Cyber Security Compliance Services
Compliance services help you work out which rules apply, put controls in place, and organize the evidence. They can't replace an independent audit where one is required, and they aren't legal advice.
On this page
Framework, obligation, control, evidence, audit
| Term | Meaning | Example |
|---|---|---|
| Framework | An organized set of outcomes or practices | NIST CSF 2.0 |
| Obligation | Something you must do under a law or contract | FTC Safeguards Rule, for covered financial institutions |
| Control | A specific safeguard you operate | Multifactor authentication on remote access |
| Evidence | A record that the control works | Dated report of accounts with MFA enabled |
| Audit or assessment | An independent or formal check against criteria | SOC 2 examination or PCI DSS assessment |
An illustrative evidence table
| Requirement | Control owner | Evidence | Review date |
|---|---|---|---|
| Limit access to customer data | IT manager | Quarterly access review, signed | Mar. 31 |
| Protect remote access with MFA | IT manager | Export of MFA enrollment | Jan. 15 |
| Train staff at least annually | HR lead | Attendance and completion records | Sept. 30 |
| Test incident response plan | Operations director | Tabletop notes and action items | June 30 |
| Oversee service providers | Finance lead | Contracts and security reviews | Dec. 1 |
Cyber security services framework: which one applies?
A framework helps you organize the work. It isn't automatically a legal requirement. Check the current publisher before relying on a version. These were checked on November 6, 2026.
| Name | Status we verified | Applies to |
|---|---|---|
| NIST CSF 2.0 | Published February 26, 2024 | Usable by any organization; voluntary unless required elsewhere |
| CISA Cross-Sector CPGs 2.0 | Updated to align with CSF 2.0 | Voluntary baseline goals, especially useful for critical infrastructure |
| NIST SP 800-171 Rev. 3 | Published May 2024 | Protecting controlled unclassified information; check which revision your contract cites |
| PCI DSS v4.0.1 | Limited revision; PCI SSC says no requirements were added or deleted | Organizations handling payment card data, usually through contracts |
| HIPAA Security Rule | Current HHS guidance | Covered entities and business associates handling electronic health information |
| CMMC | The Defense Department's CMMC page says Phase II was suspended on July 13, 2026 pending review, while Phase I self-assessment requirements remain | Defense contractors; check this page, because the program is changing |
Financial firms have their own layer of rules. See our guide to cyber security in financial services. Our earlier reporting on navigating cybersecurity regulations and governance, risk, and compliance adds background.
What a consultant can prepare, and what needs independence
| A consultant can help | Requires an independent or qualified party |
|---|---|
| Map which rules may apply, with your attorney confirming | Legal conclusions about your obligations (your attorney) |
| Run a gap analysis and readiness review | A SOC 2 report, issued through a CPA's examination under AICPA standards |
| Write policies and organize evidence | PCI assessments where required, by assessors such as PCI-qualified QSA companies |
| Prepare staff for auditor interviews | The auditor's opinion, which a preparer shouldn't also issue |
Technical testing often feeds compliance work, so read how assessments and retests produce evidence. For recent regulatory developments, see our reporting on the real cost of incidents.
This guide is general information, not legal advice.
Need a test as evidence? See how findings, fixes, and retests create a record an auditor can follow.
See how assessments produce evidence