Compliance
Backup and security that stands up to an audit
Backup and cybersecurity built on SOC 2 Type II audited platforms and configured to meet HIPAA and PCI DSS requirements — encryption at rest and in transit, enforced access control, retention and destruction rules, and audit logging you can actually produce when somebody asks for it.
If you have a client security questionnaire you cannot currently answer, bring it to us — that is usually the fastest way to find the real gaps.
Straight Answers
What these three actually mean
A great deal of compliance marketing is deliberately vague, so here is the plain version. SOC 2 is an independent audit of an organization’s controls, resulting in a report. A product cannot be "SOC 2 certified" in the abstract — a company is audited, and that company’s report is what you rely on.
HIPAA has no certification at all. Nobody can be "HIPAA certified", and any vendor claiming to be should worry you. What actually matters is whether your systems meet the Security Rule and whether the people touching protected health information have signed a Business Associate Agreement.
PCI DSS applies to the environment where cardholder data is stored, processed or transmitted. It is about scoping and segmenting that environment, not about a badge on a website.
Where we stand
The backup and cybersecurity platforms we deploy hold independent SOC 2 Type II reports. We configure them to meet HIPAA Security Rule requirements and sign Business Associate Agreements. Cardholder environments are scoped and segmented to PCI DSS.
The Three Standards
How each one applies to your systems
SOC 2 Type II
The platforms underneath your backups and endpoint protection are independently audited against security, availability and confidentiality criteria — and Type II means those controls were tested over a period, not just documented on one day.
HIPAA Security Rule
Encryption at rest and in transit, unique user identification, automatic logoff, audit controls and integrity checks. We sign a Business Associate Agreement before touching anything containing protected health information.
PCI DSS
The cardholder environment is segmented off the general network, access is restricted and logged, and we keep the scope as small as possible — because the cheapest environment to secure is a small one.
Working in a regulated profession? See IT and compliance for law firms.
The Controls
What we actually implement
Encryption at rest and in transit
On every backup, every endpoint and every transfer that leaves your building.
Enforced access control
Who can reach what, applied technically rather than by policy document, with multi-factor authentication as standard.
Retention and destruction
Rules that execute. Data that should be gone is gone on schedule, with a record that it happened.
Audit logging
Access and change history you can produce on request, rather than reconstruct from memory.
Tested restores
Backups restored on a schedule. Until a restore has been proven, you have copies, not backups.
Written documentation
The answers to client and insurer security questionnaires, kept current so they are ready before somebody asks.
Our Approach
How we handle a compliance requirement
01
Establish the obligation
What you actually have to satisfy, and who says so — a regulator, a client contract, or an insurer.
02
Assess what exists
Where the current setup already meets it, and where it does not. Usually there is more of the former than firms expect.
03
Close the gaps
Encryption, access control, retention, logging and backup testing configured to the standard rather than to a default.
04
Document it
So the next questionnaire is a matter of sending a document rather than starting a project.
Questions
Direct questions, direct answers
Is Chas Enterprise Group itself SOC 2 certified?
No, and we will not imply otherwise. The backup and security platforms we deploy hold independent SOC 2 Type II reports; Chas Enterprise Group is not itself an audited service organization. If your procurement process requires a provider that holds its own SOC 2 report, tell us early and we will say so plainly rather than waste your time.
Are you HIPAA certified?
Nobody is. There is no HIPAA certification body and no such credential exists. What we do is configure systems to the HIPAA Security Rule and sign a Business Associate Agreement, which is what the regulation actually requires of a vendor in our position.
Will you sign a Business Associate Agreement?
Yes, before we touch anything containing protected health information.
Does using your services make our business compliant?
No single vendor can make you compliant, and be suspicious of any that claims to. Compliance covers your policies, your training and your practices as well as your technology. We handle the technology side and document it so the rest of your program has something solid to point at.
Can you help us answer a client security questionnaire?
Yes, and it is one of the most useful things we do. Bring us the questionnaire — it tells us exactly what your client cares about and where the real gaps are.
What if we handle card payments?
Then the first job is scoping: working out precisely where cardholder data goes and shrinking that footprint. Most small businesses can reduce their PCI DSS scope dramatically, which reduces both cost and risk.
Backup & Security Compliance
SOC 2 Type II platforms
The backup and security platforms we deploy are independently SOC 2 Type II audited.
HIPAA controls, BAAs signed
Configured to the HIPAA Security Rule, and we sign Business Associate Agreements.
PCI DSS aligned
Cardholder environments segmented, encrypted and logged to PCI DSS requirements.
Whenever You Are Ready
Bring us the requirement
A regulation, a client questionnaire or an insurer’s checklist — we will tell you where you stand and what it takes to close the gap.
Chas Enterprise Group · Grafton, Ohio 44044 · (440) 364-3596 · charley.george@chasenterprisegroup.com