you are dealing with a possible breach now, call our 24/7 incident line at 1-650-300-7557 or see data breach and exposure response.
Breach-notification readiness checklist
- A data inventory: what regulated data you hold and where it lives
- Logging that preserves the records an investigation needs
- An incident-response plan naming counsel, your insurer and decision-makers
- Documented encryption, access and backup controls
- Vendor contracts reviewed with counsel for incident-reporting terms
- Our 24/7 incident line in your plan: 1-650-300-7557
Other obligations
Industry obligations we also help you prepare for
Many organizations face requirements beyond the major frameworks. We map the same controls to these, so you are not repeating the work for each one.
- GLBA and the FTC Safeguards Rule for non-bank financial institutions, such as tax preparers and lenders. See accounting and financial services.
- IRS Publication 4557 guidance and the written information security plan expected of tax professionals
- ABA Model Rules duties of competence and confidentiality as they apply to technology at law firms
- HIPAA readiness for practices and business associates. See cybersecurity for healthcare. Atlantic Computer Systems, our parent company, offers HIPAA compliance program support for medical practices.
- State breach-notification laws, with technical facts prepared for your counsel, who determines notification obligations
- Customer and contract security requirements, including security addenda and vendor questionnaires
How the engagement works
How a readiness engagement works
Each step produces something your team can use, whether or not an audit is scheduled.
01
Scope
We confirm which frameworks, systems, locations and data are in scope, and what deadline or event you are preparing for.
02
Assess
We review controls, configurations and documentation, interview key staff and rank the gaps by risk and effort.
03
Plan
We agree on a remediation roadmap with owners, sequence and budget, starting with the gaps that carry the most risk.
04
Remediate
Our engineers, or your IT team with our guidance, close the gaps and record what changed.
05
Document
We finalize policies and procedures and assemble an evidence library mapped to the framework.
06
Maintain
Periodic reviews keep controls and evidence current, so the next audit or questionnaire takes less effort.
Deliverables
What you receive
You keep every document, written to be reused across frameworks and requests.
- Gap assessment report with prioritized findings
- Control matrix mapping your controls to each framework in scope
- Risk analysis and risk register with owners and decisions
- Remediation roadmap with sequence, owners and status
- Policy and procedure set ready for leadership approval
- Evidence library indexed by requirement
- System security plan where the framework expects one, such as NIST SP 800-171
- Executive summary of readiness status and open decisions
One accountable team
Clear roles from first finding to final evidence
Compliance work stalls when no one owns it. We define who does what at the start, so findings turn into fixes and fixes turn into evidence.
Atlantic Computer Systems provides managed IT, including helpdesk, Microsoft 365 administration, cloud, networks, VoIP and IT logistics, so remediation is carried through in the underlying IT rather than left as a list of findings. Learn about Atlantic Computer Systems.
01
Readiness lead
Runs the engagement, owns the gap assessment and roadmap, and keeps leadership informed.
02
Security and IT engineers
Implement technical remediation and capture evidence as changes are made.
03
Your leadership and control owners
Approve policies, make risk decisions and operate controls day to day.
04
Your legal counsel
Interprets legal and contractual obligations, including notification duties. We provide the technical facts counsel needs.
05
Your auditor, assessor or regulator
Performs independent testing and makes attestation, certification or compliance determinations.
Have a deadline coming up?
Tell us what you are preparing for and when. In a free 30-minute consultation, we will clarify the scope and suggest a realistic first step.
Related services
Services that strengthen your readiness
Cybersecurity advisory and vCISO
Ongoing security leadership that keeps your program, policies and roadmap current.
Vulnerability management
Scanning, in-house penetration testing and retesting that produce the technical evidence most frameworks expect.
Security awareness training
Training, phishing simulations and completion records that support workforce training requirements.
FAQ
Compliance readiness questions
ACS Cyber helps small and midsize organizations prepare for HIPAA, SOC 2, PCI DSS, CMMC and other frameworks through gap assessments, remediation, policies and evidence preparation. We provide nationwide support, headquartered in San Jose, California, with an office hub in Boston.
No, and no provider can honestly make that promise. The determination belongs to your auditor, assessor or regulator. We give you a clear view of your gaps, help close them and prepare organized evidence, so you go into the review knowing where you stand.
No. SOC 2 reports are issued by independent CPA firms. Depending on the level your contract requires, CMMC assessments are self-assessments or are performed by authorized third-party assessment organizations or government assessors. We help you prepare for those reviews and remediate gaps beforehand.
A security risk analysis is the HIPAA Security Rule requirement to assess the risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information you hold. We perform and document the analysis, then help you remediate what it finds. For medical practices, Atlantic Computer Systems, our parent company, also provides HIPAA risk assessments.
Contain the incident, preserve evidence and bring in your legal counsel and your insurer early, as your policy requires. A forensic investigation gives counsel accurate facts, and notification decisions are made with your counsel.
ACS Cyber contains and investigates in-house, works alongside an insurer-assigned response firm where your policy permits, shares technical facts and evidence with counsel and your insurer when you authorize it, and remediates the gaps the incident exposed. See data breach and exposure response.
Start with the one a customer, contract, regulator or insurer actually requires. If none applies yet, NIST CSF 2.0 or the CIS Controls provide a practical structure, and the work carries over to other frameworks later.
No. Many controls overlap across HIPAA, PCI DSS, SOC 2, CMMC and NIST CSF 2.0. We build one control matrix mapped to every framework in scope, so one control and its evidence can serve several requirements.
Yes. We review the questions with you, confirm what is actually in place and help close gaps before you submit. We do not sell insurance, and coverage decisions belong to your carrier. See our cyber-insurance readiness guide. Atlantic Computer Systems, our parent company, also summarizes the cyber-insurance requirements carriers commonly set.
It depends on the framework, the size of the environment and how many gaps the assessment finds. After the gap assessment, we give you a roadmap with a realistic sequence so you can plan around audit dates or contract deadlines.
No. We review how data is protected, not the data itself. Please do not send passwords, health information or financial records through this website or the booking form. During an engagement, we agree on secure ways to review evidence.
Next step
Know where you stand before someone else asks
Talk with ACS Cyber about the framework, questionnaire or renewal in front of you. We will explain what readiness involves and where to begin. For an active incident, call our 24/7 incident line or visit Active Incident Support.