The IT side
of Compliance.

We work inside six regimes on the IT-control side: HIPAA for healthcare practices and business associates, SOC 2 for service organizations and SaaS providers, PCI DSS for anyone handling cardholder data on systems we manage, New York Department of Financial Services (NY DFS) Part 500 for financial services regulated in New York, the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule for financial institutions and tax preparers, and the New York SHIELD Act plus neighboring state privacy laws. Those six cover almost every business in our region that has been asked for a compliance attestation.

It means the evidence already exists, is indexed, and is current on the day the auditor asks for it, instead of being assembled in a scramble the week before. In practice that is IT policies authored and version-controlled with scheduled reviews, quarterly access reviews with documented sign-off and remediation, and continuous evidence collection covering tickets, change records, and training logs. We also maintain a read-only auditor portal so audit week is not a fire drill.

No. We are not an audit firm or a law firm, and we do not certify compliance or give legal advice. We run the IT-control side of the program: technical controls, documentation, evidence, and access reviews. During the audit itself we sit in the room with your auditor, answer the IT questions, and produce technical evidence on demand.

Part 500, formally 23 NYCRR 500, is mostly IT controls: documented cybersecurity policies, periodic risk assessments, access controls with regular reviews, security awareness training, and incident response capability with records to prove all of it. For a small regulated firm, that maps directly to the program we run: framework-aligned IT policies reviewed annually, an annual or event-driven IT risk assessment with owners and target dates, quarterly user and admin access reviews, and tracked training. The firm keeps the business-side obligations, and we keep the technical evidence current.

We sit in the room with your auditor, answer the IT questions directly, and produce technical evidence on demand. Your auditor also gets read-only access to a structured evidence library with access reviews, policies and procedures, risk assessments, incident response records, training records, and vendor management documentation. Because the program runs continuously year-round, audit day is a walkthrough, not a fire drill.