Compliance

Compliance Is Evidence, Not Software

Nobody calls us because they woke up wanting to be compliant. They call because a prime contractor sent a clause, an insurer sent a questionnaire, an auditor sent a letter, or a customer’s security team sent a sixty-question spreadsheet. The deadline is usually short, and the request is usually written in a language nobody in the building speaks.

The uncomfortable part is that compliance is not something you buy and install. Every framework below asks the same two questions: can you show the control is in place, and can you show it has stayed in place. That means written policy, technical configuration and records — produced on demand, not reconstructed the week the auditor arrives.

Argyle IT Solutions works with businesses across Northwest Ohio, Northeast Indiana and Southeast Michigan on four of these in particular.

CMMC and NIST SP 800-171 — the defense supply chain

If you hold Department of Defense contracts, or you subcontract to a prime who does, and controlled unclassified information passes through your systems, you are in scope. The 110 requirements of NIST SP 800-171 are what CMMC Level 2 assesses against.

This is the framework Northwest Ohio manufacturers most often underestimate. It is not a checklist you finish in an afternoon — it reaches into access control, media handling, physical security, and how you document what you have done.

Where we help:

• Gap assessment against every requirement, with a plain-English report of where you actually stand.
• System Security Plan — the document an assessor asks for first, and the one most companies do not have.
• Plan of Action and Milestones for anything not yet met, with realistic dates attached.
• Remediation of the technical gaps, plus the evidence trail that proves the work was done.

If a contract clause has landed on your desk and you are not sure whether it applies to you, that is the moment to call — not after you have signed it.

HIPAA — healthcare and anyone who touches ePHI

The HIPAA Security Rule requires a documented risk analysis, and its absence is one of the most common findings when a practice is investigated. Having good security is not the same as being able to prove you assessed your risk and acted on what you found.

We handle the risk analysis, the technical safeguards behind it, and the documentation that makes both defensible. Business associate agreements, access logging, encryption and workforce training all sit inside the same job.

There is more detail on our healthcare and HIPAA page.

PCI DSS — if you take card payments

Any business that stores, processes or transmits cardholder data falls under PCI DSS, and your acquiring bank decides which self-assessment questionnaire applies to you. How big that questionnaire is depends almost entirely on how your payment environment is built.

The practical work is usually the same three things: reduce what is in scope, segment the network so card data is not sitting alongside everything else, and keep the recurring obligations from quietly lapsing.

Cyber insurance questionnaires

Insurers now ask for specifics: multi-factor authentication on email and remote access, endpoint detection and response, tested backups held offline, email filtering, and documented staff training.

Answer one of those questions wrongly and you may find the policy does not respond when you need it most. We work through the questionnaire with you, say honestly which answers you can defend today, and close the gaps behind the ones you cannot.

In our experience this is also the cheapest way into the whole subject. Most businesses discover their real security position by filling out an insurance form.

How the work actually runs

• Assess — measure where you stand against the framework that applies to you, and say so plainly.
• Document — write the policies and plans the framework requires, in language your staff will actually follow.
• Remediate — close the technical gaps in priority order, against a budget you have agreed.
• Maintain — keep the evidence current, because every one of these frameworks gets reassessed.

The security work underneath all four is the same discipline described on our cybersecurity page.

Not sure which of these applies to you?

A free, no-obligation audit will tell you which frameworks you are actually subject to, and what it would take to satisfy them. Call 419-419-5737.