Does your business need to meet specific compliance requirements? Contracts, insurers, payment processors and regulators increasingly ask small businesses to show how they protect data. Zippie IT, a veteran-owned company in Meridian, Idaho, helps you find out where you stand, understand your options and close the gaps.
Choose the framework that applies to you
- HIPAA: for health care practices and the businesses that serve them. We assess the technical, administrative and physical safeguards of the HIPAA Security Rule and where needed sign a business associate agreement. See IT and compliance for healthcare practices.
- PCI DSS: for any business that accepts payment cards. We work out which questionnaire you need and whether you are ready to complete it. See PCI DSS assessments.
- CMMC: for defense contractors and subcontractors that handle federal contract information or controlled unclassified information. See CMMC readiness assessments.
- NIST Cybersecurity Framework 2.0: a practical way to measure and improve overall security. It is the right start when no single rule applies but customers, partners or insurers are asking questions.
- SOC 2: a report on a service provider’s controls. We help you prepare, and an independent CPA firm performs the audit.
How an assessment works
- Scope. We agree what is covered: systems, people, locations and data.
- Review. We compare your practices and settings with each requirement, using interviews, documents and technical checks.
- Report. You receive plain-language findings, a score or rating where the framework has one, and a prioritized plan.
- Fix. We can do the technical work, or work alongside your own staff. Remediation is quoted separately from the assessment.
- Repeat. Compliance is yearly. A shorter annual review keeps the plan current.
Not sure where to start?
A free network review is a good first step. It shows what is in place today, and it helps us recommend the right assessment. Our cyber insurance readiness service helps with renewal questionnaires. These guides explain what insurers ask: how to answer cyber insurance renewal questions without voiding your policy and what immutable backup means on your cyber insurance form.
Requirements look different by industry. See how we help medical billing companies as HIPAA business associates, accounting and tax firms with the FTC Safeguards Rule and insurance agencies and financial advisors with carrier and regulator expectations.
Ongoing guidance
Our vCIO services give you an experienced adviser for policies, procedures and planning over time. For more, see our consulting services and cybersecurity services.
What to expect
We help you prepare and improve. We are not an auditor or a certifying body. Where a framework requires a formal certification, audit or attestation, the accredited body for that framework carries it out, and we help you get ready for it.
Talk to us
Contact us for a free consultation, or call (208) 810-1795 or email info@zippieit.com.
We use your details to respond to your request. If you want details, see our Privacy Policy.
Frequently asked questions
Which compliance framework applies to my business?
It depends on your data and your customers. Health information points to HIPAA, card payments to PCI DSS, and defense contracts to CMMC. If you are unsure, send us your contracts and insurance questionnaire and we will help.
Are you an auditor or certifying body?
No. We perform readiness assessments and help you fix gaps. Formal certifications and audits are done by the accredited body for each framework.
How long does an assessment take?
Usually a few weeks, depending on size and scope. We give you a timeline once we understand your business.
Do you fix the problems you find?
Yes, if you want us to. Remediation is quoted separately, so you can also use your own team or another provider.
How often should we reassess?
At least once a year, and after major changes such as a new system, a move or a new contract.
Free self-checks to start with: the cybersecurity health check, the PCI SAQ selector and the CMMC Level 1 self-assessment.