The Operating Review › Regulated environments
A review of the whole operation reaches the parts of it that are regulated. Payroll, contracts, the general ledger, customer records and in some sectors patient or student records all sit inside somebody’s regime, and the review does not get an exemption from it. These are the frameworks the work is delivered under — described as capability and commitment, not as certification.
Where protected health information is in scope, a business associate agreement is signed before any data moves, and the engagement runs to the HIPAA Security Rule and the minimum-necessary standard. In practice we ask for de-identified or aggregated extracts first and identifiable data only where a finding genuinely depends on it. GxP and 21 CFR Part 11 where electronic records and signatures are in scope.
CUI is handled to NIST SP 800-171, with the system security plan and POA&M that go with it, and NIST SP 800-53 where a federal system is involved. Media sanitization on disposal follows NIST SP 800-88. Where a contract carries CMMC obligations or flow-down clauses, those govern what we may hold and where — and we will say so before accepting the work rather than after.
EAR and ITAR where they apply, including the part that catches research organizations: giving a foreign national access to controlled technology is an export, and a document request is a form of access. Restricted party and OFAC screening, technology control plans, and an honest reading of where the fundamental research exclusion applies rather than where it would be convenient.
GDPR and UK GDPR where a collaboration or a customer base crosses into scope, with a data processing agreement rather than an assurance. FERPA for education records. PCI DSS is handled by keeping cardholder data out of scope by default — we ask for settlement and reconciliation data, not card numbers. Where your own regime is something else, it governs, and we work to it.
What we may hold, where it may be stored, who may see it, how long it is kept and how it is destroyed are agreed in writing before the first document moves — your NDA where you want one, and a BAA or DPA where one is required. Named individuals, not “the team”. No subprocessing without your agreement. The commercial half of the same question is in the ordering terms.
Documents go to private storage with no public address; access is by an unguessable per-engagement link, never a shared password; every open, view, upload and download is written to an append-only log, so “who saw our payroll file” has a list for an answer; and a retention date is set at the start and enforced by the storage itself rather than by anyone remembering. That is the client portal.
Said plainly, because the distinction matters. Everything above is a statement of how we work and what we will commit to, not a certification. There is no such thing as being “HIPAA certified”, and a firm that says otherwise has told you something useful about the rest of its claims. Where you need evidence rather than assurance — a completed security questionnaire, a signed BAA, a named data controller, your own paper instead of ours — ask, and it happens before the engagement starts rather than during it.
A completed security questionnaire, a signed BAA, a named data controller, your own paper instead of ours — all of it happens before the engagement starts.