CYBER INSURANCE & COMPLIANCE

Cyber insurance, FTC Safeguards, and PCI, handled by the people who run your IT.

Insurance renewals ask more every year, federal rules now reach collection agencies, auto dealers, and tax preparers, and card processors want proof of your controls. We put the controls in place, write the documents that describe them, and keep both current.

Book a 30-Minute Compliance Conversation

Most compliance work is IT work.

Insurance questionnaires, federal rules, and payment card standards all ask the same questions in different words. Is MFA turned on? Are devices protected and patched? Are backups tested? Who has access to customer data, and how would you know if someone took it?

Answering those honestly takes someone who runs the environment. We do. That means we can fix the gap the same week we find it, and the paperwork describes how your systems actually work.

Cyber insurance readiness.

Only about a quarter of small businesses carry cyber insurance, and it costs less than most owners expect. The catch is the application: carriers want specific controls in place and they expect your answers to be accurate.

We help you get insurable and stay insurable:

  • A review of your renewal questionnaire before you answer it
  • MFA, EDR, email security, and tested backups in place where they’re missing
  • A written incident response plan, so you know who to call before you need to
  • Answers about AI use, which underwriters have started asking about
  • Documentation you can hand your agent at renewal time

If you already work with an insurance agent, we’re happy to work with them directly.

FTC Safeguards Rule and WISPs.

The FTC Safeguards Rule covers more businesses than most owners expect. Collection agencies, auto dealers that arrange financing, tax preparers, CPAs, and mortgage brokers all fall under it. Covered businesses need a written information security program, a designated qualified person, risk assessments, MFA, encryption, and vendor oversight. Since May 2024, a breach involving 500 or more consumers has to be reported to the FTC within 30 days.

Tax preparers hear it from the IRS as well, which expects every paid preparer to maintain a written information security plan.

We write the program, implement the technical controls it describes, and handle the technical side for whoever you name as the qualified individual.

PCI DSS.

If you take card payments, your processor expects you to follow PCI DSS. Version 4.0 made a set of new requirements mandatory in March 2025, including vulnerability scanning and payment page protections that reach smaller merchants. We’ve done this work for businesses that answer to PCI auditors, including segmentation, hardening, and the evidence auditors ask for.

CMMC and NIST 800-171.

Defense contractors and subcontractors have a separate set of requirements. Our CMMC and NIST 800-171 page covers what changed in July 2026 and what still applies.

Book a 30-Minute Compliance Conversation

Bring your questionnaire or audit request. We'll tell you where you stand.

Frequently asked questions.

What do cyber insurance carriers require now?

Nearly every carrier asks about multi-factor authentication on email, remote access, and admin accounts; endpoint detection and response on every device; and backups that are tested and protected from ransomware. Many also ask about patching, email filtering, security training, a written incident response plan, and, more recently, how your business uses AI tools.

Can you fill out our insurance questionnaire?

We'll help you answer it accurately, and we'll fix the gaps before you sign it. An answer that overstates your controls can give a carrier grounds to deny a claim, which is the worst time to find out.

Does the FTC Safeguards Rule apply to my business?

It applies to businesses the FTC considers financial institutions, which is broader than it sounds: collection agencies, auto dealers that arrange financing, tax preparers, mortgage brokers, and others. Covered businesses need a written information security program, a qualified person responsible for it, MFA, encryption, and since May 2024, notice to the FTC within 30 days of a breach affecting 500 or more consumers.

What is a WISP?

A written information security plan. The IRS requires one for every paid tax preparer, regardless of size, and the FTC Safeguards Rule requires an equivalent for every covered business. It describes how you protect customer information and who's responsible. We write it to match how your business actually runs.

What changed with PCI DSS 4.0?

All of the new requirements became mandatory in March 2025. For many smaller merchants, that means quarterly vulnerability scans and protecting your payment pages against script attacks. Some businesses that used to qualify for the shortest self-assessment now have more to prove.

Do you do CMMC and NIST 800-171?

Yes. Defense contractors have their own page covering CMMC and NIST 800-171, including what changed when the DoD suspended Phase II in July 2026.

Bring your questionnaire.

Bring the renewal form, the auditor's request, or the letter from your processor. We'll tell you where you stand and what it takes to close the gaps.

Book a 30-Minute Compliance Conversation

Related services

Related industries