Compliance isn't a binder on a shelf. It's proving, at any moment, that the controls you promised are actually in place.
Governance, risk and compliance (GRC) is how a business decides which security risks matter, puts the right controls and policies in place, and proves it to the people who ask: auditors, regulators, customers and cyber insurers. At HUFF DATA SYSTEMS it's part of managed IT, not a separate consulting project.
What GRC means for a growing business
- Governance: written security policies, clear ownership and decisions made at the leadership level.
- Risk: regular risk assessments that show where you are exposed and what to fix first.
- Compliance: meeting the rules that apply to your business, and keeping the evidence that you do.
What's included for managed clients
- Cybersecurity risk assessments with prioritized findings
- Written security policies, such as acceptable use, access and passwords
- Vendor risk reviews for the partners that handle your data
- Compliance evidence for auditors, regulators and cyber insurers
- A written incident response plan for every client
- A review of your cyber insurance application against the controls actually in place
- Quarterly reviews in plain language with direct access to our CTO
Rules and frameworks we work with
- HIPAA for healthcare practices and their business associates. See managed IT for healthcare.
- The FTC Safeguards Rule for non-bank financial businesses such as tax preparers, mortgage brokers and many auto dealers. See what the Safeguards Rule requires.
- The CIS Critical Security Controls, a prioritized set of safeguards. See our CIS Controls guide.
- The NIST Cybersecurity Framework for organizing and measuring a security program.
- Texas law, including breach notification deadlines and the SB 2610 safe harbor for businesses that follow a recognized framework. See our Texas cybersecurity compliance guide.
Compliance is a shared program
No IT provider can make a business compliant by itself. We supply the technology, assessments, policies and evidence; your business supplies the decisions, people and follow-through, from naming who is responsible to making sure employees complete training. Our CTO-led approach means we explain what is needed in plain language, then take care of it.
Cyber insurance readiness
Cyber insurers rely on your application answers, and a gap between those answers and your real controls can put a claim at risk. We review every client's application against the controls in place, and clients can apply for a policy through our partner's dual claims coverage program. Learn more about cyber liability insurance for our clients.
Common questions
Can you make us HIPAA compliant?
No provider can make a business compliant on its own. Rules such as HIPAA and the FTC Safeguards Rule place duties on the business itself. We provide the technology, assessments, policies and evidence, and guide your team through the decisions only you can make.
Do you provide evidence for auditors and insurers?
Yes. Compliance evidence for auditors, regulators and cyber insurers is part of our governance, risk and compliance work for managed clients.
Which frameworks do you work with?
HIPAA, the FTC Safeguards Rule, the CIS Critical Security Controls and the NIST Cybersecurity Framework.
Do you review cyber insurance applications?
Yes, for every client. We compare your application answers with the controls actually in place, so your answers hold up if you ever file a claim.