Clear access rights
Every framework asks who can access what and who approved it. Identity and access management is therefore our core topic, because without roles and documented approvals you cannot prove access control.
A guide to the rules
Which rules apply to your IT?The main frameworks at a glance
Many companies hear about HIPAA, the FTC Safeguards Rule, SOC 2 or CMMC at the same time, often from a customer questionnaire. It is often unclear which one applies and what it means for IT. This page sorts out six common rules and frameworks and shows where they overlap. Afterwards you will know which questions to clarify and where we can take the technical work off your plate.
Six frameworks with a shared core
These rules come from different directions. HIPAA protects patient data in health care. The FTC Safeguards Rule under the Gramm-Leach-Bliley Act covers non-bank financial institutions such as lenders and tax preparers. CMMC applies to Department of Defense contractors, and FDA 21 CFR Part 11 to electronic records in FDA-regulated companies. SOC 2 is not a law at all but an audit report customers ask for, and the NIST Cybersecurity Framework is a voluntary framework many companies use to organize their security.
In IT they ask for many of the same things. Who can access what, can data be restored after an outage, are changes traceable, and can you prove all of it? If you build these basics once and document them well, you cover a large part of several frameworks at the same time.
The frameworks compared
This overview does not replace a legal review of your situation, but it shows where to start.
| HIPAA Security Rule | Applies to health plans, health care clearinghouses and health care providers that transmit health information electronically in standard transactions, and to their business associates, including IT providers. Core IT duties: documented risk analysis, access controls, audit controls, integrity and transmission security, contingency plan with backups and Business Associate Agreements. |
| FTC Safeguards Rule (GLBA) | Applies to non-bank financial institutions under FTC jurisdiction, such as mortgage brokers, finance companies, collection agencies and tax preparation firms. Core IT duties: written information security program with a Qualified Individual, written risk assessment, multi-factor authentication, encryption, regular testing and notice to the FTC within 30 days after a breach affecting 500 or more consumers. |
| SOC 2 | No law. An attestation report by an independent CPA firm under the AICPA Trust Services Criteria, usually requested from service providers by their customers. Type 1 assesses control design at one point in time, Type 2 also tests whether controls operated over a period. Core IT duties: documented and working controls for security and, as chosen, availability, processing integrity, confidentiality and privacy. |
| CMMC 2.0 | Applies to Department of Defense contractors and subcontractors that handle Federal Contract Information or Controlled Unclassified Information. Self-assessments are required in new contracts since November 10, 2025. Third-party assessments under Phase 2 were suspended on July 13, 2026 pending a review. Core IT duties: Level 1 with 15 basic requirements, Level 2 with the 110 requirements of NIST SP 800-171. |
| FDA 21 CFR Part 11 | Applies to FDA-regulated companies such as drug, biologics and device manufacturers when records required by FDA rules are kept or signed electronically. Core IT duties: validated systems, secure time-stamped audit trails, access limited to authorized people, authority checks, record protection for the retention period and control over system documentation. |
| NIST Cybersecurity Framework 2.0 | Voluntary framework for organizations of any size and sector, released by NIST on February 26, 2024. It organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Core IT duties: none by law, but it is a common basis for security programs and customer questionnaires. |
A company can fall under several of these at once. State laws add more: every state has a data breach notification law, and some, such as New York with 23 NYCRR Part 500 for entities licensed by its Department of Financial Services, set their own security requirements.
What they all require
Secure sign-in
Multi-factor authentication for every account, including executives and field staff, and separate accounts for admin tasks. Exceptions are the first thing an auditor notices.
Tested backups
A backup only counts once a restore has been tested and the result documented. HIPAA, the FTC Safeguards Rule and Part 11 all expect that data can be recovered.
Traceable changes
Who changed what, when, and who approved it? Logs and an orderly change process answer this question before an auditor asks it.
A plan for incidents
After a breach, deadlines for notices start running, for example 30 days to the FTC under the Safeguards Rule. Who decides, who reports and which technical facts are needed must be settled before it happens.
Evidence you can show
Being secure is not enough, you have to be able to show it. We document while we implement, so at the end you have records you can hand to an auditor, inspector or customer.
How to find out what applies to you
- 01
Security Readiness Check
Start with our Security Readiness Check. It gives you a first view of where your IT stands and which frameworks are likely relevant for you.
- 02
Intro call
In 20 minutes by Teams or phone we discuss your situation, your customers' requirements and any deadlines you are facing.
- 03
Gap analysis
In the security assessment, starting at $7,900, we compare your IT with the requirements that apply to you. You get a written report with measures ranked by risk and effort, and the fee is credited toward a follow-up project.
- 04
Implementation and evidence
We implement the measures while your business keeps running and hand over documentation that belongs to you.
Our role and the role of your counsel and auditors
We handle the technical implementation and the evidence. Whether a rule legally applies to you is decided by your legal counsel, SOC 2 opinions are issued by independent CPA firms, and notices to regulators come from your company. We work with attorneys, auditors and validation partners and give them the technical information they need.
From our projects
Industrial supplier, international · 2,000 users
Introduction of an identity and access management solution at an international, family-owned industrial supplier in Germany. The project included reorganizing file shares and a password reset that users can do themselves.
Result: The help desk has more time: users reset their own passwords, and password tickets dropped from almost 300 to 10 per week.
Updated:
FAQ
Frequently asked questions
Which rule applies to my company?
That depends on your industry, the data you handle and your customers. Medical practices and their IT providers fall under HIPAA, tax preparers and many non-bank lenders under the FTC Safeguards Rule, Department of Defense suppliers under CMMC and FDA-regulated manufacturers under 21 CFR Part 11 for electronic records. SOC 2 and the NIST Cybersecurity Framework are not laws, but customers often ask for them. Your legal counsel confirms what applies.
Can one company fall under several rules?
Yes, that is common. A medical device maker that supplies the Department of Defense can face Part 11, the QMSR and CMMC at the same time. Because the technical requirements overlap a lot, we plan measures so that one piece of evidence serves several frameworks.
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by an independent CPA firm under standards of the AICPA. A Type 1 report covers the design of controls at one point in time, and a Type 2 report also covers whether they worked over a period, often several months. We help you prepare controls and evidence, and the CPA firm issues the report.
Can an IT provider be HIPAA certified?
No. HHS does not endorse or recognize private HIPAA certifications. What matters is a signed Business Associate Agreement and safeguards that fit your risk analysis. We sign a Business Associate Agreement with every HIPAA client.
Where does CMMC stand in 2026?
Since November 10, 2025, new Department of Defense contracts can require CMMC Level 1 or Level 2 self-assessments. On July 13, 2026, DoD suspended Phase 2, which would have required third-party Level 2 assessments from November 10, 2026, and started a review of the program. Self-assessments and the NIST SP 800-171 requirements in existing contracts still apply. Check the current status before you plan.
We are not regulated. Do we still need to do anything?
Often yes, because regulated customers pass their requirements on to suppliers and service providers. Security questionnaires, SOC 2 requests and contract clauses are the most common way these rules reach smaller companies. The NIST Cybersecurity Framework is a good basis for answering them.
Do you provide the legal assessment?
No, your legal counsel makes the binding assessment. We explain the technical requirements, implement them and deliver the documentation that attorneys and auditors need.
Where should we start?
With a gap analysis that shows where your IT stands today. It is part of our security assessment, starting at $7,900, and the fee is credited toward a follow-up project.
Compliance
Let's clarify what applies to you
Tell us about your situation in 20 minutes. Afterwards you will know which rules to keep in mind and what they mean for your IT.