Nyra Security
Book a scoping call

Compliance & cloud workspace security

Three audits.
One set of controls.

HIPAA, SOC 2 and PCI DSS ask for the same handful of things in three different dialects. Nyra Security maps them once, builds them once, and hardens the Microsoft 365 or Google Workspace tenant where most of your evidence already lives.

Book a scoping call See the control crosswalk
Readiness assessments Evidence pipelines Tenant hardening Auditor liaison

What we take you through

Audit programs, run end to end

We scope the boundary, close the gaps, build the evidence, and stay in the room while the assessor works through their request list.

HIPAA

Providers, digital health, and business associates handling PHI

  • Security Rule risk analysis and risk management plan under §164.308(a)(1)(ii)(A)–(B)
  • Policies mapped across administrative, physical and technical safeguards
  • Business Associate Agreement review, including subcontractor flow-down
  • Breach notification runbook and the four-factor assessment under §164.402
  • Workforce training, sanction policy, and access termination procedures

You end up with A defensible risk analysis, a safeguard gap register, a sequenced remediation plan, and an evidence set that holds up to an OCR inquiry.

SOC 2

SaaS and service organizations buried in customer security reviews

  • Scoping the Trust Services Criteria that actually apply — Security always, the other four by contract
  • Control design against the 2017 TSC with the 2022 revised points of focus
  • Readiness assessment and gap closure before the observation window opens
  • Evidence automation inside tools you already run, instead of a screenshot marathon
  • Auditor selection, kickoff, and management of the request list

You end up with A control matrix, a populated evidence repository, and a Type II observation window you can get through without a fire drill.

PCI DSS v4.0

Merchants and service providers that touch cardholder data

  • Scope reduction first: tokenization, hosted payment pages, network segmentation
  • SAQ selection, or Report on Compliance readiness where a QSA is required
  • Requirement 8 authentication, Requirement 10 logging and Requirement 11 testing built to pass
  • Customized approach documentation where the defined approach does not fit your architecture
  • ASV scan and penetration test coordination under 11.3.2 and 11.4.3

You end up with A scope diagram you can defend, the correct SAQ, and remediation ordered by what the assessor asks for first.

The signature of the work

One control, three audits

Most teams build their HIPAA program, then start over for SOC 2, then start over again for PCI. They are largely the same controls under different citations. Filter a column to see what a single framework asks for — the rest stay visible, because the overlap is the point.

Control HIPAA Security Rule SOC 2 TSC PCI DSS v4.0 M365 / Workspace
Risk assessment §164.308(a)(1)(ii)(A)Accurate and thorough risk analysis CC3.2Identifies and analyzes risk to objectives 12.3.1Targeted risk analysis per requirement Secure Score and Workspace security health as the recurring baseline
Multi-factor authentication §164.312(d)Person or entity authentication CC6.1Logical access security measures 8.4.2MFA for all access into the CDE Conditional Access with FIDO2 passkeys / 2-Step Verification with security keys
Least privilege §164.308(a)(4)Information access management CC6.3Access added, modified and removed 7.2.2Access by job function and least privilege Privileged Identity Management, just-in-time roles / delegated admin roles
Encryption in transit §164.312(e)(1)Transmission security CC6.7Transmission and movement of information 4.2.1Strong cryptography over open networks Exchange Online TLS connectors / Gmail TLS compliance rules
Audit logging §164.312(b)Audit controls over ePHI systems CC7.2Monitoring for anomalies 10.2.1Audit logs for all system components Purview Audit with extended retention / admin audit exported to BigQuery
Data loss prevention §164.312(c)(1)Integrity of ePHI CC6.7Restricts movement of information 3.5.1PAN rendered unreadable wherever stored Purview DLP on PHI and PAN classifiers / Drive and Gmail DLP rules
Incident response §164.308(a)(6)Security incident procedures CC7.4Responds to identified security incidents 12.10.1Incident response plan, tested annually Defender XDR incidents / Alert Center rules routed to an on-call owner
Third-party risk §164.308(b)(1)Business associate contracts CC9.2Assesses and manages vendor risk 12.8.2Written agreements with service providers Enterprise app consent governance / API access control with an app allowlist
Backup and recovery §164.308(a)(7)(ii)(A)Data backup plan A1.2Recovery infrastructure, only if Availability is in scope —Not directly required by v4.0 Retention policies and litigation hold / Google Vault retention rules
Security awareness §164.308(a)(5)Training and periodic reminders CC1.4Competence of personnel 12.6.3Training at hire and annually Attack simulation training / phishing reporting wired into the Alert Center

— not directly required by that framework Citations reference the HIPAA Security Rule at 45 CFR Part 164 Subpart C, the 2017 Trust Services Criteria, and PCI DSS v4.0.

Where the evidence actually lives

Microsoft 365 and Google Workspace consulting

For most teams the tenant is the environment: identity, mail, files, devices and the audit trail all sit in one console. We configure it to the standard your auditor will test, and leave you the runbook for keeping it there.

Microsoft 365

Entra ID, Purview, Defender, Intune, Exchange Online

Identity
Conditional Access baseline, phishing-resistant MFA, legacy authentication blocked, Privileged Identity Management on admin roles, monitored break-glass accounts
Data
Sensitivity labels, DLP policies tuned to PHI and PAN classifiers, retention and litigation hold, external sharing limits on SharePoint and OneDrive
Threat
Defender for Office 365 Safe Links and Safe Attachments, Defender for Cloud Apps session policies, SPF, DKIM and DMARC moved to enforcement
Devices
Intune compliance policies used as a Conditional Access gate, so an unmanaged laptop cannot reach regulated data
Evidence
Unified audit log retention set to the period your framework requires, sign-in logs streamed to your SIEM, Secure Score tracked over time

Google Workspace

Admin console, Context-Aware Access, Vault, Drive and Gmail controls

Identity
2-Step Verification enforced with security keys, Context-Aware Access rules by device and location, super-admin separation, scoped role delegation
Data
Drive DLP and Gmail content compliance rules, shared drive membership cleanup, external sharing restricted by target, Vault retention and holds
Threat
Advanced phishing and malware protection, security sandbox on attachments, OAuth app access control with a third-party app allowlist
Devices
Managed Chrome browser policies and endpoint verification tied back into Context-Aware Access conditions
Evidence
Admin audit and investigation queries saved as recurring reports, log export to BigQuery, security health dashboard reviewed on a schedule

The rest of the program

Advisory and ongoing work

Certification is a milestone, not a security program. These are the engagements that keep one running between audits.

Fractional vCISO

A named security leader for board reporting, customer escalations and roadmap ownership, at a fraction of a full-time hire.

Risk assessments

NIST CSF 2.0 or HIPAA-aligned assessments with findings ranked by likelihood and impact, not by how loud the scanner was.

Tabletop exercises

Facilitated ransomware and data-breach scenarios with your actual on-call staff, producing a plan that survives contact.

Security questionnaires

We answer the inbound reviews, CAIQ and vendor assessments that stall your deals, and keep a reusable answer library.

Policy authoring

A policy set written for how your company actually operates, mapped to every framework in scope and reviewed annually.

Vendor due diligence

Reviewing the subprocessors you rely on, chasing their reports, and tracking what each contract obligates them to.

Penetration test management

Scoping the test, selecting the firm, triaging results, and driving retest to closure with evidence the auditor accepts.

Diligence support

Security readiness for fundraising or acquisition, and review of the security posture you are acquiring.

How an engagement runs

Four phases, in order

Each phase has an exit condition. You always know which one you are in and what has to be true to leave it.

01 Scope

Draw the boundary1–2 weeks

Data flow mapping, system inventory, and a written boundary. We confirm which frameworks genuinely apply and, where possible, shrink what falls inside. Exit condition: a scope diagram both you and a future assessor would sign.

02 Assess

Find the real gaps3–4 weeks

Control-by-control review against the crosswalk, including a live walkthrough of your tenant configuration. Exit condition: a gap register where every item names an owner, a fix and the evidence it will produce.

03 Remediate

Build and wire it up6–12 weeks

Configuration changes, policy rollout, training, and an evidence pipeline that collects itself. We do the hands-on tenant work rather than handing you a spreadsheet of recommendations. Exit condition: every gap closed or formally risk-accepted.

04 Audit

Stay in the roomThrough the report, then ongoing

Auditor kickoff, request-list management, and drafting responses to findings. Afterward, a quarterly cadence so the next report is a renewal rather than a rebuild.

What we are not

Nyra Security is not a QSA, not a CPA firm, and not your certifying body. We do not issue the report — that independence is what makes it worth anything. We get you ready for the people who do issue it, and we sit beside you while they ask.

Start here

Tell us what is in scope

A scoping call runs about forty-five minutes. Bring whoever knows how data moves through your systems. You will leave with an honest read on effort and timeline, whether or not you work with us.

  • Which frameworks you need, and what is driving the deadline
  • Where regulated data lives today, roughly
  • Whether you run Microsoft 365, Google Workspace, or both
  • Any assessor or auditor already engaged
support@nyrasecurity.com Replies within one business day.

This opens a pre-filled email in your mail client. Nothing is stored or sent from this page. Please do not include PHI, cardholder data, or credentials.