Pass Your Next Audit.
Prove Your Compliance.

The FTC Safeguards Rule sits under the Gramm-Leach-Bliley Act and applies to "financial institutions" that aren't regulated by another federal agency. Section 314.2(h) of the Rule lists thirteen example categories, and they're broader than the name suggests - tax preparation services, accountants providing certain financial services, mortgage brokers, financial advisors, collection agencies, and "finders" are all named. Covered firms must maintain a written information security program, designate a Qualified Individual to oversee it, and implement specific safeguards.

Whether it reaches your firm depends on what activities you actually perform, not just what industry you're in - a practice doing tax prep is treated differently than one doing audit and attest work only. Determining which side of that line you fall on is part of the free gap assessment.

New York's SHIELD Act requires any business holding private information of NY residents to maintain "reasonable" administrative, technical, and physical safeguards. It applies broadly - law firms, financial advisors, insurance agencies, and most professional service firms are covered.

If the FTC Safeguards Rule or NYDFS cybersecurity regulation applies to your business, yes - a WISP isn't optional. Even under the SHIELD Act's more general "reasonable safeguards" standard, a documented plan is the clearest way to demonstrate compliance if you're ever questioned.

Partially, and it's narrower than most firms expect. Maintaining information on fewer than 5,000 consumers exempts you from four specific provisions: the written risk assessment, the penetration testing and vulnerability assessment schedule, the written incident response plan, and the annual written report to leadership. That's it. You still need a written security program, a designated Qualified Individual, access controls, encryption, MFA, employee training, and service provider oversight.

The other catch: the threshold counts every consumer record you hold, not your active client list this year. Firms that have been in business a decade and retain records for the required period are often well over 5,000 without realizing it. If you're relying on the exemption, that assumption is worth documenting rather than presuming - a presumption of exemption rarely survives scrutiny on its own.

No. We work alongside your existing IT provider or in-house staff. We handle the compliance-specific layer - the risk assessment, the WISP, the safeguards those documents call for, and the monthly evidence reporting - without touching your day-to-day IT relationship.

That's exactly what we prepare you for. Between your WISP, monthly evidence reports, and annual review documentation, you'll have a paper trail ready to hand over - not a scramble to assemble one after the fact.

A consultant typically hands you a report and leaves. We build the plan, implement the technical safeguards behind it, and keep monitoring and documenting on an ongoing basis - so compliance doesn't quietly lapse six months after the assessment.

Yes - remediation (fixing the gaps we find) is available as separate hourly or project work, scoped and quoted upfront before anything begins.

That's part of the free gap assessment. We'll look at what data you handle and who you serve, and tell you plainly which regulations apply and where your actual exposure is.