• Compliance frameworks

Solve compliance challenges and realize positive business benefits.

Contact an expert

Leverage our deep compliance expertise, gained from our work with more than 50 cybersecurity frameworks.

Meet compliance standards

Certain compliance schemes require separation between any advisors and consultants with the third-party auditor. To discuss your specific framework needs and how we can best support you, including with federally cleared staff, contact us today.

Advisory and assessment services

In addition to FedRAMP, PCI, HITRUST, ISO , SOC, StateRAMP, and CMMC – we support the following frameworks.

Department of Defense Risk Management Framework (DoD RMF)

Our DoD RMF certification and accreditation service assesses your information systems to DoD RMF standards in pursuit of a DoD Agency Authority to Operate (ATO). Our DoD RMF experts help you:

  • Gain a unified view of your organization’s cyber risk and vulnerabilities.
  • Gauge the potential impact of risk-based decision-making on the mission.
  • Reduce time spent obtaining DoD and other federal agency authorizations with reciprocal acceptance.
  • Proactively build security into systems, increasing the likelihood of executing future projects on time and on budget.
  • Enhance efficiency through information assurance control inheritance and reuse.
FISMA

Meet FISMA authorization needs with our cost-competitive assessment and advisory services.

  • FISMA assessment
    Assess, test, and review your information systems with our in-depth testing and assessment capabilities.
  • FISMA advisory
    Build security into your IT deployments with our technology consulting services
ITAR and EAR

Our ITAR and EAR advisory and assessment services help you navigate the cybersecurity aspect of the export control compliance process.

  • Export control cybersecurity advisory
    Leverage our expert advisors for support with scoping, gap analysis, implementation of security controls and contract obligations, and documentation development.
  • Export control cybersecurity assessment
    Assess security controls and contract obligation compliance and ensure continuous compliance monitoring.
NIST SP 800-171

We provide advisory and assessment services designed to help you navigate the compliance process for the Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) cybersecurity contract obligations.

  • NIST SP 800-171 advisory Leverage our expert advisors for support with scoping, gap analysis, and implementation of security controls, contract obligations, and documentation development.
  • NIST SP 800-171 assessment Assess security controls and contract obligation compliance and ensure continuous compliance monitoring.
Drug Enforcement Administration’s Electronic Prescriptions for Controlled Substances (DEA EPCS)

Every two years, providers and pharmacies must undergo a third-party audit of their electronic prescription or pharmacy management applications to achieve DEA EPCS certification. Rely on our auditing program for your EPCS assessment and certification:

  • Education – Get the guidance you need to meet federal requirements before deploying your electronic prescription or pharmacy management application.
  • Gap analysis – Identify application deficiencies and receive remediation recommendations.
  • Auditing services – Assess and certify the application’s access controls, proofing services, evidence management, system confidentiality and integrity, and physical security
FFIEC

Banks: Manage risk and GLBA compliance.
Our suite of security services meets the federal, state, and local regulatory needs of the banking industry. We provide guidance for creating a balanced, justified information security program that keeps executive management up to date on risk and threat landscapes and maintains compliance with GLBA. We follow the FFIEC’s defined approach for GLBA compliance by:

  • Testing your network for vulnerabilities
  • Monitoring networks for anomalies
  • Implementing an incident response program
  • Training staff on security awareness
  • Ensuring third parties have adequate security controls in place
Credit unions: NCUA-accepted risk management

Our methodology incorporates the National Credit Union Administration (NCUA) AIRES examination framework to prepare for audits and meet compliance requirements. Our services have been reviewed and accepted by the NCUA and state-level examiners nationwide.

We can also conduct a periodic risk assessment in accordance with the Federal Trade Commission’s Red Flags Rule. The program can help you detect the “red flags” of identity theft in your day-to-day operations, take steps to prevent the crime, and mitigate damage

compliance frameworks overview graphic

What can you expect from our compliance services?

Compliance Essentials

By coordinating assessments across more than 50 compliance frameworks, you can eliminate duplicate activities and maintain a state of continuous compliance with Compliance Essentials.

A knowledgeable team

Projects are led by a credentialed senior director and supported by consultants who have accumulated methodologies, insights, and know-how through service to more than 1,800 clients annually.

The most experience

We conduct more than 2,000 assessments annually.

Cost efficiencies

Rather than rip and replace, we optimize security tools across your organization to leverage your existing assets and licenses – creating a cost-efficient plan to engineer the right architectures, software, and tools to aid in developing resilient, secure systems and migrations

No hidden agenda

Our firm stance on technology and vendor independence allows for thorough in-depth and unbiased recommendations from an experienced third party.

Frequently asked questions

What is FISMA?

The Federal Information Security Management Act (FISMA) is a federal law designed to increase the security posture of government agency federal systems, bureaus, departments, and their supporting entities, such as vendors and subcontractors.

Vendors and subcontractors that provide information systems to agencies must prove, through an annual assessment, that they meet FISMA requirements. This process involves working directly with each agency to achieve an authority to operate (ATO) and be assessed to controls based on FIPS 199, FIPS 200, and NIST SP 800-53 Revision 4.

What DoD RMF stand for?

NIST developed the Department of Defense (DoD) Risk Management Framework (RMF) to provide a set of standards that enable DoD agencies to effectively manage cybersecurity risk and make more informed, risk-based decisions.

Who needs ITAR and EAR advisory and assessment services?

Any organization that deals with defense contracting, defense-related exports, or other defense services may need to comply with either the U.S. International Traffic in Arms Regulation (ITAR) or the similar Export Administration Regulation (EAR). Both the ITAR and EAR establish stringent requirements and restrictions for organizations working with export-controlled products and services to ensure that any export-related actions taken by the organization do not adversely affect U.S. national security.

Ready to fuel your success with unmatched cybersecurity solutions?

Secure your business’s future with our technical expertise, innovative technology, and compliance consulting.