What is the difference between HIPAA and SOC 2?

HIPAA is federal law that governs how covered entities and business associates protect patient health information. SOC 2 is a voluntary audit framework built on the Trust Services Criteria that shows how a service organization secures customer data. One is a legal obligation tied to health data; the other is a trust signal your customers and prospects ask for.

Does my company need SOC 2 if we handle no card data?

Card data points you toward PCI DSS, not SOC 2. SOC 2 is about how you protect the systems and data your customers entrust to you, regardless of payments. If you run software or services for other businesses, customers will ask for a SOC 2 report during procurement. We help you scope it and build controls that hold up.

How long does a SOC 2 readiness assessment take?

It depends on how much of the groundwork already exists: documented policies, working controls, monitoring, and evidence practices. A company with mature operations may be close to ready; one starting from informal habits needs time to build and demonstrate controls before an auditor will accept them. We assess where you stand first, then sequence the work so nothing is rushed.

Do you support both Denver and Houston?

Yes. Class IV serves Denver and Houston as its primary markets, with fractional CISO leadership and compliance programs delivered in both. The same accountable model applies: one partner runs your technology and owns your compliance posture, with on-site work in either city when the engagement calls for it, and remote delivery nationwide where it fits.

Compliance & Governance

HIPAA, SOC 2, PCI DSS & CMMC compliance, executed

Updated September 2026

Compliance frameworks fail mid-market companies for one reason: they are treated as documents instead of operating systems. Class IV runs HIPAA, SOC 2, PCI DSS, and CMMC programs as part of your IT operations - controls that are implemented, evidenced, and maintained, not policies that sit in a shared drive. Our fractional CISO works alongside our managed services team, so the same partner that runs your technology is accountable for keeping it compliant. For companies in Denver and Houston with 30 to 100 employees, that means audit readiness is a standing condition, not a fire drill. You get named-framework expertise, evidence artifacts your auditor will accept, and executive ownership of the entire program - without hiring a full-time compliance team.

HIPAA compliance for healthcare and covered data

HIPAA applies two ways: as a covered entity handling protected health information directly, and as a business associate handling it on a covered entity's behalf. Both roles carry the same core burden, and most mid-market companies touch healthcare data without calling themselves healthcare companies. The work starts with a security risk analysis that reflects how your systems actually operate, then builds administrative, physical, and technical safeguards on top of it. Policies matter only when they describe controls that run every day. Executive-level ownership means someone senior owns the risk analysis, signs off on safeguards, and can answer for the program when an inquiry or a partner's due diligence arrives. We put that ownership in place and keep the underlying systems, access controls, and backups doing their part.

Read the full HIPAA compliance guide

SOC 2 readiness and sustained compliance

SOC 2 is built on the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. In practice, most mid-market companies scope a report around security plus the criteria their customers actually ask about. The work moves from a readiness assessment, where gaps between current operations and the criteria are identified, through a review period where controls operate and generate evidence, to the report itself. The report is a snapshot; the controls are the program. Prospects and partners increasingly ask about your security posture before they will sign, and that value erodes the moment controls slip after issuance. We keep the controls operating as part of managed services, so the next report is easier than the last one and the answers you give customers stay true.

Read the full SOC 2 readiness guide

PCI DSS scope reduction and validation

PCI DSS governs how cardholder data is stored, processed, and transmitted. The most effective compliance move available to a mid-market company is shrinking the cardholder data environment: fewer systems that touch card data means fewer requirements, less evidence, and a smaller blast radius when something goes wrong. Scoping starts by mapping where card data actually flows, then engineering it down, often through segmentation or removing card data from systems that never needed it. From there, validation follows the cadence your acquiring bank or processor sets, backed by evidence gathered from systems that are monitored and maintained as part of normal operations. We handle the scoping, the technical controls, and the evidence, so validation reflects reality rather than a scramble.

Read the full PCI DSS compliance guide

CMMC and NIST 800-171 for defense-adjacent companies

CMMC applies to companies that want to win or keep Department of Defense work, built on NIST 800-171 for Level 2 and a smaller set of foundational practices for Level 1. The Defense Department's pause on new CMMC requirements slowed contract rollouts, but it did not touch the obligations underneath: DFARS 252.204-7020 still requires NIST 800-171 implementation, and SPRS scoring still feeds how your company is evaluated for contract awards. SPRS scores come from a self-assessment against NIST 800-171, and the gap between a weak score and a competitive one is real, unimplemented controls. We run the gap assessment, close the technical findings through managed services, and keep the scoring and documentation current, so defense-adjacent companies can bid without wondering whether their paperwork is honest.

Read the full CMMC and NIST 800-171 guide

Which framework applies to you?

Compliance framework comparison
Framework	Who typically needs it	Core obligation	What Class IV does
HIPAA	Healthcare providers, practices, and business associates handling protected health information	Protect PHI through a security risk analysis and working safeguards	Runs the risk analysis, implements safeguards, and owns the program alongside managed services
SOC 2	Software, SaaS, and service companies whose customers ask for security assurance	Operate controls that meet the Trust Services Criteria and evidence them	Takes you from readiness through the report, then keeps controls operating day to day
PCI DSS	Any company that stores, processes, or transmits card payments	Secure and validate the cardholder data environment	Scopes the environment down, implements the controls, and manages validation evidence
CMMC / NIST 800-171	Defense-adjacent companies pursuing or holding Department of Defense contracts	Implement NIST 800-171 and maintain SPRS scoring under DFARS 252.204-7020	Runs the gap assessment, closes findings, and keeps scoring and documentation current

One partner from gap to audit

Compliance programs stall when the company that advises on controls is not the company that runs the systems. At Class IV, the same team that monitors, patches, and supports your environment implements the controls and collects the evidence, so the audit reflects how your technology actually runs. If leadership capacity or IT direction is the gap, the 10-day Stabilization Sprint is the entry point: it turns IT and security ambiguity into a prioritized plan with compliance built in. From there, your fractional CISO and the managed services team keep readiness standing.

Frequently asked questions

What is the difference between HIPAA and SOC 2?: HIPAA is federal law that governs how covered entities and business associates protect patient health information. SOC 2 is a voluntary audit framework built on the Trust Services Criteria that shows how a service organization secures customer data. One is a legal obligation tied to health data; the other is a trust signal your customers and prospects ask for.
Does my company need SOC 2 if we handle no card data?: Card data points you toward PCI DSS, not SOC 2. SOC 2 is about how you protect the systems and data your customers entrust to you, regardless of payments. If you run software or services for other businesses, customers will ask for a SOC 2 report during procurement. We help you scope it and build controls that hold up.
What did the CMMC pause actually change?: The Defense Department pause slowed when CMMC requirements appear in new contracts, but it changed nothing about the underlying obligations. DFARS 252.204-7020 still requires NIST 800-171 implementation, and SPRS scoring still applies to covered contracts. Companies that waited out the pause face the same work on a shorter runway. We treat it as a current obligation, not a future one.
How long does a SOC 2 readiness assessment take?: It depends on how much of the groundwork already exists: documented policies, working controls, monitoring, and evidence practices. A company with mature operations may be close to ready; one starting from informal habits needs time to build and demonstrate controls before an auditor will accept them. We assess where you stand first, then sequence the work so nothing is rushed.
Do you support both Denver and Houston?: Yes. Class IV serves Denver and Houston as its primary markets, with fractional CISO leadership and compliance programs delivered in both. The same accountable model applies: one partner runs your technology and owns your compliance posture, with on-site work in either city when the engagement calls for it, and remote delivery nationwide where it fits.