Fully Managed IT
Your complete IT department, run for you.
Security evidence & questionnaires
The technical evidence your auditor, insurer or client asks for.
We implement and document the technical safeguards your auditor, insurer or client asks about. Your compliance program, policies and risk analysis stay with you or your compliance adviser.
Who it’s for
For organizations that have to show their work.
The questions come from different places. The answer is the same: controls implemented to a standard, and evidence that proves it, ready when someone asks.
- Healthcare organizations with business associate obligations and a Security Rule to operate to.
- Firms whose clients send security reviews before signing, and every year after.
- Any organization whose cyber insurance now demands specific controls, and asks for proof at renewal.
- Financial firms whose examiners expect documented technical controls.
- Any organization that has been told to produce evidence and doesn’t know where to start.
What’s included
Controls implemented, evidence kept, questions answered.
Technical controls
Identity and MFA, encryption, logging, device management, backups and segmentation, implemented to CIS Controls as the operating baseline.
Evidence collection
Screenshots, reports and logs organized by control, kept current, and ready when an auditor, insurer or client asks.
Security questionnaires
Help giving accurate, consistent answers to the reviews clients, partners and insurers send, with the controls behind every answer.
Business associate agreements
We sign them with healthcare clients and operate to them. PHI is handled under the technical safeguards the Security Rule names.
Vendor coordination
For the vendors we manage on your behalf: what they hold, how it’s protected, and the documentation they owe you.
Insurance renewals
The controls underwriters look for (MFA, endpoint detection and response, backups, training) in place, and the attestations answered truthfully.
How it works
Three steps, then it stays current.
- Weeks 1–2
Assess the technical controls
Measure what is in place against the baseline and against what your auditor, insurer or client actually asks for.
- Weeks 2–8
Close the gaps
Implement the missing controls in priority order, with progress reported as we go.
- Ongoing
Keep the evidence current
Evidence refreshed on a schedule, so the next questionnaire you complete is a day’s work, not a month’s.
What you can expect
Where our evidence is used.
- HIPAA technical safeguards and business associate agreements.
- GLBA Safeguards technical controls: access reviews, logging, encryption.
- Cyber insurance control requirements and renewal attestations.
- Client security reviews and vendor questionnaires.
- CIS Controls as the operating baseline behind all of it.
Questions
What leaders ask us.
Can you certify us?
No. No IT provider should certify its own work. We put the technical controls and evidence in place, then support you through independent review by your auditors, examiners or assessors.
Can you run our compliance program?
No, and you should be wary of an IT provider who says yes. We implement and document the technical side; a compliance adviser or your own team owns the program, the policies and the risk analysis. We work alongside them.
Do you sign a business associate agreement?
Yes. We sign BAAs with healthcare clients and handle PHI under HIPAA technical safeguards.
Is this included in the managed plan?
Yes. The technical controls, the evidence and help completing your questionnaires are part of every fully managed plan. There is no separate compliance product to buy. See how pricing works.
Related services
Cybersecurity
Layered defense and rehearsed response.
AI, Done Responsibly
We help you use AI with confidence: guardrails first, real time saved after.
Start with a conversation.
Thirty minutes with a support specialist, not a salesperson. We’ll ask about your environment, tell you what we’d look at first, and say so if we’re not the right fit. No cost, no obligation, and nobody will call you seven times.