HIPAA, PCI DSS, NIST and CMMC Compliance Readiness in Northern Virginia
Find the gaps, fix them, and have the evidence ready before an auditor, assessor or insurer asks.
We get your business ready to show a regulator, assessor, customer or insurer that your security controls exist, work and are written down.
It is for medical and dental practices under HIPAA, stores and restaurants that take cards, defense contractors working toward CMMC, production companies asked for a TPN assessment, and firms facing a cyber insurance renewal. DistrictConnects runs readiness assessments and fixes the gaps we find, and we sign a HIPAA business associate agreement before any work starts.
- BAASigned before any HIPAA work begins
- 110NIST SP 800-171 requirements behind CMMC Level 2
- 60 daysHIPAA outer limit for breach notice after discovery
Where compliance usually falls apart
Most businesses we assess have some good controls in place. What they lack is proof, and a clear list of what is still missing.
- No current risk analysis. The HIPAA Security Rule makes a documented risk analysis a required step, yet many practices have never done one, or last did it years ago.
- “Our processor handles PCI.” If card terminals sit on your network, part of PCI DSS is still yours, and the future-dated requirements of PCI DSS v4.x became mandatory on 31 March 2025.
- Settings without paperwork. MFA is on, but nothing shows since when, for whom, or what happens when someone leaves. Assessors and insurers grade evidence, not intentions.
- Vendors with no BAA. A cloud, email, backup or IT vendor that handles patient data is a business associate and needs a signed agreement.
- No plan for a breach. HIPAA allows no more than 60 days from discovery to notify affected patients, and waiting until day 60 can still count as unreasonable delay. Deciding who does what in the middle of an incident is too late.
- CMMC on pause, NIST SP 800-171 still in force. The Pentagon suspended CMMC Phase II in July 2026, but contract clauses for controlled unclassified information and Phase 1 self-assessments still apply.
A readiness assessment tells you which gaps matter, and in what order, before someone outside the business finds them.
Frameworks we prepare you for
The frameworks overlap heavily: access control, MFA, encryption, logging, backups, training and written policies. One solid foundation serves several of them at once.
- HIPAA. The Security Rule’s administrative, physical and technical safeguards reviewed against how your practice actually works, with the risk analysis, policies and workforce training to match.
- PCI DSS v4.x. Scope review of the cardholder data environment, POS and payment VLANs, firewall rules, SAQ preparation, vulnerability scan support and evidence for your acquirer or QSA.
- NIST CSF 2.0. The six functions, Govern, Identify, Protect, Detect, Respond and Recover, as a practical baseline for any business without a specific regulation.
- NIST SP 800-171 and CMMC. Level 1 covers basic safeguards from FAR 52.204-21, Level 2 the 110 requirements of NIST SP 800-171 Rev. 2, and Level 3 adds requirements from SP 800-172. We prepare the SSP, POA&M and evidence.
- TPN. Readiness against the MPA Content Security Best Practices for media vendors handling studio content, ahead of a Trusted Partner Network assessment.
- Cyber insurance. The controls underwriters ask about, including MFA, EDR, tested backups, an incident response plan and email security, documented so every answer on the application is true.
Our team holds CEH, CISSP, CISM, CISA, Security+ certifications, but readiness work is not a formal audit or legal advice, and certification comes only from an accredited assessor.
What is included
Gap assessment against the framework
Your current controls checked line by line against HIPAA, PCI DSS, NIST CSF 2.0, NIST SP 800-171 and CMMC, or the MPA Content Security Best Practices for TPN. You get a scored list of what is in place, what is partial and what is missing.
Risk analysis and risk register
The documented risk analysis HIPAA requires, and the same method for other frameworks: systems, threats, vulnerabilities, likelihood and impact, with a risk management plan that says what will be done about each one and by when.
Asset and data flow mapping
Where patient records, card data, controlled unclassified information or studio content live and how they move. Shrinking that footprint, for example by isolating card terminals on their own VLAN, often shrinks the scope of the whole assessment.
Remediation we carry out ourselves
We fix the technical gaps instead of handing you a list: MFA and Conditional Access, Intune device compliance and BitLocker, EDR, firewall segmentation, encrypted email, audit logging and backups with tested restores.
Policies and documentation
Security policies, an incident response plan, a vendor and BAA register, and for contractors a System Security Plan (SSP) and Plan of Action and Milestones (POA&M). Written for how your business actually works, not copied from a template.
Microsoft 365 compliance settings
Audit logging, retention and legal hold, data loss prevention, sensitivity labels, external sharing limits and Defender for Office 365, configured and mapped to the framework controls they satisfy.
Staff training with records
Annual and new-hire security awareness training plus simulated phishing, with completion records ready for HIPAA, PCI DSS and CMMC reviews and for cyber insurance applications.
Evidence kept current
Quarterly reviews, a yearly refresh of the risk analysis, and an evidence package assembled 60 to 90 days before an assessment or insurance renewal: MFA reports, EDR coverage, backup tests, training logs and patch status.
How the work runs
Scoping call and BAA
We confirm which frameworks apply, what triggered the need (a contract clause, a payment processor letter, an insurance renewal, a client questionnaire) and the deadline. Healthcare clients sign a BAA with us before we touch any system.
Discovery
An engineer reviews your Microsoft 365 tenant, devices, network, firewall, backups and vendors, and interviews the people who handle the regulated data, on-site or remotely.
Gap report and priorities
You receive a plain-English report: each requirement, where you stand, the risk and the fix, ranked so the most important gaps close first. The remediation quote is itemized.
Remediation
Our team makes the technical changes, after hours where they could interrupt work, and records each one with a date and an owner, which becomes your evidence.
Documentation package
Policies, risk analysis, SSP and POA&M where required, network diagrams and evidence screenshots, organized the way an assessor, acquirer or underwriter asks for them.
Ongoing upkeep
Compliance drifts as staff, vendors and systems change. Quarterly reviews keep the controls and the paperwork in step, and we help answer assessor and insurer follow-up questions.
Platforms we work with
- Microsoft 365
- Microsoft Intune
- Microsoft Defender
- CrowdStrike
- SentinelOne
- Fortinet
Industries we do this for
Related guides
Service area
On-site across Northern Virginia and DC.
Prince William
- Manassas
- Haymarket
Arlington and Alexandria
- Arlington
- Alexandria
DC and Maryland
Common questions
Do you perform formal HIPAA, PCI or CMMC audits?
No. We run readiness assessments and fix what they find, so you go into a formal review prepared. Formal assessments come from accredited bodies: a Qualified Security Assessor (QSA) for PCI DSS when your acquirer requires one, a certified third-party assessment organization (C3PAO) for CMMC, an accredited assessor for TPN. We work alongside those assessors and supply the evidence they ask for.
Will you sign a HIPAA business associate agreement?
Yes, before any work starts. Any IT provider that can access systems holding patient information is a business associate under HIPAA and needs a signed BAA. We also check that your other vendors, including email, cloud storage, backup, phone and practice management providers, have signed one, and keep a register of them for your records.
What is the first step toward HIPAA compliance?
A documented risk analysis. The HIPAA Security Rule requires an accurate and thorough assessment of the risks to electronic patient information, and HHS treats it as an ongoing process rather than a one-time form. The Security Rule does not prescribe specific products, so the risk analysis is what justifies the safeguards you choose. Without one, every other control is hard to defend.
Is Microsoft 365 HIPAA compliant out of the box?
No. Microsoft offers a BAA for its in-scope cloud services, but that covers Microsoft's side only. Whether your tenant meets HIPAA depends on configuration: MFA and Conditional Access, audit logging, retention, data loss prevention, encrypted email and device controls through Intune. We review the tenant against HIPAA and NIST, then configure and document the settings that are missing.
We use a payment processor. Do we still need PCI DSS?
Usually yes, though often a shorter version. A processor reduces your scope but does not remove it. If card terminals or POS systems connect to your network, that network is in scope, so card devices need their own VLAN and firewall rules, and guest Wi-Fi must have no route to them. We help you confirm your Self-Assessment Questionnaire (SAQ) type and prepare it.
What does CMMC require right now?
The Pentagon suspended the CMMC Phase II rollout in July 2026 while it reviews the program, but contractors handling controlled unclassified information still have to meet the 110 requirements of NIST SP 800-171 Rev. 2 under DFARS clause 252.204-7012, and Phase 1 self-assessments continue. We build the SSP and POA&M, close the gaps and prepare you for whichever assessment applies.
What is a TPN assessment, and can you help?
The Trusted Partner Network is the Motion Picture Association's content security program. Studios ask post-production, VFX and other media vendors to be assessed against the MPA Content Security Best Practices, which cover organizational, operational, physical and technical controls. We prepare you before the assessor arrives, fixing network, access, encryption and logging gaps and documenting each fix so the assessor can verify it.
How much does a compliance readiness assessment cost?
It depends on which frameworks apply, the number of users, locations and systems in scope, how much documentation already exists and how much remediation follows. We do not publish prices. A free first assessment tells you roughly where you stand, then you get an itemized quote for the readiness work and any fixes, month to month with no long-term contract.