Compliance and Risk Management Services That Keep You Audit-Ready

IT compliance services help organizations address the security, governance, and documentation requirements of applicable regulations, contracts, and industry standards. CompassMSP provides scoping, gap assessments, prioritized remediation, control implementation, policy development, evidence collection, and assessment support. Services include CMMC readiness, HIPAA and HITRUST support, and alignment with frameworks such as the NIST Cybersecurity Framework. Engagements can also address NIST SP 800-171, SOC 2, PCI DSS, GDPR, FINRA, and NYDFS Part 500 requirements.

 Compliance means meeting applicable requirements and maintaining evidence that demonstrates how those requirements are addressed. Security is the ongoing work of protecting systems, detecting threats, responding to incidents, and recovering operations. An audit evaluates a defined scope and does not guarantee protection against future attacks. Compass connects compliance support with cybersecurity operations, helping produce evidence through the controls and systems that protect your environment. 

On July 13, 2026, the Department announced the suspension of the November 10, 2026 CMMC Phase 2 transition. The official announcement confirms that Phase 1 self-assessment requirements remain in place.

Applicable contract obligations still matter. DFARS 252.204-7012 establishes safeguarding and incident-reporting requirements, while applicable CMMC clauses address assessment status, reporting, and affirmations. Compass’s CMMC readiness services help align your controls and documentation with the requirements relevant to your contracts.

 Do not assume the announcement automatically changes an existing award. Review the clauses, modifications, and written direction applicable to each contract. Where incorporated, DFARS 252.204-7021 requires contractors to maintain the specified CMMC status and associated affirmations. Compass can help organize the technical scope and supporting evidence through a CMMC readiness engagement. 

 Yes. The Cyber AB’s statement on the Phase 2 suspension confirms that C3PAO Level 2 certification assessments and other assessment, training, and practitioner services remain operational. Certification may support customer requirements and demonstrate independently assessed control implementation. Compass helps prepare your environment and evidence through CMMC readiness support; an authorized C3PAO performs the certification assessment. 

 No. Continue addressing the security requirements that apply to your contracts and the information you handle. The pause does not remove applicable DFARS safeguarding obligations or Phase 1 self-assessment requirements. Prioritize accurate documentation, implemented controls, and evidence that supports your submissions. Compass’s CMMC readiness services help identify which work remains necessary and how to sequence it. 

 The Cyber AB’s July 2026 announcement describes a 60-day program review, but that does not establish a guaranteed publication date or replacement implementation schedule. Review recommendations should not be treated as changes to your contract. Compass helps organizations assess published developments against their existing obligations, while The Fine Print provides ongoing coverage of compliance and cybersecurity changes. 

HHS continues to identify the Security Rule changes as a proposal and states that the current HIPAA Security Rule remains in effect during rulemaking. Proposed safeguards should not be presented as finalized requirements or assigned a firm compliance deadline.

The existing rule already requires risk analysis and appropriate administrative, physical, and technical safeguards. Compass’s HIPAA and HITRUST services help evaluate current obligations and prioritize security improvements while preparing for potential changes.

 Timelines depend on the framework, assessment scope, existing controls, and the evidence already available. An initial assessment may take several weeks, while remediation and evidence collection can take months or longer. Technical changes, policy approvals, and external assessment scheduling also affect the timeline. Compass establishes milestones through its readiness assessment process, with responsibilities and dependencies defined before committing to a completion date. 

 A gap assessment compares your current controls and evidence with applicable requirements. It identifies missing or incomplete controls, documents findings, and establishes remediation priorities, owners, and estimated effort. For CMMC engagements, scoping includes identifying where federal contract information or controlled unclassified information is stored, processed, or transmitted. The result is a practical work plan that connects requirements to implementation and evidence. 

 Yes. Compass helps translate findings into a prioritized remediation plan, address control gaps, improve documentation, and prepare evidence for reassessment. When Compass also manages your IT environment, its operating teams can implement agreed technical changes. In co-managed environments, Compass coordinates with your internal team so responsibilities, completion criteria, and supporting records remain clear. 

 Not every organization needs a vCISO, but compliance work benefits from clear security leadership and accountability. Compass vCISO advisory provides separately scoped support for governance, risk prioritization, security strategy, and board reporting. A vCISO helps leadership evaluate remediation priorities and risk acceptance decisions; your organization retains responsibility for approving those decisions and meeting its obligations. 

 Evidence comes from the services and controls operating within your agreed scope. Cybersecurity services provide monitoring and incident records, while Managed IT can provide patching records, backup checks, and configuration documentation. Complete Security adds deeper investigative findings and forensic records. Compass organizes relevant evidence around assessment requirements, as outlined in our guide to security and compliance deliverables. 

 Compass provides readiness, implementation, documentation, and assessment support. Formal assessment responsibilities depend on the program: authorized C3PAOs conduct CMMC Level 2 certification assessments, independent CPA firms perform SOC 2 examinations, and HITRUST certification involves an authorized external assessor and HITRUST’s review process. These programs have specific independence and qualification requirements. Compass’s HIPAA and HITRUST support helps prepare your organization for the applicable assessment process. 

CompassMSP’s security operations center is 100% U.S.-based, including detection, triage, investigation, and containment. Compass’s managed IT service desk and engineering teams operate a blended U.S. and Philippine follow-the-sun model.

SOC location alone does not establish personnel citizenship, data residency, or export-control compliance. Where those requirements apply, they must be addressed explicitly in service scope, access permissions, and contractual terms. Compass’s security advisors help connect those requirements to your security program.

 Compass supports third-party risk management through vendor inventories, risk classification, security questionnaire reviews, contractual security requirements, and ongoing oversight. The depth of review depends on each vendor’s access, the information it handles, and its importance to your operations. AICPA guidance on SOC engagements highlights the importance of vendor management controls. Compass vCISO advisory helps leadership evaluate vendor risks and prioritize follow-up actions.