Compliance work fails in a predictable way. An organization buys a policy template pack, fills in the blanks, files it, and believes the obligation is discharged. Then an assessor asks not for the policy but for evidence that the control it describes has been operating — twelve months of access reviews, patch records, training completions, log retention — and the gap between what was written and what was done becomes the finding.
We treat compliance as an engineering problem. Controls get implemented in the environment, the environment produces evidence as a by-product, and the documentation describes something that is actually true.
How an engagement runs
Every framework engagement follows the same shape. Scope — establish what is in and out, because scope determines cost more than any other decision. Gap assessment — measure the current state against the control set, honestly, including the uncomfortable parts. Remediation — close gaps in risk order rather than in the order they appear in the standard. Evidence — instrument the controls so they generate proof continuously. Readiness — a dry run before the real assessor arrives.
NIST CSF 2.0
The NIST Cybersecurity Framework is voluntary, which is exactly why it works as a common baseline: it describes outcomes rather than prescribing products. Version 2.0, released in February 2024, added a sixth function, Govern, alongside Identify, Protect, Detect, Respond and Recover — making leadership accountability and supply-chain risk part of the program rather than an afterthought. We use it to give a business one honest picture of where it stands, and as the backbone that the stricter frameworks below plug into.
HIPAA
The Security Rule is less prescriptive than most people expect and more demanding in practice. The core obligations — a genuine risk analysis, access controls, audit controls, encryption decisions documented with reasoning, and business associate agreements that reflect reality — are where findings cluster. The risk analysis in particular is the single most commonly cited deficiency, usually because it was performed once, years ago, and never revisited after the environment changed.
PCI DSS 4.0
Version 4.0 brought several requirements that were future-dated and are now simply in force, along with a stronger emphasis on continuous rather than annual validation. The most valuable work here is usually scope reduction: every system that touches cardholder data pulls a large control set with it, and re-architecting so that fewer systems touch it is cheaper than protecting all of them.
SOC 2 Type II
Type II differs from Type I in one critical respect: it examines whether controls operated effectively over a period, typically six to twelve months. That makes it a scheduling problem as much as a security one. Controls need to be live and generating evidence before the observation window opens, which is why the organizations that struggle are the ones that start three months before a customer deadline.
NIST 800-171 and CMMC 2.0
If you handle Controlled Unclassified Information under a federal contract, this is not optional and the timeline is real. CMMC Phase 2 makes third-party certification by an accredited C3PAO mandatory for contracts involving CUI as of November 10, 2026 — self-attestation on the things that matter goes away.
The work starts with the CUI boundary. Draw it too wide and you are hardening machines that never see CUI; draw it too narrow and an assessor finds CUI somewhere unprotected, which is worse. From there it is the 110 requirements of NIST SP 800-171, a System Security Plan that matches reality, and a Plan of Action and Milestones that is genuinely being worked rather than maintained as a fiction.
One honest caveat we give every prospect: getting to a defensible Level 2 posture from a cold start realistically takes nine to twelve months, because evidence has to accumulate. That is precisely why starting now is the whole point. With Phase 2 beginning November 10, 2026, a firm starting today should plan contract by contract, with a documented POA&M, rather than expect certification by the deadline.
GLBA Safeguards Rule
The FTC's amended Safeguards Rule reaches considerably further than banks. Mortgage brokers, tax preparers and CPAs, auto dealers arranging financing, investment advisers, collection agencies — all can meet the definition of a financial institution. The rule requires a named Qualified Individual, a written information security program, a risk assessment, vendor oversight, and breach notification to the FTC within thirty days of discovering an event affecting five hundred or more consumers.
NYDFS (23 NYCRR 500)
New York's cybersecurity regulation applies to any business licensed by the state's Department of Financial Services — including Ohio insurance agencies, lenders and money transmitters that hold a New York license. The amended rule requires a designated CISO, a written program and policies approved by senior leadership, multifactor authentication for remote and privileged access and, from November 2025, for all access to information systems, an asset inventory, notification to the Department within 72 hours of a qualifying cybersecurity event, and an annual compliance certification due every April 15.
ISO 27001
ISO/IEC 27001 certifies an information security management system rather than a checklist of controls, which is why customers outside the United States so often ask for it. The 2022 revision reorganized Annex A into 93 controls across four themes, and the transition window from the 2013 version has now closed. Certification runs through an accredited body in two audit stages, followed by annual surveillance audits over a three-year cycle, so the program has to keep operating long after the certificate is issued.
Cyber insurance requirements
Insurers now underwrite on controls. Applications and renewal questionnaires routinely ask about multifactor authentication, endpoint detection and response, immutable or offline backups, patching, and security awareness training — and an answer that overstates what is actually in place can give the carrier grounds to deny a claim. We help you document the controls your policy requires and prepare accurate answers for insurer questionnaires, so the coverage you pay for holds up when you need it.
The Ohio angle worth knowing about
Ohio businesses have an incentive that businesses in most other states do not. The Ohio Data Protection Act provides an affirmative defense against certain tort claims arising from a data breach, available to organizations that maintain a written cybersecurity program reasonably conforming to a recognized framework — NIST, CIS Controls, ISO 27001, and several others qualify.
It is a safe harbor rather than immunity, and whether it applies to a given claim is a question for your counsel. But the practical implication is straightforward: the same work that reduces your risk of a breach also improves your legal position if one happens anyway. Very few Ohio businesses we speak to know this provision exists.
What you end up with
A control set that operates, documentation that describes it accurately, evidence that accumulates without anyone having to remember, and a readiness assessment before you spend money on an external auditor. Framed commercially: fewer findings, shorter audits, better insurance conversations, and a defensible position if something goes wrong.
Facing an audit, a customer security questionnaire, or a contract requirement with a date on it?
This page is general information about regulatory frameworks and is not legal, compliance, audit, or insurance advice. Any engagement is governed by the executed Torchsec service agreement.