SECURITY COMPLIANCE

The security controls your insurer and regulators expect, actually in place.

Insurance carriers and regulators want proof of the same basic controls: MFA, endpoint protection, tested backups, and a plan for when something goes wrong. We put them in place, write the documents that describe them, and keep both current.

Book a 30-Minute Compliance Conversation

Most compliance work is IT work.

Insurance carriers, federal rules, and payment card standards all ask the same questions in different words. Is MFA turned on? Are devices protected and patched? Are backups tested? Who has access to customer data, and how would you know if someone took it?

Answering those honestly takes someone who runs the environment. We do. That means we can fix the gap the same week we find it, and the paperwork describes how your systems actually work.

The controls insurers expect.

We don’t sell insurance. We put in the controls carriers look for, so your business qualifies for coverage and your answers hold up if you ever file a claim:

  • Multi-factor authentication on email, remote access, and admin accounts
  • Endpoint detection and response on every device
  • Email security and regular patching
  • Backups that are tested and protected from ransomware
  • A written incident response plan, so you know who to call before you need to
  • A clear policy on how your team uses AI tools, which carriers have started asking about

When renewal comes around, we help you answer the questions accurately. If you work with an insurance agent, we’ll work with them directly.

FTC Safeguards Rule and WISPs.

The FTC Safeguards Rule covers more businesses than most owners expect. Collection agencies, auto dealers that arrange financing, tax preparers, CPAs, and mortgage brokers all fall under it. Covered businesses need a written information security program, a designated qualified person, risk assessments, MFA, encryption, and vendor oversight. Since May 2024, a breach involving 500 or more consumers has to be reported to the FTC within 30 days.

Tax preparers hear it from the IRS as well, which expects every paid preparer to maintain a written information security plan.

We write the program, implement the technical controls it describes, and handle the technical side for whoever you name as the qualified individual.

PCI DSS.

If you take card payments, your processor expects you to follow PCI DSS. Version 4.0 made a set of new requirements mandatory in March 2025, including vulnerability scanning and payment page protections that reach smaller merchants. We’ve done this work for businesses that answer to PCI auditors, including segmentation, hardening, and the evidence auditors ask for.

CMMC and NIST 800-171.

Defense contractors and subcontractors have a separate set of requirements. Our CMMC and NIST 800-171 page covers what changed in July 2026 and what still applies.

Book a 30-Minute Compliance Conversation

Bring the renewal form, audit request, or processor letter. We'll tell you where you stand.

Frequently asked questions.

What do cyber insurance carriers require now?

Nearly every carrier asks about multi-factor authentication on email, remote access, and admin accounts; endpoint detection and response on every device; and backups that are tested and protected from ransomware. Many also ask about patching, email filtering, security training, a written incident response plan, and, more recently, how your business uses AI tools.

Will you help with our insurance renewal?

Yes. For our clients, it's part of the job. We'll help you answer the carrier's questions accurately and fix any gaps before you sign. An answer that overstates your controls can give a carrier grounds to deny a claim, which is the worst time to find out.

Does the FTC Safeguards Rule apply to my business?

It applies to businesses the FTC considers financial institutions, which is broader than it sounds: collection agencies, auto dealers that arrange financing, tax preparers, mortgage brokers, and others. Covered businesses need a written information security program, a qualified person responsible for it, MFA, encryption, and since May 2024, notice to the FTC within 30 days of a breach affecting 500 or more consumers.

What is a WISP?

A written information security plan. The IRS requires one for every paid tax preparer, regardless of size, and the FTC Safeguards Rule requires an equivalent for every covered business. It describes how you protect customer information and who's responsible. We write it to match how your business actually runs.

What changed with PCI DSS 4.0?

All of the new requirements became mandatory in March 2025. For many smaller merchants, that means quarterly vulnerability scans and protecting your payment pages against script attacks. Some businesses that used to qualify for the shortest self-assessment now have more to prove.

Do you do CMMC and NIST 800-171?

Yes. Defense contractors have their own page covering CMMC and NIST 800-171, including what changed when the DoD suspended Phase II in July 2026.

Find out where you stand.

Bring whatever is asking the questions: a renewal form, an auditor's request, or a letter from your card processor. We'll tell you where you stand and what it takes to close the gaps.

Book a 30-Minute Compliance Conversation

Related services

Related industries