Compliance frameworks
Programs documented against the frameworks that apply to you.
A control an auditor cannot see does not count. We document the program against the framework as we build it. Our clients have passed every audit they have brought us into, across HIPAA, PCI-DSS, NY-DFS Part 500, and SOC 2.
Audit record
- Pass rate
- 100% across client engagements
- Deliverables
- Risk registers, findings, evidence
- Opinion
- Remains with independent auditors
Frameworks
Frameworks we support.
- Who
- Healthcare providers, health plans, clearinghouses, and business associates handling ePHI.
- What we do
- Security Rule risk analysis (45 CFR § 164.308), asset inventory and ePHI flow mapping, safeguard implementation, encryption, MFA, backup and restoration, and ongoing management.
- Evidence
- OCR-ready risk assessment documentation, policies, remediation records, and testing reports.
- Learn more
- HIPAA security services · Readiness checklist
- Who
- Retailers and any organization that stores, processes, or transmits payment card data.
- What we do
- Scope reduction through tokenization and encryption, cardholder data environment protection, Requirement 11 penetration testing and vulnerability scanning, and program documentation.
- Evidence
- Penetration test reports, scan results, encryption and key management documentation, and gap assessments.
- Learn more
- Retail · Encryption and tokenization
- Who
- Banks, insurers, agencies, and other entities licensed by the New York Department of Financial Services.
- What we do
- Cybersecurity program and policy, risk assessment, penetration testing and vulnerability management (500.05), MFA, encryption, incident response, and evidence for the annual certification.
- Evidence
- Risk assessment, testing reports, control documentation, and incident response plans.
- Learn more
- Financial services · Insurance
- Who
- Organizations responding to customer due diligence on how they protect data, especially SaaS and service providers.
- What we do
- Readiness assessment against the Trust Services Criteria, control implementation, vulnerability management and monitoring, and evidence preparation for the audit.
- Evidence
- Control narratives, policies, monitoring records, and penetration test reports.
- Learn more
- Technology and SaaS
- Who
- Any organization that wants a structured way to measure and improve its security program.
- What we do
- Cyber risk evaluation against the Identify, Protect, Detect, Respond, and Recover functions, maturity scoring, and a prioritized roadmap.
- Evidence
- Risk register, current and target profiles, and remediation plan.
- Learn more
- Assessments and compliance
Our work supports your compliance program. Certification and audit opinions remain with the appropriate independent parties. Testing does not itself certify compliance or guarantee a third party’s acceptance.
Other requirements
Also commonly relevant.
GLBA and FFIEC
Safeguards Rule programs and examination guidance for financial institutions.
NAIC Model Law
State insurance data security laws modeled on the NAIC framework.
Cyber insurance
Application controls carriers expect: MFA, EDR, backups, email security, and testing.
AI governance
NIST AI RMF, the EU AI Act, and emerging state rules for AI systems.
Facing an audit or a questionnaire?
Tell us the framework and the deadline. We will say what evidence you are missing and how long it takes to produce.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon