Find and close the gaps before an examiner, certification auditor, or customer does. Independent compliance audits by CISA-certified auditors against HIPAA, ISO 27001, NIST SP 800-53, NY DFS, and more.
Get Your QuoteAs Certified Information Systems Auditors, we evaluate your administrative, physical, and technical safeguards against the framework you are measured on, and show you exactly where you fall short and how to close each gap.
Altius IT evaluates compliance with leading industry standards and regulations, including HIPAA, HITECH, GDPR, FFIEC, GLB, FTC, FACTA, NIST, ISO, ITAR, FISMA, and more, plus SOC 2 readiness ahead of an examination by our CPA partners. Many of our clients bundle our compliance audit with our network security audit. Our report identifies specific “gaps” and provides detailed instructions to address each risk. The audit includes a comprehensive risk assessment and risk management recommendations.
We tell you up front what our audit delivers and who gives the final word, so nobody is surprised at examination or certification time.
Also assessed: the CJIS Security Policy, the GLBA Safeguards Rule, SOX IT general controls, and FTC consent order requirements.
Only a licensed CPA firm can perform a SOC 2 examination and sign the opinion. We do the readiness work, which is the gap assessment, the remediation plan, and getting your evidence and controls into a state that will survive scrutiny. The SOC 2 report itself is issued by our CPA partners, and we coordinate with them through to the examination. Any firm that tells you it will both prepare you and issue your SOC 2 report is describing something it cannot do.
Readiness in that sense is a distinct engagement, and SOC 2 is the one we offer it for. Everything else on this page is an audit we perform and report on ourselves, under our own Certified Information Systems Auditor credential.
The Security Rule audit in the rows above covers the safeguards around electronic PHI. The Privacy Rule, which governs how PHI may be used and disclosed, is part of our privacy audit. The Security Risk Analysis is required by the Security Rule but performed as its own engagement, as part of our risk assessment. They are three engagements, and satisfying one does not satisfy the others. Our HIPAA compliance audit page sets out all three side by side if you are working out which ones apply to you.
HIPAA protects the confidentiality, integrity, and availability of protected health information, and the U.S. Department of Health and Human Services Office for Civil Rights (OCR) enforces it. The Privacy Rule sets national standards for how PHI may be used and disclosed, the Security Rule requires administrative, physical, and technical safeguards for electronic PHI, and the Breach Notification Rule requires notice when unsecured PHI is compromised. Business associates that handle PHI for a covered entity must comply as well.
OCR can impose civil monetary penalties for non-compliance, and investigations often begin with a breach report or a patient complaint. Organizations that can show a current risk analysis, documented safeguards, trained staff, and corrective action on past findings are in a far stronger position when they do.
To stay compliant, healthcare organizations should:
Altius IT’s reports provide specific recommendations and detailed steps you can take to address any identified security vulnerabilities and meet compliance requirements. After delivery of our reports, Altius IT provides three months of free support to answer any questions you may have.
Show clients, examiners, and prospects that an independent certified auditor has assessed your controls. As Certified Information Systems Auditors, we can issue an Auditor Opinion Letter documenting our opinion of your controls against the requirements in scope.
Altius IT provides a certified auditor with each engagement:
Our proposal provides you with detailed information so you know exactly how we will help you:
Three phases built around the framework you are measured against and the date you face it.
We confirm which frameworks and rules apply to you, the systems and locations in scope, and the date of any examination or certification, then request the policies and evidence an examiner will expect. You receive a detailed proposal covering scope, pricing options, team CVs, and sample reports.
We test your administrative, physical, and technical safeguards against each requirement through interviews, document review, and technical verification, and record whether each control is well designed and actually operating.
You receive a gap report mapped to each requirement, with risk ratings, specific steps to close every gap, and risk management recommendations. We walk your team through the results and provide three months of free post-audit support. Where needed, we can issue an Auditor Opinion Letter.
This audit is for organizations that answer to a regulator, a certification body, or a customer contract, and need independent evidence of where they stand.
| Healthcare & Business Associates | HIPAA Security Rule safeguards, with the risk analysis and privacy work alongside. See our HIPAA compliance audit. |
| ISO 27001 Organizations | An independent clause 9.2 internal audit before the certification body arrives. |
| Federal Agencies & Contractors | NIST SP 800-53 control assessments for the assess step of the Risk Management Framework. |
| Financial Institutions | NY DFS Part 500, the GLBA Safeguards Rule, and FFIEC expectations, with findings an examiner can follow. |
| Service Organizations | SOC 2 readiness before our CPA partners begin the examination. |
No. Only a licensed CPA firm can issue a SOC 2 report. We do the readiness work, and our CPA partners perform the examination and issue the report.
Clause 9.2 of ISO 27001 requires you to run internal audits of your own ISMS, performed objectively and impartially. We perform that internal audit independently. Certification is a separate audit performed by an accredited certification body, which issues the certificate.
No. Our independent control assessment is the assess step of the NIST Risk Management Framework. The authorization decision belongs to your authorizing official, who uses the assessment as evidence.
Yes. Many controls overlap, such as risk assessment, access control, vendor oversight, and incident response. We test each control once and map the result to every framework in scope, so one engagement can serve HIPAA and ISO 27001, or NY DFS and the GLBA Safeguards Rule.
Unlike a security consultant, Altius IT is certified as a Certified Information Systems Auditor to perform a security audit of your environment and issue reports and recommendations to secure your systems. Altius IT has been featured in 40+ publications and nationwide media outlets.
Strengthen your applications and network infrastructure against evolving threats.
Meet HIPAA, GDPR, NIST, ISO, PCI-DSS, SOX, and other compliance standards.
Safeguard sensitive data, intellectual property, and customer information.
Every engagement includes follow-up support to ensure vulnerabilities are properly mitigated.
