Requirement-by-requirement reviews for organizations that hold protected health information, account data or consumer financial information.
HIPAA has no certificate at the end of it. What it has is an Office for Civil Rights audit protocol, a breach portal and enforcement actions that turn on whether an organization ever did an accurate and thorough risk analysis.
Financial regulation works the same way: the question is whether you can show, provision by provision, what you do. Our reviews work each rule from its own operative wording and are scoped to your entity type and the data you actually hold.
An activity-by-activity review of your ePHI safeguards against the HHS OCR HIPAA Audit Protocol for the Security Rule: the Administrative, Physical, Technical, Organizational and Documentation safeguards.
A readiness and gap review using the NIST guidance that maps the HIPAA Security Rule into key activities, to safeguard ePHI and document a defensible program.
A readiness and gap review across Requirements 1 through 12 and Appendices A1, A2 and A3, scoped to your entity type, merchant or service provider level and cardholder data environment. Applicability is tracked item by item, including the requirements that came into force after 31 March 2025.
A review of your payment software and the lifecycle behind it against both standards in the framework: the PCI Secure Software Standard v2.0 and the PCI Secure Software Lifecycle (Secure SLC) Standard v1.1.
Know exactly what your privacy notice promises, and whether your systems keep it. We review Regulation P (12 CFR part 1016) against your institution type, product lines, affiliate structure and sharing posture.
A review that first establishes which FCRA duties actually attach to your organization, and then whether you can show them.
A readiness and gap review against Regulation (EU) 2022/2554, scoped to your entity type, your critical or important functions and your ICT provider estate.
For financial institutions licensed in the West African Monetary Union: one review against the BCEAO instructions for payment services, electronic money and market infrastructures and the Commission Bancaire de l’UMOA circulars on governance, internal control, risk management and compliance.
No. HIPAA is a policy and process rule before it is a technical one. None of the 72 key activities in the OCR audit protocol can be closed on AWS output alone: every activity needs documentation as well, and we collect both.
No. Our PCI DSS work is a readiness and gap review that prepares you for a self-assessment questionnaire or a QSA-led assessment.
The OCR audit protocol review shows how you would fare in an audit by the regulator. The NIST SP 800-66r2 review follows the NIST implementation guidance and suits organizations building or documenting a program. They can be combined.
Book a consultation with our team in Salt Lake City, Bordeaux or Johannesburg and tell us what you are trying to solve.