Security & Compliance
Protection you can explain to an auditor, an insurer or a board.
Security isn't a product we add at the end. It's how we run every client: the same baseline controls, applied consistently, documented, and reviewed as threats change.
How we protect clients
- Multi-factor sign-in on email and every critical account.
- Endpoint protection and 24x7 monitoring on every managed device.
- Prompt operating system and application patching.
- Encrypted laptops and encrypted, off-site, tested backups.
- Least-privilege access: staff get what they need and no more.
- Hardened Microsoft 365 and email filtering against phishing and impersonation.
- Security awareness training and phishing tests for staff.
- Help writing an incident response plan, so everyone knows the first hour's steps.
How we protect ourselves
An IT provider holds the keys to many offices, which makes us a target too. We use multi-factor sign-in everywhere, keep administrative access private and tightly restricted, use vendors whose security is independently audited, and hold ourselves to the same controls we put in place for clients.
Bill Brazeal holds the CISSP, one of the most respected credentials in information security.
HIPAA support for medical and dental practices
The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic patient information. We help with the technical side and the documentation behind it:
- a security risk assessment and a plan to address what it finds;
- access controls, unique logins, automatic logoff and multi-factor sign-in;
- encryption of devices, email and backups;
- audit logging and monitoring;
- backup, disaster recovery and emergency-mode planning;
- written policies, staff training records and evidence for audits;
- a Business Associate Agreement where HIPAA requires one.
What we don't promise
No IT provider can make a practice "HIPAA compliant" on its own. Compliance also depends on your policies, your privacy practices, your staff and your other vendors. We work alongside your compliance officer, practice administrator or attorney, and we're clear about which parts are ours.
Likewise, no security program can promise you'll never have an incident. What we can promise is that you'll be far harder to breach, you'll know quickly if something happens, and you'll be able to recover.
Cyber insurance
Insurers now expect multi-factor sign-in, endpoint detection, tested backups and an incident response plan, and they ask about each one on the application. We help you answer accurately, close gaps that affect your coverage or premium, and coordinate with your agent and the insurer's response team if you ever need to use the policy.
Other requirements
Financial, legal and retail offices face their own rules, from client data protection to payment card security. We map your obligations to concrete controls and keep the evidence organized for when someone asks.