IT Compliance: HIPAA, CMMC, SOC 2 & PCI

Compliance you can prove.

Regulators, customers, and insurers increasingly want evidence rather than assurances. Corewell Technology turns the frameworks that apply to your Los Angeles business into a working program: a gap assessment against the standard, written policies your team will actually follow, technical controls implemented and monitored, evidence collected continuously, and an engineer beside you when the auditor or the customer questionnaire arrives.

Get a free IT assessment 213-225-1511

HIPAA, CMMC, NIST, SOC 2, PCI DSS, and CCPA
Written policies matched to your actual operations
Controls implemented and monitored, not just listed
Evidence and audit support included

Frameworks we work in

HIPAA Security and Privacy Rules for healthcare providers and their business associates. CMMC 2.0 and NIST SP 800-171 for Department of Defense suppliers and their subcontractors. SOC 2 for software and service companies whose customers demand a report. PCI DSS for merchants and anyone storing or transmitting card data. The California Consumer Privacy Act and the CIS Controls as a baseline for every business. And the increasingly specific requirements of cyber-insurance carriers, which function as a framework of their own.

Why a program rather than a checklist

Compliance that lives in a binder fails the first time a laptop is lost or a customer sends a 200-question security review. A program means the policies describe what your people do, the controls are enforced by technology rather than memory, evidence is collected automatically from the systems themselves, and someone reviews it on a schedule. That program is also, not coincidentally, what keeps you out of a breach notification in the first place.

How Corewell delivers it

We start with a gap assessment that maps each requirement to your current state and produces a prioritized remediation plan with costs and timelines. We then write or adapt policies, implement the technical controls through your managed IT environment, train staff, and configure continuous evidence collection. For CMMC we prepare the System Security Plan and Plan of Action and Milestones and work with your C3PAO. For SOC 2 we coordinate with your auditor. For HIPAA we conduct the annual risk analysis the rule requires and maintain the documentation.

What you receive

A current gap assessment and risk register. A policy set that matches your operations. Controls that are implemented, monitored, and reported. An evidence library ready for an auditor, an insurer, or a customer. Staff training records. And a compliance calendar so nothing is discovered late. When a questionnaire or audit arrives, a Corewell engineer answers the technical questions with you.

What is included

IT Compliance: HIPAA, CMMC, SOC 2 & PCI: what you receive

Gap assessment

Every requirement mapped to your environment with a prioritized, costed remediation plan.

Policies and procedures

Written for your business and reviewed annually, not downloaded templates.

Technical controls

Encryption, MFA, logging, access control, and monitoring implemented and enforced.

Continuous evidence

Screenshots, logs, and reports gathered automatically into an audit-ready library.

Risk analysis and SSP

Annual HIPAA risk analysis, CMMC System Security Plans, and POA&M maintenance.

Audit and questionnaire support

An engineer beside you for the auditor, the assessor, and the customer security review.

Questions

Common questions

Does Corewell certify us?

No provider can certify you; certification comes from the assessor or auditor for the framework. Corewell prepares you, implements the controls, gathers the evidence, and supports you through the assessment so it succeeds the first time.

We are a small medical practice. Does HIPAA really apply to our IT?

Yes. The HIPAA Security Rule applies to every covered entity regardless of size, and it requires a documented risk analysis, policies, access controls, encryption, backups, training, and business associate agreements with vendors like us. Enforcement actions against small practices are common.

How long does CMMC readiness take?

For a small defense subcontractor starting from a typical environment, six to twelve months to reach Level 2 readiness is realistic, depending on how much data must be moved into an enclave and how quickly policies can be adopted. We provide a dated plan after the gap assessment.

Related services