Compliance, in plain words
Compliance means proving you protect what you hold. An insurer, a regulator or a big customer asks for that proof. We did not invent a grading scale for it. We work from CIS Controls, a public checklist of protections, and we say which items you have in place.
The checklist
CIS Controls is a list written by security people for every size of business. It starts with the basics: know your devices, know your accounts, back up your data, patch your software, protect email, watch for break-ins. The first group of controls is the floor for any business.
Where CORE fits
CORE delivers that floor: domain, email, backups, devices, identity and patches. Hold CORE and the basics are answered. See CORE.
A business that holds regulated data, like a clinic or a law firm, usually needs more than the floor. We scope that with you, item by item, instead of selling a label.
Insurance and questionnaires
Our agreement asks you to hold cyber liability insurance. Insurers send questionnaires, and a vCIO answers them with you, finds the gaps and writes the policies. See Working with a vCIO.