Skip to main content

Decypher Technologies

white Decypher logo

Compliance Readiness Backed by a $3M Security Warranty

A client, insurer, or auditor is going to ask for proof. Get real controls in place — and the evidence to back them up — before that day arrives.

A customer sends a security questionnaire. Your cyber insurer wants proof of controls before renewal. Then an auditor asks for documentation on a framework nobody’s mapped to yet. None of these arrive on your schedule, and they don’t wait for you to get organized first.

Passing the questionnaire and actually being secure aren’t the same thing. We’ve worked with businesses that checked every box and still had a hole an attacker could walk through — and businesses with genuinely strong security who had nothing ready to show for it when asked.

Decypher addresses both issues. We figure out what applies to you, put the right controls in place, and keep the evidence ready so you can hand it over the day it’s requested.

Security Operations Warranty

Every managed security engagement also carries our Security Operations Warranty: up to $3 million, at no added cost. If something does go wrong, you're not alone.

See What Applies to Your Business
Schedule a Cybersecurity Risk Assessment

Start Here: What Actually Applies to You​

You don’t need to guess your way through compliance. What applies to you comes down to four things: your industry, your data, where you operate, and what your customers and contracts require.

Your industry

Some requirements attach directly to the kind of business you run. Process payment cards, and PCI DSS applies. Handle protected health information, and HIPAA applies. Hold customer financial data, and the FTC Safeguards Rule or GLBA may apply. Run security reviews for customers, and SOC 2 usually enters the conversation.

Your data

Scope narrows fast once you look at what you hold: payment card data, protected health information, financial records, employee records, legal and accounting files, government-related or contract-controlled information, proprietary business data. Each carries its own obligations. If you can't say clearly what sensitive data you hold, where it lives, and who can access it, that's usually the first gap to close.

Where you operate

Geography triggers requirements on its own — based on where your customers live, where your staff work, and where your data moves. That can mean state privacy and breach laws in the U.S., financial-sector rules like NYDFS 23 NYCRR 500, or the GDPR if you serve anyone in Europe.

Your customers, insurers, and contracts

For most businesses, compliance pressure shows up here first — before any regulator gets involved. A prospect wants proof of monitoring and incident response. An insurer asks about MFA, testing, and recovery. A larger client wants evidence of access control and governance. Every one of these is a compliance conversation, even when no law is named.

What Compliance Looks Like in Practice

Almost every framework asks for the same handful of things underneath the jargon. Someone has to own the program. You have to understand your risks, put controls against them, and write down what you did. Those controls need testing on a regular cadence, and the results need keeping. Then you review and adjust as the business changes. The details vary from rule to rule, but a program built around that cycle covers most of them together, which is why we build the working program first and map it to each regulation afterward.

The Frameworks Mid-Sized Businesses Meet Most Often

Below are the rule sets our clients run into most, across financial services, healthcare, hospitality, nonprofits, and professional firms. Each entry covers who it applies to, what it protects, what you are expected to do, what evidence to keep, and where Decypher fits.

PCI DSS

keep card payments from becoming a breach
Read More

PCI DSS

keep card payments from becoming a breach

Who it applies to:

Any business that stores, processes, or transmits payment card data, or supports a cardholder data environment.

What it protects:

Cardholder data and the systems that could expose it through weak access controls, poor segmentation, insecure applications, or untested recovery.

What you are expected to do:

The current standard is PCI DSS v4.0.1, and its future-dated requirements have been mandatory since March 31, 2025. That includes multi-factor authentication for all access to the cardholder data environment, stronger password rules, and tighter e-commerce script and page-monitoring controls, on top of the long-standing basics: secure your systems, restrict and monitor access, manage vulnerabilities, and test the environment regularly.

Evidence to keep:

Access-control records, vulnerability and penetration testing results, change and configuration records, monitoring and incident documentation, and training records where relevant.

How Decypher helps:

We run the security operations behind PCI: continuous monitoring and MDR, access hardening and MFA, recurring vulnerability assessments, and penetration testing across your environment. We also keep the evidence organized, so when a card brand or acquirer asks for proof, producing it is a quick task rather than a fire drill.

See Where You Stand on PCI

HIPAA Security Rule

protect patient data and prove you did
Read More

HIPAA Security Rule

protect patient data and prove you did

Who it applies to:

Healthcare providers, health plans, clearinghouses, and the business associates that create, receive, maintain, or transmit electronic protected health information (ePHI).

What it protects:

The confidentiality, integrity, and availability of ePHI.

What you are expected to do:

The Security Rule does not hand you a checklist. It requires reasonable administrative, technical, and physical safeguards, and it expects each organization to determine what is reasonable from its own risk analysis. In practice that means assigning ownership of the security program, analyzing risk to ePHI, controlling access, monitoring and responding to incidents, training your workforce, and planning for the availability of ePHI if systems go down.

Evidence to keep:

Risk assessment records, access-control and MFA documentation, vulnerability and remediation tracking, incident response documentation, and policies, procedures, and training records.

How Decypher helps:

HIPAA leaves the specifics to you, which is where most teams get stuck. We turn its open-ended expectations into security operations that run day to day, beginning with the risk analysis the rule requires and extending through access controls, a testing cadence, incident readiness, and reporting. All of it is documented, so you can show a regulator or a business-associate partner how ePHI is protected.
Map My HIPAA Gaps

FTC Safeguards Rule and GLBA

a testable program for customer financial data
Read More

FTC Safeguards Rule and GLBA

a testable program for customer financial data

Who it applies to:

Businesses that handle covered customer financial information, defined broadly enough to reach many organizations that do not think of themselves as financial institutions, including mortgage brokers, auto dealers, tax preparers, and similar firms.

What it protects:

Customer financial information from unauthorized access, misuse, alteration, or destruction.

What you are expected to do:

The 2021 amendments, in effect since June 2023, turned the Safeguards Rule from general guidance into specific, testable controls built around nine required elements. Those include naming a qualified individual to run the program, a written risk assessment, encryption of customer information in transit and at rest, multi-factor authentication, regular testing, service-provider oversight, a written incident response plan, and an annual report to leadership. A 2024 update added breach notification to the FTC within 30 days for incidents affecting 500 or more consumers.

Evidence to keep:

The written security program, risk assessment, MFA and access-control records, penetration testing and vulnerability assessment results with remediation tracking, service-provider oversight records, and the annual program report.

How Decypher helps:

The rule’s technical demands line up closely with what we deliver: 24/7 monitoring and MDR, MFA and encryption, annual penetration testing, and semiannual vulnerability assessments. Our incident response readiness gives you a fighting chance at the 30-day notification clock, and we back the qualified individual with the reporting and evidence the role has to produce. Where your obligations run through a banking regulator or the SEC instead of the FTC, we scope the program to whichever one governs you.
Check My Safeguards Readiness

SOC 2

the report your customers ask to see
Read More

SOC 2

the report your customers ask to see

Who it applies to:

Service organizations that store, process, or otherwise handle customer data, and increasingly any vendor whose clients run security due diligence before signing.

What it protects:

Customer data, evaluated against the Trust Services Criteria: security, and where relevant availability, processing integrity, confidentiality, and privacy.

What you are expected to do:

SOC 2 has no fixed checklist. A SOC 2 Type II report attests that the controls you use to safeguard customer data are well designed and that they operated effectively across a review period. Auditors want to see controls that ran consistently for months, backed by evidence, not a point-in-time snapshot.

Evidence to keep:

Access and change records, monitoring and alerting output, vulnerability and remediation tracking, incident records, and policy and control documentation covering the audit period.

How Decypher helps:

For most teams the audit week is the easy part. The challenge is running controls consistently for the whole period and capturing evidence the entire time. Our monitoring, access controls, testing cadence, and reporting generate that evidence as you go, so the operating history an auditor or a prospect wants to see is already built up when they ask.
Get SOC 2 Ready

GDPR

protect patient data and for any business serving people in Europe
Read More

GDPR 

for any business serving people in Europe

Who it applies to:

Any organization that processes the personal data of people in the EU, regardless of where the business itself is located. You do not need an office in Europe to be in scope; serving EU customers or handling EU employee data is enough.

What it protects:

The personal data and privacy rights of individuals in the EU, backed by some of the steepest penalties in data protection: up to the greater of €10 million or 2% of global annual turnover for many violations, and up to €20 million or 4% for the most serious.

What you are expected to do:

Process personal data lawfully and transparently, honor individuals’ rights over their data, apply appropriate security to protect it, and, when a breach poses a risk, notify the relevant supervisory authority within 72 hours of becoming aware of it, with affected individuals notified directly in high-risk cases. Many organizations must also designate a data protection officer or a clear point of contact for privacy.

Evidence to keep:

Records of processing activities, your security controls and risk assessments, a breach register documenting every incident whether or not it was reportable, and evidence of how and when breaches were assessed and notified.

How Decypher helps:

That 72-hour clock is what trips up most programs, because meeting it means detecting a breach and understanding it fast enough to make the notification call. Our monitoring and MDR are built for exactly that speed. Alongside them, the access controls and data protection we put in place lower the odds of a breach to begin with, and we keep the incident documentation the regulation expects you to hold.

Note: EU rules in this area continue to evolve, including a proposal that could adjust the breach-notification window. We track those changes so your program stays current.

Talk Through GDPR

State Privacy and Breach Laws

the obligations geography creates

Read More

State Privacy and Breach Laws

the obligations geography creates

Who it applies to:

Businesses that hold personal data on residents of states with their own privacy or breach-notification laws, which now covers most of the country in some form. Financial-sector firms licensed in New York also face NYDFS 23 NYCRR 500, which carries specific requirements for risk assessment, penetration testing, and incident response.

What it protects:

The personal data of state residents, and their right to be told promptly when that data is exposed.

What you are expected to do:

Requirements vary by state, but the common threads are reasonable security safeguards, limits on how personal data is used and shared, and breach notification within defined timeframes, some shorter than the federal ones.

Evidence to keep:

Your security program documentation, data inventory, access records, and incident and notification records.

How Decypher helps:

These laws lean on a common core of security and notification expectations, so one well-run program tends to cover most of them together. We stand that program up, keep its evidence current, and give you the detection and response speed that state breach deadlines, often tighter than the federal ones, leave little room to miss.
Review My State Obligations

Compliance Support Without Checkbox Security

We aim at controls that cut down risk and produce evidence you can defend, so your program earns its keep in an audit and in an incident alike.
Advisory and program support

We help you set ownership and risk tolerance, operationalize the right controls, and produce the artifacts auditors, customers, and insurers expect: risk assessments, remediation tracking, incident records, and executive and governance reporting that shows how the program is maintained over time.

Compliance reporting and archiving

Many frameworks also require you to retain records in a way that cannot be altered or deleted after the fact. We provide the archiving infrastructure that supports it:

  • Email archiving, with availability for Teams, SharePoint, and more
  • Retention for up to six years with archive redundancy
  • Non-rewriteable, non-erasable WORM-compliant storage
  • Secure authentication and storage with customizable user roles
  • Search, discovery, and review capabilities with online web access to your data
Explore How We Support Your Program

Backed by a $3 Million
Security Operations Warranty

Compliance and security are both judged by what happens when something goes wrong. Our managed security operations include the Security Operations Warranty, a no-cost customer benefit that provides up to $3 million (USD) in financial assistance for cybersecurity incidents. So the program you build to satisfy auditors and insurers carries financial backing behind it if an incident does hit. 
Ask Us About the Warranty

Turn Compliance Pressure Into a Program That Holds Up

Maybe you are trying to work out what applies to you. Maybe an insurer flagged a gap, or a client is waiting on evidence you do not yet have organized. Any of those is a fine place to start. We will give you a clear read on where you stand and a prioritized plan to get where you need to be.

Decypher provides cybersecurity and compliance-enablement services. We are not a law firm and do not provide legal advice. Determinations about which regulations apply to your organization should be made with qualified legal counsel.