Security Architecture

Frameworks &
standards

Every Securafy service is built on a foundation of recognized security frameworks and industry standards. We don’t just reference NIST — we operationalize it. Here’s exactly how our services map to the frameworks that govern your industry and satisfy your auditors, insurers, and regulators.

Primary Framework

NIST Cybersecurity Framework 2.0

Released in February 2024, NIST CSF 2.0 is the gold standard for cybersecurity program management. Every Securafy service tier is mapped to one or more CSF 2.0 functions. Our COMPLY-CARE program delivers full implementation across all six.

🏛️
GOVERN
New in v2.0
Risk strategy, roles, policies, supply chain — board-level cybersecurity accountability
🔍
IDENTIFY
All Tiers
Asset inventory, risk assessments, business environment, and governance documentation
🛡
PROTECT
All Tiers
Access control, data security, awareness training, and protective technology
📡
DETECT
SECURE+
24/7 monitoring, anomaly detection, security event logging, and SOC triage
RESPOND
SECURE+
Response planning, containment, communications, and post-incident analysis
🔄
RECOVER
All Tiers
Recovery planning, backup testing, business continuity, and resilience improvements
Why CSF 2.0 alignment matters for businesses nationwide: NIST CSF alignment satisfies the Ohio Data Protection Act Safe Harbor requirement, satisfies cyber insurance carrier framework requirements, and is referenced in HIPAA, GLBA, CMMC, and CJIS guidance. It’s also the language your auditors, board, and regulators speak.
MSP Security Standard

CISA MSP Hardening Guidance

CISA published specific hardening guidance for MSPs recognizing that MSPs are high-value targets — a compromised MSP means access to all their clients. Securafy complies with every CISA MSP hardening requirement internally and operationally.

🔐 Authentication & Access

MFA enforced on all internal Securafy systems, all client-facing portals, and all remote access paths. Privileged access strictly managed and logged.

📈 Logging & Monitoring

Comprehensive logging of all Securafy internal and client-facing systems. Logs retained, reviewed, and correlated. Audit trail available for all privileged actions.

🔌 Principle of Least Privilege

No employee has more access than required for their role. Access reviews quarterly. Segmentation between client environments prevents cross-client exposure.

🛡 Hardened Internal Systems

Securafy’s own infrastructure follows the same standards we enforce for clients — Zero Trust, EDR, vulnerability management, and security awareness training.

📄 Documented Incident Response

Written, tested Securafy IR plan for responding to security events affecting our own infrastructure or supply chain. CISA-aligned notification procedures.

👥 Workforce Security Training

All Securafy staff complete security awareness training, phishing simulations, and role-specific technical training. Tracked and documented.

Complete Framework Coverage

Every Framework Your Industry Requires

Securafy’s service catalog covers all major compliance frameworks. Our COMPLY-CARE tier is purpose-built for regulated industries — delivering the controls, documentation, and audit support each framework requires.

📋
NIST SP 800-171 & CMMC 2.0
DoD / NIST

110-practice framework governing protection of Controlled Unclassified Information (CUI) for defense contractors and manufacturers. CMMC 2.0 now required in DoD contracts.

ManufacturingDefenseCUI
How Securafy delivers: SSP development, gap assessment, all 110 practices implemented, C3PAO preparation, POA&M management, ongoing control maintenance.
🏢
HIPAA Security Rule
HHS / OCR

Administrative, physical, and technical safeguards for electronic Protected Health Information. Updated 2024 rules add mandatory MFA, encryption, and 72-hour breach notification.

HealthcareePHIBAA
How Securafy delivers: Annual risk analysis, technical safeguards, BAA execution, workforce training, breach response, and OCR audit documentation.
🏦
GLBA Safeguards Rule & FFIEC CAT
FTC / FFIEC

2023 Safeguards Rule mandates MFA, encryption, pen testing, and an annual board report for financial institutions. FFIEC CAT governs bank examinations across 5 maturity domains.

BankingFinanceExaminer-Ready
How Securafy delivers: Full Safeguards Rule program, FFIEC CAT assessment, examiner preparation, vCISO qualified individual support, annual board reporting.
🚪
CJIS Security Policy v5.9.5
FBI / LEADS

All 14 policy areas governing access to criminal justice information (CJI) for law enforcement agencies and their IT vendors. Securafy signs MCAs with all LE clients.

Law EnforcementMCALEADS
How Securafy delivers: Full 14-area compliance, Advanced Authentication, CJIS-compliant cloud, MDM, training, MCAs, and LEADS audit readiness.
💳
PCI DSS v4.0
PCI SSC

12-requirement standard for cardholder data protection. v4.0 is now the only valid version (since March 2024), with expanded MFA requirements and new anti-phishing controls.

MerchantsPaymentsCDE
How Securafy delivers: CDE scoping, network segmentation, SAQ support, quarterly ASV scans, annual pen testing, continuous monitoring.
⚔️
Ohio Safe Harbor Act (ORC §1354)
State of Ohio

Ohio’s Data Protection Act provides an affirmative defense against data breach lawsuits for businesses with a qualifying cybersecurity program aligned to a recognized framework.

All BusinessesLegal Defense
How Securafy delivers: Framework selection, written program documentation, personal information inventory, evidence maintenance, vendor security requirements.
📊
CIS Controls v8
Center for Internet Security

18 prioritized security controls providing a practical, prescriptive roadmap from basic cyber hygiene to advanced security operations. Also qualifies for Ohio Safe Harbor.

All IndustriesPrescriptive
How Securafy delivers: Full CIS Controls v8 implementation across IG1, IG2, and IG3, mapped to your specific risk profile and industry obligations.
📋
SOC 2 Type II Readiness
AICPA

Trust Service Criteria for technology companies, SaaS providers, and service organizations. SOC 2 Type II is increasingly required by enterprise clients and investors.

SaaSTech CompaniesMSPs
How Securafy delivers: Readiness assessment, policy development, Common Criteria implementation, evidence collection, auditor liaison support.
🛡
Cyber Insurance Readiness
Insurance Carriers / Underwriters

Cyber insurers now require documented controls — MFA, EDR, tested backups, and a written incident response plan — before issuing or renewing coverage. Missing controls mean denied claims or no policy at all.

All IndustriesRenewal-ReadyClaims-Defensible
How Securafy delivers: MFA enforcement, EDR deployment, tested isolated backups, written IRP, annual 3rd-party assessment, and documented evidence packages your carrier accepts.
Learn More →
Service Tier Mapping

Which Frameworks Are Covered by Each Tier

Our service tiers are purpose-built to match your compliance obligations. Every regulated industry has the right tier available.

FrameworkPrimary IndustryMinimum TierFull Coverage Tier
NIST CSF 2.0All industriesESSENTIAL-CARE (PROTECT, RECOVER)COMPLY-CARE (all 6 functions)
CIS Controls v8All industriesESSENTIAL-CARE (IG1)COMPLY-CARE (IG1+IG2+IG3)
HIPAA Security RuleHealthcare / Business AssociatesSECURE-CARECOMPLY-CARE
GLBA Safeguards RuleBanking / FinanceSECURE-CARECOMPLY-CARE
FFIEC CATBanks / Credit UnionsSECURE-CARECOMPLY-CARE
CMMC 2.0 Level 1Defense Contractors (FCI)SECURE-CARECOMPLY-CARE
CMMC 2.0 Level 2Defense Contractors (CUI)COMPLY-CARECOMPLY-CARE
CJIS Security PolicyLaw EnforcementCOMPLY-CARECOMPLY-CARE
PCI DSS v4.0Merchants / Payment ProcessorsSECURE-CARECOMPLY-CARE
Ohio Safe Harbor (ORC §1354)All BusinessesESSENTIAL-CARE (basic program)COMPLY-CARE (full documentation)
SOC 2 Type IISaaS / Tech / Service ProvidersSECURE-CARECOMPLY-CARE
Cyber Insurance ReadinessAll IndustriesSECURE-CARECOMPLY-CARE

Your Industry Has A
Framework. We Know IT.

Securafy speaks the language of your auditors, examiners, and regulators. Our team includes CISSP, CISM, CMMC-AB, and CISA certified professionals who live and breathe these frameworks for Columbus and Cleveland, our clients.

Free Compliance Assessment COMPLY-CARE Services
📍 Columbus & Cleveland, Ohio

FREE · 30 MINUTES · NO SALES PITCH

See Exactly Where You're Exposed.
Before an Attacker Does.

Our free 47-point network and security assessment gives you a prioritised remediation report in plain language — no obligation, no upsell.

Book a Free Strategy Call → 📞 (330) 906-8888

★ Soteria Award — Most Trusted MSP in North America 2024  ·  30-Day Risk-Free Trial  ·  10-Minute Response Guarantee