Resources
The rules, explained like you're busy
Plain-English answers to the compliance and security questions Tri-Valley business owners actually ask — written to be useful whether or not you ever call us. Also see the complete FAQ.
How does a NIST 800-171 self-assessment work?
A NIST 800-171 self-assessment scores how your company protects controlled unclassified information (CUI) against 110 security requirements, using DoD's scoring methodology, and posts the result to SPRS — the database primes and contracting officers check before awarding defense work.
Read the guide →
What do cyber insurance applications actually ask?
Cyber insurance applications ask roughly 30 questions about specific security controls — multi-factor authentication, endpoint detection, backups, staff training, and incident response. Answering inaccurately can void your coverage exactly when you need it, and carriers increasingly verify before paying claims.
Read the guide →
What is a HIPAA security risk assessment?
A HIPAA security risk assessment (SRA) is the documented analysis — required by the HIPAA Security Rule — of where your practice's electronic patient data lives, what threatens it, and how well your current safeguards hold up. It's the first document an auditor or investigator requests.
Read the guide →
What is the SEC cybersecurity rule?
There isn't one 'SEC cybersecurity rule' — it's a wave: the amended Regulation S-P (incident response programs and 30-day customer breach notification, now in force for all firms), long-standing books-and-records rules like 17a-4, and a proposed cyber risk-management rule for advisers. Examiners already test against all of it.
Read the guide →
What is IRS Publication 4557?
IRS Publication 4557, 'Safeguarding Taxpayer Data,' is the IRS's security guide for tax professionals. It explains your legal duty under the FTC Safeguards Rule to maintain a written information security plan (WISP) and the specific protections expected of every preparer.
Read the guide →
What is MDR (managed detection and response)?
Managed detection and response (MDR) is a service where security analysts monitor your computers, accounts, and email around the clock and act immediately when an attack is detected — containing it in minutes rather than writing a report you read the next morning.
Read the guide →
Reading is free. So is the gap analysis.
Skip the research phase — we'll check your actual environment against the rules that apply to you.
Book a Free Gap Analysis30-minute findings presentation. No obligation.