Who each framework applies to, what it actually asks for, and how they overlap. You don't need to know any of this before calling us. It's here in case you want to.
Highlighted cards are our core practice areas. Most organizations answer to two or three of these at once, which is why we assess each on its own terms and use the overlap so you never do the same work twice.
Requires safeguards for patient information, starting with an accurate, organization-wide risk analysis. Some safeguards are "required"; others are "addressable", meaning you implement them or document why an alternative is reasonable.
Twelve requirement areas protecting cardholder data. Most small merchants validate annually through a self-assessment questionnaire (SAQ). Choosing the right one depends on how you take payments.
Six functions (Govern, Identify, Protect, Detect, Respond, Recover) that give boards and staff a shared language. It's our default lens for local government and for board reporting.
Requires a written information security program, board oversight and member-notice procedures, plus reporting of cyber incidents to NCUA within 72 hours. Examiners review it during information security examinations.
Protects student education records and limits disclosure. Ed-tech vendors typically get access under the "school official" exception, which makes data sharing agreements essential.
Pennsylvania's breach notification law. Amendments in 2024 added Attorney General notice and credit-monitoring requirements in certain breaches.
Requires independent, third-party technical security assessments for agencies supporting critical functions, and for vendors that serve them.
An international standard for an information security management system, certified by an accredited body. Usually driven by customers who require certification.
A CPA firm's report on a service organization's controls. We provide readiness: getting your controls and evidence in shape before the auditor arrives.
The clocks start the moment something goes wrong. A good program knows them before it needs them.
Outer limit to notify individuals after discovering a HIPAA breach.
45 CFR 164.404(b)For a federally insured credit union to report a cyber incident to NCUA.
12 CFR 748.1(c)HIPAA Security Rule implementation specifications, 22 of them "addressable" with documented decisions.
45 CFR 164, Subpart C, App. ALongest interval between reviews of each PCI DSS targeted risk analysis.
PCI DSS v4.0.1 · 12.3.1HIPAA compliance can satisfy Pennsylvania's breach law for the same incident. But Pennsylvania adds its own layers, and the details matter.
Pennsylvania's Breach of Personal Information Notification Act generally treats a HIPAA-covered organization that follows HIPAA's breach notification rules as compliant. But 2024 amendments added Attorney General notice and credit-monitoring requirements, and the state's HIV, mental-health and patient-record confidentiality laws can be stricter than HIPAA. Your incident response plan should account for all of it.
General information, not legal advice.That's the first thing we sort out, usually in a single conversation.
