- HIPAA
- Medical and dental practices. Continuous risk analysis, access controls, audit logs, and breach-response procedures — all documented monthly. Our remediation workflows also satisfy the HIPAA Breach Notification Rule for affected individuals, HHS, and (for larger breaches) media notifications within 60 days.
- PCI DSS
- Any business accepting credit cards. Segmented monitoring, quarterly vulnerability scans, and annual pentest — all included. Evidence preservation that satisfies acquiring bank and card-brand investigations, including PCI Forensic Investigator (PFI) requirements.
- SOC 2
- Software and service companies. Auditors receive evidence of continuous monitoring, patch management, incident response, and change control. Evidence of security testing and vulnerability management is formatted to auditor standards.
- Cyber Insurance
- Carriers increasingly require MFA, EDR, 24/7 monitoring, backup, and training as a condition of coverage. All core requirements are delivered and documented by our platform. Our remediation workflows follow underwriter-approved forensic workflows — with hour-by-hour documentation for claim support and direct communication with your carrier's breach coach.
- NIST CSF
- Government contractors and security-conscious SMBs. Our service maps directly to the Identify, Protect, Detect, Respond, and Recover functions.
- CIS Controls
- Implementation Groups 1 and 2 covered end-to-end — inventory, secure configurations, access control, continuous vulnerability management, and more.
- State Privacy Laws
- CCPA / CPRA (California), SHIELD (New York), TXPPA (Texas), and 50+ state breach-notification statutes — each with different clocks and thresholds. Our monthly evidence supports both routine compliance and breach-notification workflows.
- FTC Safeguards Rule
- Financial service providers — documented incident response plan and notification obligations under the updated 2023 rule.
- GLBA
- Gramm-Leach-Bliley Act requirements for financial institutions. Administrative, technical, and physical safeguards documented and enforced.
- ISO 27001
- Information security management system (ISMS) controls mapped and documented. Evidence packages ready for certification audits.
Evidence that writes itself.
Every month, your compliance evidence is generated automatically — control mappings, access logs, patch records, incident reports, and training attestations. When the auditor or underwriter asks, you're already ready.