Cybersecurity for businesses in northwest Iowa: layered security, 24/7 monitoring and the paperwork that proves it, for HIPAA, PCI DSS, CMMC, SOC 2, the FTC Safeguards Rule and your cyber insurer.
$ connect eth0link up, 1 Gbps$ scan 10.0.0.0/24devices found: 23CRIT Default switch passwordHIGH Remote desktop open to the internetHIGH File server missing patchesMED Guest Wi-Fi can see staff PCsScan complete. 4 findings.Pen test reportExample findingsCriticalDefault switch passwordHighRemote desktop open to the internetHighFile server missing patchesMediumGuest Wi-Fi can see staff PCsPlan to fix: attachedIs this you signing in?Approve
Which rules apply to you?
Pick everything that is true of your business. Most rules turn out to ask for the same twelve things.
Nothing picked yet. Here are the twelve controls they share.
Risk assessmentWhat could hurt you, found and ranked.
MFA and access controlA stolen password is not enough to get in.
EDREvery computer watched for behavior that looks like an attack.
Patching and vulnerability scansKnown holes found and closed on a schedule.
EncryptionA stolen laptop or an intercepted email reads as noise.
SIEM and 24/7 monitoringEvery log in one place, with someone watching.
Immutable backupsCopies ransomware cannot touch, restored on purpose.
Security awareness trainingYour people practice spotting the fake email.
Firewall and segmentationGuests, registers and servers each kept in their own lane.
Penetration testingWe attack it first and show you what we got into.
Incident response planWho does what in the first hour, written before you need it.
Policies and evidenceThe paperwork an auditor, insurer or customer asks to see.
PCI DSS
The card brands’ rulebook for anyone who stores, processes or transmits card numbers.
A firewall, and no default passwords
Vulnerability scans every quarter and a penetration test every year
Logs kept, and watched
How we help. We shrink the card environment as far as it will go, then run the scans, the test and the paperwork.
HIPAA
US law for healthcare providers, health plans and the firms that work for them.
A written risk analysis
Access controls and audit logs on patient data
Backups, and a plan for a bad day
How we help. We do the risk analysis, lock down who can see what, and keep the evidence an auditor asks for.
CMMC and NIST 800-171
The Pentagon’s standard for contractors and their suppliers. Level 2 is the 110 requirements of NIST SP 800-171.
Multi-factor sign-in everywhere
Audit logs and incident reporting
A system security plan (SSP) and a plan of action (POA&M)
How we help. We run the gap assessment, close what is open, and write the SSP and POA&M with you.
SOC 2
An independent auditor’s report on how you protect customer data, measured against the Trust Services Criteria.
Controls that are written down
Proof that they ran, month after month
Monitoring, change control and vendor checks
How we help. An auditor issues the report. We get you ready for it: the controls, the monitoring and the evidence.
FTC Safeguards Rule
A federal rule for non-bank financial businesses: auto dealers, tax preparers, lenders and more.
A named person in charge and a written risk assessment
Multi-factor sign-in and encryption
Yearly penetration testing, or continuous monitoring
How we help. We act as the outside security team the rule expects, and run the testing it names.
Cyber insurance
Not a law. But the questionnaire decides your premium, and whether you get a policy at all.
MFA on email and remote access
EDR on every computer
Backups an attacker cannot delete
How we help. We put the controls in, then help you answer the questionnaire truthfully.
A plain summary, not legal advice. Your auditor, assessor or insurer has the final word, and we work with them.
The six layers
Email security and training
Phishing filtered before anyone clicked.
Phishing-resistant MFA
A stolen password still can’t get in.
EDR with 24/7 monitoring
Malware caught and isolated in seconds.
Immutable backups
Ransomware is a restore, not a ransom.
AI cameras and door access
Break-ins caught on camera.
Internet failover
An outage switches to the backup line.
Pen testing: we break in before someone else does.
Ethical hackers attack your business the way a real criminal would: from the internet, from inside your network, over Wi-Fi, by email and through a USB port. You get a plain-English report of what we found and a plan to fix it.
