Security and compliance

Filter for the requirement before you take a meeting.

Tell me the rule you have to meet (such as HIPAA, PCI, SOC 2, HITRUST, CMMC, FedRAMP, NIST, ISO 27001, or E-Rate). I use it to narrow solution providers across phones, cloud, and security. A full security program, secure networking (SASE), penetration testing, and physical security are separate reviews.

What I compare

• The requirement. The specific rule your organization must meet.
• Coverage. The parts of the requirement each provider covers, and the parts that stay with your team.
• Monitoring and response. Endpoint detection and response (EDR), which watches laptops, desktops, and servers for signs of an attack, and managed detection and response (MDR), where a provider’s security team watches the alerts and handles incidents.
• Fit. How each option fits the tools and staff you already have.
• Scope across systems. Which systems the rule applies to: phones, cloud, network, or all of them.
• Contract terms. Term length, notice periods, and renewal terms.

Common situations

A new compliance requirement. A customer, regulator, or insurer now requires a rule you have to meet. I narrow providers to those that cover it.

A renewal with a coverage question. The current provider may not fully cover the rule. I compare before you renew.

Several rules across different systems. I map each rule to the systems it applies to, then compare.

When staying put is the right call

If your current setup already meets the rule and the terms work, I will say so.

See the criteria I use to compare security providers

How a Technology Needs Assessment works

Security and compliance FAQ