This usually starts with a customer or prospect asking, “Are you SOC 2 compliant?”, “Are you HIPAA compliant?” or “Do you meet CMMC?” Those questions are not interchangeable. Ask for the exact written requirement, contract language or questionnaire behind the request before choosing work or promising an outcome.
Understand the basic distinction
SOC 2 concerns a CPA examination and report about controls at a service organization. The AICPA describes SOC 2 examinations in relation to security, availability, processing integrity, confidentiality or privacy. Ask the requester which report and scope it needs. See the AICPA’s SOC resources.
HIPAA concerns legal requirements for covered entities and business associates. HHS explains who falls within those categories. Your role and activities matter; the fact that a customer works in healthcare is not a complete analysis of your obligations. Check the HHS explanation of covered entities and business associates with a qualified adviser.
CMMC concerns cybersecurity requirements in defense contracting. Establish what the relevant solicitation or contract currently requires, including scope and assessment expectations. Consult the official CMMC program information rather than relying on an old rollout summary.
These are starting points for clarification. They do not determine what your particular business must do or establish that one report, program or technology service satisfies another requirement.
Get the request into a form you can act on
Ask the customer to provide the document or contract section behind its question. Then clarify:
- Which part of your business, service or environment is involved
- What information you will receive, store or access
- What evidence the customer is requesting
- Who will review that evidence
- What date or contract stage the request relates to
- Which points need a decision from a legal, compliance or assessment specialist
Record the exact requirement and its source. If someone has summarized it informally, ask whether that summary matches the written request before planning from it.
Separate your current position from the work ahead
Bring together what your business already knows about its technology and responsibilities. Identify which answers are supported, which need verification and which point to work that has not been completed.
Keep those categories clear. For example, an existing policy, a proposed change and a record showing completed work are different things to put in front of a reviewer. Ask the requester what evidence is appropriate to the question.
Treat any proposal to reuse existing work as something to check against the particular requirement. Avoid assuming that a single set of documents will establish every requested outcome.
Agree who handles each part
Separate the business decision, interpretation of the requirement, technology work and any independent review. Ask each participant what it is responsible for and what it is qualified to provide.
ProIncident’s primary relationship is Fully Managed IT, with cybersecurity and baseline AI governance included in the standard managed service. Security Questionnaires is the relevant starting point for discussing customer questions about the environment.
If the discussion calls for security leadership, ask about the scope of vCISO Services. Any audit, certification, legal or specialist compliance requirement needs its own confirmed responsibility and scope. Do not infer those services from a general IT agreement.
Frequently asked questions
Can we choose whichever requirement is easiest?
Start with what actually applies to your business and what the customer is requesting. Have the requirement clarified before deciding what work to undertake.
Does having cybersecurity services establish compliance?
Do not use a service label as the answer. Review the particular requirement, the actual environment and the evidence with the appropriate specialist or reviewer.
Can existing security work be useful?
Bring it into the review and ask which parts address the specific request. Any gaps or additional evidence should be identified against that request rather than assumed away.
Will ProIncident provide an audit or certification?
An audit, certification or compliance determination needs the appropriate qualified provider. Confirm who is responsible for that work separately from ongoing technology management.
Start with the customer’s actual question
Start with the exact requirement or questionnaire you received. We can discuss the technical information behind it and where specialist advice is needed.