Will this make us HIPAA or PCI certified?

There is no HIPAA certification, and PCI DSS and SOC 2 are attested by qualified independent assessors. ALCO gets you ready and keeps the evidence; the assessor or auditor makes the formal decision. We will never tell you otherwise.

We are small. Do we really need this?

Small businesses are the usual target because the controls are usually missing. The core set, MFA, backups, patched devices, trained people and a password manager, is affordable and most of this page is about doing those well.

Do you do the phishing simulations yourselves?

Yes, as part of the service. The emails look like the real thing, the lesson for anyone who clicks is short and kind, and you see the trend each quarter.

What if something happens at 2 AM?

Call us; phones are answered around the clock. The incident plan we wrote together says who isolates what, who is told, and in what order.

Can you just do the assessment?

Yes. A standalone assessment with a prioritised report is a common first step. You can fix the findings with us, with your own people or with someone else.

Security and compliance

Security you can show, not just say.

An assessment against a named framework, the fixes in order of risk, MFA everywhere, phishing training that sticks, and the evidence organised before an insurer, a customer or an auditor asks. Readiness for HIPAA, PCI DSS, SOC 2 and CMMC, without pretending to be the auditor.

Book a call Ask a question

MFA on every account
Admin accounts separated
Disk encryption everywhere
Phishing training this quarter
Backups tested
Incident plan reviewed
Old VPN account removed

Security · Your CompanyReviewed

Multi-factor sign-inRequired for every user
Passwords1Password, shared vaults, audit trail
Phishing simulation3 of 42 clicked, retrained
Open findings2 low, both scheduled
Insurance questionnaireAnswered with evidence
Policies9 approved, 1 in review
Incident contact treeTested in March

What ALCO reviews with every security client. Example board.

What is included.

Assessment against a framework

Review your systems against a named framework and prioritize findings by risk.
MFA everywhere

Enable multi-factor authentication on supported email, remote access, administrator and business accounts.
Hardening

Apply documented baselines to endpoints, servers, identity and cloud systems, with exceptions recorded.
Passwords done properly

Manage company passwords in 1Password, with shared vaults, an audit trail and offboarding.
Phishing training that sticks

Provide short security awareness training and realistic phishing simulations, with follow-up lessons.
Written policies

Write practical policies for access, acceptable use, backups, vendors, remote work and incident response.
Incident response, in advance

Define incident contacts, isolation responsibilities and customer and insurer communications before an incident.
Questionnaires and insurance

Prepare cyber insurance applications and customer security questionnaires using documented evidence and remediation plans.
Readiness for HIPAA, PCI DSS, SOC 2, CMMC

Prepare control mappings, remediation and evidence for independent HIPAA, PCI DSS, SOC 2 or CMMC assessments.

How it works.

Scope and assess

Agree the systems, data and framework, then review configuration and evidence.
Fix by risk

Prioritize identity and exposed access, recording each agreed fix in myALCO.
Train and document

Approve policies, train staff, run phishing simulations and rehearse the incident plan.
Review and keep evidence

Review findings, emerging risks and policies quarterly, keeping supporting evidence organized.

Start with the assessment.

Tell us what you run, who you answer to, HIPAA, PCI, an insurer, a customer, and we reply with a short plan and a written estimate.

1Password is a trademark of AgileBits Inc. Product names and logos identify the products ALCO deploys; no endorsement is implied.

Security you can show, not just say.

What is included.

Assessment against a framework

MFA everywhere

Hardening

Passwords done properly

Phishing training that sticks

Written policies

Incident response, in advance

Questionnaires and insurance

Readiness for HIPAA, PCI DSS, SOC 2, CMMC

How it works.

Scope and assess

Fix by risk

Train and document

Review and keep evidence

Start with the assessment.