Compliance & cyber insurance
Practices, advisors and firms in New York carry obligations their IT provider usually ignores until the questionnaire arrives. We run the HIPAA Security Risk Assessment your covered entity is required to have, build the written information security program the SHIELD Act expects, maintain the NYDFS Part 500 controls and filings for financial advisors, and take companies through SOC 2 readiness with an auditor we have worked with. Cyber insurance applications are completed from the same evidence the monthly report draws on, so the answers are true.
What is included
- HIPAA Security Risk Assessment with the risk register, remediation plan and policy set
- NY SHIELD Act written information security program (WISP) and annual review
- NYDFS Part 500 program for financial advisors: risk assessment, policies, annual certification support
- SOC 2 readiness: gap assessment, policies, control implementation, evidence collection, auditor management
- Cyber insurance readiness review and application support, with evidence attached
- vCISO hours on Complete: policy reviews, vendor assessments, board-level reporting
- Business associate and data processing agreements signed where your regulation requires one
Questions about compliance & cyber insurance
Do you do the audit?
No. Readiness is ours; the audit is an independent CPA firm's. We prepare the evidence, sit in the fieldwork and handle the follow-ups.
Our insurer sent a 40-question form. Can you fill it in?
Yes, included on Secure and Complete. Answers come from the monitoring data, so the policy holds up if there is a claim.
How often is the HIPAA risk assessment needed?
Annually, and after any significant change. The first one is a project; the annual update is included on Complete.
Other services
Get the number in writing.
People, devices, servers and sites. The quote names the plan, any projects and the total.