Privacy and compliance readiness

What this service is

Compliance readiness means getting your privacy and security practices to the point where they meet the requirements that apply to you, and being able to show it. Promatics handles the technical and operational side: what data you hold, how it is protected, how breaches are handled, and what evidence exists. Your legal counsel interprets the law; independent bodies certify. We sit between the two and do the practical work.

US requirements we commonly prepare for

The United States has no single federal privacy law, so requirements usually come from several sources at once.

• State comprehensive privacy laws, such as the California Consumer Privacy Act as amended by the CPRA, the Texas Data Privacy and Security Act, and laws in Virginia, Colorado and a growing number of other states. They cover privacy notices, consumer rights (access, deletion, correction, and opting out of sale, sharing and targeted advertising), data protection assessments for high-risk processing, and contracts with service providers.
• State breach notification laws, which every state has, each with its own definition of personal information, triggers and timelines, alongside state laws that expect reasonable security safeguards.
• HIPAA, whose Privacy, Security and Breach Notification Rules apply to covered entities such as healthcare providers and health plans, and to business associates that handle protected health information for them under business associate agreements (BAAs).
• The GLBA Safeguards Rule for financial institutions, enforced by the FTC for non-bank financial companies, together with the FFIEC IT Examination Handbook and the 2023 interagency guidance on third-party risk management for banks, NYDFS Part 500 for New York-regulated financial companies, and NCUA expectations for credit unions.
• The FTC Act, under which the FTC treats misleading privacy promises and unreasonable data security as unfair or deceptive practices.
• CAN-SPAM and the TCPA, where email marketing, calls, texts and consent practices are part of the review.

These summaries are general and not legal advice. Your counsel should confirm what applies to you.

Frameworks, audits and insurers

Many organizations need to satisfy someone other than a regulator. We prepare you for:

• The NIST Cybersecurity Framework 2.0 and the CIS Controls, common baselines for organizations of any size, and CMMC 2.0 for defense contractors handling federal contract information or controlled unclassified information, where higher levels require an assessment by an authorized third-party assessment organization.
• SOC 2 and ISO/IEC 27001, often requested by enterprise clients. Reports and certificates come from independent auditors and registrars.
• Cyber insurance questionnaires, which commonly ask about MFA, EDR, backups, email security and training.
• Client security questionnaires and contract clauses on data location, breach notification and subcontractors.

Breach readiness

The first days after a breach are stressful, and decisions made then are hard to undo. A breach response plan sets out how an incident is contained, who assesses which notification laws are triggered and by when, who decides on reporting and notification, who speaks to your insurer and counsel, and how the incident record is kept. We build the plan with you and rehearse it in a tabletop exercise.

How we work with your counsel and auditors

Readiness work goes faster when roles are clear. Your legal counsel decides which obligations apply and how to read them. Your auditor or certification body decides whether you meet a standard. We translate their requirements into systems, procedures and evidence, flag questions that need a legal answer instead of guessing, and keep a traceable list showing each requirement, the control that meets it, its owner and where the evidence lives. That list becomes the working document for everyone involved, and it stays with you after we finish.

Connected services

Readiness often reveals technical work. Security assessments measure your controls in depth, and our wider cybersecurity services close the gaps, including EDR, email security and awareness training.