Who This Is For
Businesses across South Bend, Mishawaka, Elkhart, Goshen, Plymouth and Northern Indiana that have a compliance obligation and nobody whose job it is to own it: the dental practice that has never done a HIPAA risk assessment; the machine shop whose defense customer just asked for an SPRS score; the dealership or tax office that hasn't heard the FTC Safeguards Rule applies to it; the company whose cyber-insurance renewal came back with a list of required controls; and anyone whose largest customer now sends a security questionnaire with every contract.
The Problem: The Rules Arrived Before the Staff Did
Ten years ago, compliance was something large companies worried about. Today it reaches a 12-person practice, a 40-person shop and a family dealership — through regulators, through insurers, and increasingly through customers who push their own obligations down the supply chain. The requirements are real and the penalties are real, but the small business receiving them has an owner, an office manager and an IT vendor hired to keep the computers running. Nobody was hired to read the rule, map it to the environment, fix the gaps, write the policies and keep the evidence. That is the job we take.
The Frameworks We Work With
HIPAA
Security Rule risk assessment, safeguards, policies, training, Business Associate Agreements and breach readiness for practices and their vendors. HIPAA compliance support →
CMMC & NIST SP 800-171
Scoping, gap assessment, SPRS scoring, SSP and POA&M, remediation and assessment support for defense suppliers. CMMC readiness for manufacturers →
Cyber-insurance requirements
The controls carriers now require — MFA, EDR, backups, email security, training — implemented so the application is truthful and the claim is honored. Cyber-insurance readiness →
FTC Safeguards Rule
The written information security program, qualified individual, risk assessment, MFA, encryption, monitoring, training, vendor oversight and incident plan required of dealerships, tax preparers, accountants and other non-bank financial institutions.
PCI DSS
Network segmentation for card-handling systems, the technical controls, and support completing the annual self-assessment questionnaire your processor requires.
Customer security questionnaires
Accurate answers, the gaps that would cost you the contract identified, and a plan with costs to close them — because these questionnaires are now how large customers prune their vendor lists.
One Foundation, Many Frameworks
The frameworks differ in detail but overlap heavily in substance. Nearly all of them require the same foundation: multi-factor authentication, named accounts with least-privilege access, endpoint detection and response, email security, encryption of devices and sensitive data, logging and monitoring, tested and immutable backups, staff security training with records, vendor oversight, a written incident-response plan and a periodic risk assessment. We build that foundation once, as part of managed IT. Each specific framework then becomes a matter of its additional controls and its documentation — not a fresh project every time a new requirement lands on your desk.
How It Works
- Identify what applies. The data you hold, the customers you serve, the policies you carry — and therefore which rules reach you.
- Gap assessment. Every requirement scored against your environment, with evidence, producing a prioritized list.
- Plan with costs. Phased, fixed-price, approved one phase at a time.
- Remediate by risk. The items most likely to cause a breach or lose a contract first, scheduled around your operation.
- Document. Policies, procedures, training records, risk assessments, vendor agreements — organized so a question from a regulator, insurer or customer is a lookup, not a scramble.
- Operate. Reviews, training, reassessments and evidence collection as a routine inside your managed IT agreement.
Pricing
The gap assessment is a fixed-price engagement. Remediation is quoted as a phased fixed-price plan after the assessment. Ongoing operation of the controls is included in a managed IT agreement. Third-party assessor or auditor fees, where a framework requires them, are separate and we tell you what to budget. Hourly consulting follows our published rates.
"We Feel Protected and Secured!"
Moving to LecsIT has brought us one significant advantage: a strong sense of security for our systems. LecsIT excels in providing fast and professional responses, thanks to their well-staffed and knowledgeable team. If you're on the fence about choosing LecsIT, ask yourself this: Can you afford the potential ransom?
Frequently Asked Questions
Related
HIPAA · CMMC & NIST 800-171 · Cyber-insurance readiness · Cybersecurity services · Security-awareness training · Dealership IT (Safeguards Rule) · Financial services IT · vCIO advisory
From the blog: FTC Safeguards Rule 2026: What Northern Indiana SMBs Need to Do Now · Four Compliance Gaps That Cost Businesses Money · CISA's Cybersecurity Performance Goals 2.0 for Northern Indiana SMBs
Not Sure Which Rules Reach You?
Start with a gap assessment. We'll identify what applies, score you honestly, and hand you a phased plan with costs.
Request a Compliance Gap AssessmentOr call (888) 606-8805