Loading...
Compliance Engineering
I assess your technical safeguards against the actual regulatory requirements, document the gaps with evidence, and hand you a prioritized remediation roadmap your team can execute.
Most compliance programs are spreadsheets. The controls described on paper do not match the controls running in production.
The gap between documentation and reality is where audit findings live.
Paper policies, no enforcement: The MFA policy exists. Half the workforce uses shared credentials. The security rule says encrypt at rest. Three NAS devices run unencrypted SMB shares.
No evidence collection: Auditors ask for proof of restore testing. The backup team says "it runs every night." Nobody can produce a restore log from the last 12 months.
Reactive remediation: Controls get fixed the week before the audit, then drift back within 90 days. No monitoring, no enforcement, no accountability loop.
I assess what is actually running, compare it to what the regulation requires, and document the delta with evidence your auditor can verify.
Control-by-control assessment against HIPAA, SOC 2, PCI DSS, or CJIS technical requirements. Each gap includes the specific regulation reference, current state, and required state.
Screenshots, configuration exports, and log samples that demonstrate current compliance posture. Organized by control family for direct auditor consumption.
Gaps prioritized by regulatory risk and implementation effort. Each item includes the specific configuration change, the responsible party, and the estimated timeline.
Assessment of existing written policies against regulatory requirements. Gaps between documented policy and actual technical implementation are flagged explicitly.
A single deliverable your compliance officer can hand to an auditor: current posture, known gaps, remediation status, and supporting evidence. No scrambling the week before.
What affects scope.
Field Evidence
Real compliance and security work from previous engagements.
The Shared Login Reckoning: HIPAA's New Security Rule: A client wanted shared credentials to cut licensing costs. The new HIPAA Security Rule makes that a violation. MFA, encryption, and pen testing are no longer optional.
HIPAA, Analytics, and the End of the Ad-Hoc Portal: How recent HIPAA and OCR guidelines force fundamental engineering changes across web analytics, shared logins, and WCAG accessibility.
Shared Wi-Fi Passwords: The Risk Nobody Budgets For: A PSK on a sticky note is not a security control. 802.1x certificate-based authentication is the standard. This post walks through the gap.
Common Questions
I review your regulatory requirements, scope the assessment boundary, and send a fixed-price proposal within 48 hours.