Compliance Needs Based on Industry & Location

SOC 2 Type I & II The five Trust Services criteria

Developed by The American Institute of Certified Public Accountants (AICPA), SOC 2 helps organizations safeguard customer data.

SOC stands for System and Organization Controls — it includes five Trust Services Criteria

security, availability, processing integrity, confidentiality, and privacy. SOC 2 compliance is a critical framework for MSPs and clients.

SOC 2 — short for System and Organization Controls 2 — is a widely recognized auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It is designed to help service organizations, like Managed Service Providers (MSPs), demonstrate their commitment to safeguarding customer data and managing risk effectively.

ISO 27001 (2022) Implement and maintain an ISMS

ISO 27001 is the internationally recognized standard for implementing and managing an Information Security Management System (ISMS). It should not be confused with ISO 27701, ISO 27017, or ISO 27018. ISO 27001 requirements are the standard used to pass an audit, guaranteeing that a business’s security protocols are up-to-date.

PCI DSS Secure credit card data

The Payment Card Industry Data Security Standard (PCI DSS) is essential for anyone handling credit card information. These standards are designed to protect and secure payment accounts throughout the transaction process. All companies that accept, process, store, or transmit credit card data should be sure to abide by these standards. PCI compliance standards are a pillar in e-commerce.

HIPAA Securing personal health info

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It’s a federal standard specifically for protected health information (PHI). Regulated by the Office for Civil Rights, HIPAA outlines the permissible use and disclosure of PHI in the USA as set forth by HHS guidelines. HIPAA compliance is absolutely crucial for all healthcare businesses and anyone who handles personal health data for customers and clients.

SOC 1 Type I & II Financial data control

Developed by The American Institute of Certified Public Accountants (AICPA), SOC 1 reports address a service organization’s financial controls. Type I is a snapshot of controls at a specific point in time, while Type II reports on controls over a defined period. The framework outlines five objectives that organizations must address: control environment, risk assessment, control activities, information and communication, and monitoring.

SOC 2 Type I & II The five Trust Services criteria

Developed by The American Institute of Certified Public Accountants (AICPA), SOC 2 helps organizations safeguard customer data. SOC stands for System and Organization Controls — it includes five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. SOC 2 compliance is a critical framework for MSPs and clients.

FTC Safeguards Rule Rules for financial institutions

The FTC Safeguards Rule ensures that entities covered by the Rule maintain safeguards to protect customer information. It applies to financial institutions subject to the FTC’s jurisdiction that aren’t subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6805.

DORA For the EU financial sector

The Digital Operational Resilience Act (DORA) is a regulatory framework aimed at strengthening the cybersecurity and operational resilience of the financial sector within the European Union. It is critical for financial institutions as it mandates comprehensive management of ICT risks, ensuring consistent and robust security practices across the sector to prevent and mitigate cyber incidents.

FFIEC Cybersecurity Assessment Assessment for financial institutions

The Cybersecurity Assessment Tool helps financial institutions recognize potential risks and determine their cybersecurity preparedness. Developed by the Federal Financial Institutions Examination Council with ideas from the FFIEC Information Technology Examination Handbook, NIST Cybersecurity Framework, and industry-established best practices, this comprehensive framework is an essential MSP IT service in the financial sector.

NYDFS Cybersecurity Regulation New York’s cybersecurity regulation for financial institutions

The NYDFS Cybersecurity Regulation (23 NYCRR 500) is a comprehensive set of requirements for financial institutions operating under the New York State Department of Financial Services (NYDFS) jurisdiction. It covers organizations such as banks, insurance companies, credit unions, and their third-party service providers, aiming to safeguard sensitive financial data. MSP IT Services must reflect the local requirements for financial institutions in New York.

HIPAA Securing personal health info

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. It’s a federal standard for protected health information (PHI). Regulated by the Office for Civil Rights, HIPAA outlines the permissible use and disclosure of PHI in the USA as set forth by HHS guidelines.

MARS For health, identification, and tax information

Minimum Acceptable Risk Standards (MARS) are designed to ensure the availability, confidentiality, and integrity of protected health information (PHI), personally identifiable information (PII), and federal tax information (FTI). The Centers for Medicare and Medicaid Services developed the standards based on the National Institute of Standards and Technology (NIST) Special Publication 800-53.

PCI DSS Secure credit card data

The Payment Card Industry Data Security Standard (PCI DSS) is essential for anyone handling credit card information. These standards are designed to protect and secure payment accounts throughout the transaction process. All companies that accept, process, store, or transmit credit card data should be sure to abide by these standards, making it another essential MSP IT service.

CMMC 2.0 For defense contractors

The U.S. Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) was introduced to ensure that all defense contractors use security protocols to protect sensitive defense information. Companies responsible for handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) must meet the CMMC compliance requirements.

NIST 800-171 Federal standard for DoD contractors

Similar to the CMMC 2,0, NIST Special Publication 800-171 (NIST 800-171) is a federal standard that establishes procedures for defense contractors and subcontractors. Specifically, it’s for the management of Controlled Unclassified Information (CUI), such as personal data, equipment specs, logistical plans, and other defense-related information.

CJIS Protects criminal justice system information

The Criminal Justice Information Services Security Policy (CJIS) is a set of security standards created by the FBI. CJIS provides the structure needed to handle sensitive criminal justice information. This policy is mandatory for law enforcement agencies, courts, correctional facilities, and any third-party entities that access, store, or transmit this type of data. MSPs must provide a compliance management tool to support clients in these sectors.

FedRAMP Government data in cloud storage

FedRAMP® was launched in 2011 to provide a cost-effective and risk-focused model for the federal government's use of cloud technology. This program is essential for government operations as it ensures that cloud technologies are implemented securely and efficiently using cybersecurity compliance automation software.

Motion Picture Association The film industry framework

The MPA manages security assessments at entertainment vendor facilities for its member studios. This set of Content Security Best Practices outlines standard controls to help secure content, production, post-production, marketing, and distribution. This framework is essential for compliance MSPs who support clients in the film industry.