Compliance
Meet HIPAA, FTC Safeguards, and insurance requirements, documented.
Policies, technical controls, and the evidence an auditor or insurer asks to see. We do not claim certifications Tritek does not hold.
Who this is for
Healthcare practices, accounting and tax firms, retailers, and any business whose insurer or a large customer just sent a security questionnaire. Defense suppliers can ask about CMMC readiness. That work is confirmed before we describe it as an engagement.
What’s included
-
Risk assessment
A written look at how data moves through the business and where it is exposed.
-
Policies
Short policies people can follow: access, passwords, devices, vendors, and what to do when something looks wrong.
-
Technical controls
MFA, encryption, backups, logging, and least-privilege access lined up with the policy. A policy with no control behind it does not help you.
-
Evidence
The exports, screenshots, and restore records an auditor, a customer, or an insurer asks for.
-
Healthcare
Help for practices that handle patient information and have to show HIPAA safeguards. We are not a HIPAA certifier, and we will not say the help desk is “HIPAA certified.”
-
FTC Safeguards
For tax preparers, accounting firms, and other financial businesses covered by the Safeguards Rule: a security program, a qualified person, and the controls the rule expects.
-
PCI DSS
Help retailers shrink where card data lives and document the controls around what remains. We are not a QSA and we do not imply an audit we did not perform.
-
CMMC readiness
Defense-supply-chain readiness only if you confirm we should offer it. We do not claim a CMMC certification.
Tools and partners
Vendor names and logos stay off the site until the current list is confirmed.
How we deliver it
- 1
Name the rule
HIPAA, FTC Safeguards, PCI, a customer contract, or an insurance form. The work follows the requirement, not a generic checklist with your logo on it.
- 2
Gap list
What you already do, what is missing, and what is written down versus what is only a habit.
- 3
Fix and file
Controls get turned on. Policies get saved somewhere the team can find them.
- 4
Keep the evidence current
The quarterly review includes the items that expire, such as training, restore tests, and vendor lists.
Questions people ask
Are you a HIPAA auditor?
No. We help practices put safeguards and documentation in place. We do not certify a practice, and we do not publish compliance badges.
Do you cover the FTC Safeguards Rule?
Yes, as a practical program for the firms it covers, including many tax and accounting offices. You still own the program. We help build it and keep the technical pieces current.
Can you make us PCI compliant?
We can help you reduce where card data lives and document controls. We will not call you compliant, and we are not a Qualified Security Assessor.
Do you do CMMC?
Related services
Find out where your IT stands.
Free, no-obligation assessment. A person reads what you send.