Compliance Readiness Starter Guide: HIPAA, SOC 2 and CMMC

Compliance frameworks can look overwhelming, but they share a simple core: protect sensitive data, control who can reach it, and be able to prove it. This guide covers the three we are asked about most.

HIPAA

Who it applies to: healthcare providers, health plans and their business associates, meaning vendors that handle patient information on their behalf.

What it asks for, in plain language:

A risk analysis of where patient data lives and what could go wrong
Safeguards based on that analysis, such as access controls, encryption, backups and training
Business associate agreements with vendors that touch patient data
Written policies and records that show it's being done

Where to start: an up-to-date risk analysis. Everything else depends on it.

SOC 2

Who it applies to: companies, often software and service providers, whose customers want independent proof that their data is handled securely. It's usually driven by customers, not law.

What it asks for: controls in areas such as security, availability and confidentiality, reviewed by an independent auditor. A Type I report looks at whether controls are designed well at a point in time. A Type II report tests whether they actually worked over a period, often several months to a year.

Where to start: find out which report your customers expect, then get the core controls running consistently before the audit period begins.

CMMC

Who it applies to: companies in the U.S. defense supply chain that handle federal contract information or controlled unclassified information (CUI).

What it asks for: a set of security practices based on federal standards, at a level that depends on the information you handle. Lower levels can be self-assessed. Handling CUI generally means meeting the NIST SP 800-171 requirements, and many contracts require an assessment by an authorized third party.

Where to start: confirm which level your contracts require and map where covered information lives. Limiting where it goes makes everything after that easier.

What all three have in common

Most of the work behind these frameworks is the same everyday security:

Multi-factor sign-in and limited admin access
Managed, protected devices
Email security and staff training
Tested backups
Monitoring and a plan for responding to incidents
Evidence that all of this is happening

That's why many companies get there faster by running the controls first and building the formal program on top.

How Elevaire helps

Elevaire Managed Security runs the day-to-day controls and produces much of the evidence along the way.
A virtual CISO leads the program, owns the policies and works with your auditors.
Our compliance readiness work scopes the formal program, such as a HIPAA risk analysis, SOC 2 preparation or a CMMC assessment, as a defined project.

This guide is general information, not legal advice. Confirm your specific obligations with your counsel, auditor or contracting officer.