Bay Geeks Guide · Compliance Insurance & Compliance Hub

Insurance & Compliance, In One Place

Cyber insurance, HIPAA, PCI DSS and the FTC Safeguards Rule (GLBA) each show up as a different form asking a different auditor's questions, but underneath they're checking for the same dozen or so controls. This page is the map: which framework applies to you, which guide covers it, and which controls satisfy more than one at once.

Start Here

If a client, insurer or auditor just handed you a form, the fastest path is the framework it's testing against. If you're not sure which applies, the industry pages below are built around the framework most relevant to that kind of business, and every page links back to this one.

Cyber Insurance

Applies to nearly every business with a policy or applying for one. Covers MFA, EDR, backups, monitoring and the rest of what carriers ask before they'll quote or renew.

Cyber Insurance Questionnaire: What They Ask →

HIPAA

Applies to medical, dental and behavioral health practices, and anyone handling protected health information.

PCI DSS

Applies to any business that stores, processes or transmits card payments: retail, restaurants, hospitality and e-commerce.

GLBA / FTC Safeguards Rule

Applies to accountants, bookkeepers, tax preparers and payroll providers as "financial institutions" under federal law, and shapes how we approach law firms handling client funds and financial records too.

The Controls That Satisfy More Than One

Build these once and most of the paperwork across every framework below gets easier, not harder. This is a plain-English map, not a legal opinion: confirm your specific obligations with your insurer, your processor, or counsel.

Control	Cyber Insurance	HIPAA	PCI DSS	GLBA / Safeguards
Multi-factor authentication	Explicit	Expected	Explicit	Explicit
EDR / anti-malware on every endpoint	Explicit	Expected	Explicit	Explicit
Offline or immutable backups, tested	Explicit	Expected	Recommended	Expected
Patch & vulnerability management	Explicit	Expected	Explicit	Explicit
Network segmentation	Increasingly asked	Recommended	Explicit	Recommended
Access control & unique logins	Explicit	Explicit	Explicit	Explicit
Encryption (transit & at rest)	Explicit	Expected	Explicit	Explicit
24/7 monitoring / logging (SOC, MDR)	Explicit	Expected	Explicit	Expected
Written security policy / plan	Explicit	Explicit	Explicit	Explicit (the WISP itself)
Staff security training	Explicit	Explicit	Explicit	Explicit
Vendor oversight (BAAs, service-provider agreements)	Sometimes asked	Explicit (BAA)	Explicit	Explicit
Breach notification procedure	Explicit	Explicit	Card-brand rules apply	Explicit (2024 amendment)

Where the Evidence Comes From

An auditor, insurer or client rarely wants a promise; they want a screenshot, a log, or a signed report. That's what One-Click Compliance reporting through Bay Geeks SOC produces on a schedule, mapped to HIPAA, PCI DSS and NIST, so the evidence already exists instead of getting assembled the week before someone asks for it.

FIXED ✓

Not Sure Which Framework Applies to You?

Tell us what you're being asked to prove, whether that's a client's insurance form, a new client's due-diligence questionnaire, or an auditor's checklist, and we'll point you to the right controls and the right evidence.

Start With Cyber Insurance One-Click Compliance Compare All Plans

Frequently Asked Questions

Do I need a different security setup for each framework?

No. MFA, EDR, tested backups, patching, access control, encryption, monitoring and a written policy satisfy most of what cyber insurance, HIPAA, PCI DSS and GLBA each ask about. The paperwork differs; the underlying network mostly doesn't.

Which page applies to my business?

If you're renewing or applying for cyber insurance, start with the questionnaire guide. If you handle patient data, card payments, or client financial records specifically, start with the matching industry page above; each links back to the framework it's built around.

Does having a SOC or maintenance plan mean I'm compliant?

It means the technical controls are in place and reported on, which is most of the work. Full compliance also includes your own written policies, employee acknowledgment, vendor agreements (like BAAs), and, for some frameworks, a named responsible person. We help with all of it, but a signature at the end is usually yours to give.

Do I still need cyber insurance if I meet HIPAA, PCI DSS or GLBA?

Yes. Those frameworks govern how you protect data; insurance pays for the forensics, legal work, notification costs and lost income after something still goes wrong. Meeting the frameworks makes coverage easier to get and usually cheaper, but it isn't a substitute for it.