Services
Regulatory and Framework Readiness
Get ready for the security rules that apply to you, and stay ready between audits.
When you need it
You have a rule to meet.
-
Your customer
"We need your SOC 2 report."
You geta program built to meet the standard, and help through the audit.
-
A contract
"You must meet CMMC."
You getthe work and paperwork it requires.
-
A regulator
"Show us your HIPAA records."
You getrecords kept current all year.
-
You
"Which of these rules apply to us?"
You geta clear answer before you spend anything.
What you get
Ready for the audit.
-
A list of what applies
Which rules you must meet, and which you don't.
-
One map for all rules
Where they overlap, so work is done once.
-
A proof folder
The records an auditor will ask for.
-
A fix plan
Owners and dates for every gap.
How it works
Simple, start to finish.
-
We sort out what applies
Before anyone buys anything.
-
We close the gaps
In the order the audit needs.
-
We keep the proof current
So the next audit isn't a scramble.
Questions
Compliance questions, answered.
Does Heights perform the audit or examination itself?
No. An independent auditor or assessor does that. We get you ready for it.
Does being compliant mean we are secure?
No. Passing an audit is a minimum. We build a program that's actually secure, and ready for the audit.
We are subject to several frameworks. Do we need separate programs?
No. One program can cover several rules. We map each one to it.
How early should we start before an assessment date?
As soon as you know the date. Starting early costs less than a rush.
Insights
Related reading.
-
Regulatory and Framework Readiness
GLBA Safeguards Rule Changes: What Financial Institutions Must Do in 2024
The FTC amended the Gramm-Leach-Bliley Act Safeguards Rule in 2021 and 2023, with the most recent breach notification requirements taking effect in May 2024. Financial institutions subject to FTC jurisdiction must now maintain written information security programs meeting specific technical standards and report qualifying data breaches within 30 days. Leadership faces accountability for security outcomes without always having clear ownership or governance in place.
Dr. Daniel Glauber, 19 August 2026
-
Regulatory and Framework Readiness
What GDPR Requires of US Companies and When It Applies
The General Data Protection Regulation applies to US companies that process personal data of individuals in the European Union, regardless of where the company is located. This article explains the territorial scope, core obligations, leadership accountability and practical steps for compliance.
Dr. Daniel Glauber, 18 August 2026
Let's talk.
Got an audit, a contract or a regulator asking? Book a call. We'll tell you where you stand and what it takes.