Compliance

Robust Frameworks Simplified

The DevilDog Compliance Group

Establishing effective cybersecurity controls is a major challenge for every company. Organizations both big and small need to leverage a prescriptive, repeatable, and mathematical approach to risk management.


Cybersecurity compliance regulations are designed to harden your infrastructure. DevilDog takes on the work of managing the complex compliance processes so you can focus on your core business. Our experienced team is well-versed in government compliance and can support your business’s software security needs while distilling both the assessment and solution into easy-to-understand concepts and terms.

DevilDog’s compliance experts have over 70 years of experience in federal and commercial regulations

The DevilDog Compliance Group can provide a comprehensive cybersecurity plan that’s right for you. Our solutions include everything companies need to comply with regulations, such as

  • Complete Business Continuity Plans with over-arching goals and policies
  • Disaster Recovery Plans with Security Controls
  • Complete identification of risks, vulnerabilities and threats
  • Step-by-step procedures
  • Continuous monitoring and improvements


The DevilDog Compliance Group is comprised of project managers and cybersecurity specialists with decades of experience in meeting a wide range of regulations. We also work with experts in the field, including the authors of CyberSecurity regulations, such as CMMC, NIST 800-171 and DFARS.

Compliance Specializations

  • Gramm-Leach Bliley Act
  • DFAR
  • NIST SP 800-30
  • NIST SP 800-34
  • NIST SP 800-64
  • FIPS 199 & 200
  • CMMC
  • FISMA
  • NIST SP 800-39
  • NIST SP 800-122
  • NIST 800-53
  • Data Privacy
  • NIST 800 171
  • NIST SP 800-37
  • NIST SP 800-60
  • NIST SP 800-137
  • NIST SP 800-18
  • HIPAA
  • ISO 27001
  • NIST SP 800-12
  • NIST SP 800-50
  • NIST SP 800-115
  • FedRAMP
  • ONG-C2M2

“Cyber defense requires greater speed and agility to outpace our adversaries, substantially increased costs and risks to threat actors, and the durability and resiliency to recover immediately.”

— CISA

How to Start a Compliance Program


Identify Specific Requirements & Types of Data

For starters, it’s important to first figure out what regulations or laws you need to comply with. Compliance requirements vary greatly from federal to state. Some apply regardless of whether your business is located in the state, territory or market.

Secondly, it’s important to determine what type of data you are storing and processing, as well as which states and countries you are operating in. In many regulations, specific types of personal information are subject to additional controls. Personally identifiable information (PII), includes any data that could uniquely identify an individual.

Appoint a CISO or Outsource a CISO

Most companies are far too small to justify hiring a six-figure CISO to manage compliance. However, there are many cybersecurity firms that have staff to manage cybersecurity at a fraction of this cost. By hiring a CISO or outsourcing this responsibility you can gain compliance and get regular updates regarding the state of your cybersecurity program and compliance efforts.

Conduct Vulnerability/Risk Assessments

Every major cybersecurity compliance requirement requires a vulnerability/risk assessment. These are critical in determining what your organization’s most critical security flaws are, as well as what controls you already have in place.

Implement Technical Controls Based On Requirements

You must implement technical controls to the cybersecurity regulation you are adhering to. Here are some examples of technical controls:

  • Implementing a Firewall
  • Standardized Anti-Virus across all endpoints
  • Implementing Network Monitoring Software
  • Implementing Log Aggregation Software
  • Protect & Encrypt Sensitive Data

Implement Policies, Procedures, & Process Controls

You must have policies and procedures in place to mitigate risk. It’s critical for compliance, security and safety. Some examples of non-technical controls include:

  • Documented policies and procedures
  • Audit and Accountability Processes
  • Mandatory Employee Cybersecurity Training
  • Appointing a CISO or outsource CISO
  • Conducting Vulnerability/Risk Assessments

Test & Review

Review requirements that need to be met and regularly test your controls. Conducting regular tests will make sure your company stays compliant.