Start from the rules you answer to, then design the access.
On each industry page you'll find the regulations that shape identity and data work in that sector, each linked to its primary text. Plus the platforms and problems we run into most there.
Energy, oil & gas
Identity governance, privileged access and OT remote access for pipelines, utilities and oil and gas operators under TSA directives and NERC CIP.
- TSA Security Directive Pipeline-2021-02 series
- NERC CIP-004 (personnel and access management)
- NERC CIP-005 (electronic security perimeters and remote access)
- NERC CIP-007 (system security management)
Healthcare payers
Facets, member identity and claims data work for health plans meeting CMS-0057-F API deadlines, the HIPAA Security Rule and state data security laws.
- CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- State insurance data security laws (NAIC Model 668)
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Banking & financial services
IGA, privileged access, MFA and data access controls for banks, credit unions and lenders under FFIEC guidance, NYDFS Part 500, GLBA and PCI DSS.
- FFIEC Authentication and Access Guidance (2021)
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
- GLBA Safeguards Rule (16 CFR Part 314)
- PCI DSS v4.0.1
Insurance
State data security laws, NYDFS Part 500 and the NAIC AI bulletin all land on insurers. We handle the identity, governance and data work they call for.
- State insurance data security laws (NAIC Model 668)
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
- NAIC Model Bulletin on the Use of AI Systems by Insurers
- NYDFS Insurance Circular Letter No. 7 (2024)
Public sector
We work with state and local agencies, and the vendors selling to them, on identity, CRM and getting ready for FedRAMP, GovRAMP, TX-RAMP, CJIS and CMMC.
- FedRAMP and FedRAMP 20x
- GovRAMP (formerly StateRAMP)
- TX-RAMP (Texas Government Code 2054.0593)
- FBI CJIS Security Policy
Manufacturing
Manufacturers and defense suppliers bring us in for CMMC prep, export-controlled data access, IEC 62443 remote access and getting ERP data into analytics.
- CMMC (32 CFR Part 170 and DFARS 252.204-7021)
- NIST SP 800-171 Rev. 2 and DFARS 252.204-7012
- ISA/IEC 62443 series
- ITAR release and access information (22 CFR 120.50 and 120.56)
Pick an industry. See the rules, the platforms and the work.
Energy, oil & gas
open the industry page →Healthcare payers
open the industry page →Banking & financial services
open the industry page →Insurance
open the industry page →Public sector
open the industry page →Manufacturing
open the industry page →Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it