System compliance
Controls and evidence for the frameworks you answer to
IT compliance support means putting in place the technical controls that frameworks such as HIPAA, PCI DSS, NIST CSF 2.0 and CMMC require, and keeping evidence they work. Storcom helps through backup, disaster recovery and security services that map to those controls, plus test reports and documentation for your auditors.
Last updated
Which frameworks does Storcom help with?
Each framework asks for backup, recovery and security controls in its own words. Here is where our services fit.
| Framework | Who it applies to | Where Storcom helps |
|---|---|---|
| NIST CSF 2.0 | Any organization that wants a common risk framework | Identify, Protect, Detect, Respond and Recover outcomes through EDR, scanning, firewall, backup and tested recovery |
| HIPAA Security Rule | Covered entities and business associates that handle electronic protected health information | Contingency plan controls: data backup, disaster recovery, testing, plus endpoint protection and vulnerability management |
| PCI DSS | Organizations that store, process or transmit payment card data | Firewall management, anti-malware on endpoints and internal vulnerability scanning (an Approved Scanning Vendor is still required for external scans) |
| NIST SP 800-171 and CMMC | Defense contractors and suppliers handling controlled unclassified information | Backup protection, malicious code protection, vulnerability scanning and incident response capability |
| CIS Controls | Organizations that want a prioritized list of safeguards | Continuous vulnerability management, malware defenses, data recovery and incident response management |
| SOC 2 readiness | Service organizations whose customers ask for a SOC 2 report | Evidence for security and availability criteria: backups, DR tests, endpoint protection and scan results |
| CJIS Security Policy | Agencies and vendors that access criminal justice information | Backup and recovery, malicious code protection and vulnerability management, scoped with your CJIS Systems Agency |
Frameworks change. Confirm current requirements with your auditor or assessor.
How does Storcom help you stay compliant?
Endpoint and network security
Managed EDR on CrowdStrike Falcon and managed firewalls with monitoring and reporting.
Backup and retention
Immutable off-site copies with retention set to your policy, and restore validation that proves they work.
Tested disaster recovery
Documented runbooks and failover tests against a stated RTO and RPO, with written test reports.
Vulnerability management
Continuous risk scanning through CrowdStrike Falcon, with prioritized findings, so remediation is tracked rather than remembered.
Evidence for auditors
Restore and failover test results, scan reports, coverage reports and configuration documentation you can hand to an assessor.
What this page does not claim
This page describes how Storcom helps your organization meet its obligations. It is not a statement about certifications or attestations held by Storcom, and working with Storcom does not by itself make you compliant.
Your organization owns its policies, risk assessment and attestations. Formal assessments, such as a CMMC certification assessment or a SOC 2 examination, are performed by an accredited third party or a licensed CPA firm. Storcom supplies the technical controls and the evidence those assessments look for.
Getting audit-ready with Storcom
Scope
Identify the frameworks that apply and the systems and data in scope.
Gap review
Start with a discovery call, then compare current backup, recovery and security controls to the framework.
Implement
Put the missing controls in place, as products you own, services Storcom manages, or both.
Test and document
Run restore and failover tests, collect scan and coverage reports, and keep the evidence current for the next audit.
Frequently asked questions
Does working with Storcom make us compliant?
No single vendor can make an organization compliant. Compliance depends on your policies, risk assessment and controls across the business, judged by your auditor or assessor. Storcom supplies technical controls for backup, disaster recovery and security, plus the evidence that they work.
Does HIPAA require a disaster recovery plan?
Yes. The HIPAA Security Rule contingency plan standard requires a data backup plan, a disaster recovery plan and an emergency mode operation plan for electronic protected health information, with testing and an applications and data criticality analysis as addressable specifications. Storcom helps healthcare organizations build, test and document these plans.
What evidence can Storcom provide for an audit?
Typical evidence includes backup and restore validation reports, disaster recovery test results and runbooks, endpoint protection coverage reports and vulnerability scan reports. Storcom produces these as part of its managed backup, recovery and security services, so they are ready when an auditor asks.
Which compliance frameworks does Storcom work with?
Storcom helps organizations meet the backup, recovery and security controls in HIPAA, PCI DSS, NIST CSF 2.0, NIST SP 800-171 and CMMC, the CIS Controls, SOC 2 readiness and the CJIS Security Policy. The work is scoped to the framework and systems that apply to you.
Start with a discovery call.
Tell us what you run today, what is changing and what worries you. We listen, ask questions and tell you plainly whether and how we can help. No cost, no commitment.