Compliance Services

The Financial Industry Regulatory Authority Act regulates and protects participants in the financial industry. It governs cybersecurity and technology oversight, record keeping, communications, and financial management.

The Sarbanes-Oxley Act places responsibility on public companies to be transparent in financial reporting to prevent fraud. Companies are responsible for providing reports measuring internal control processes.

The International Standards Organization is an independent international organization made up of member bodies that share knowledge and develop consensus-based standards in different industries. At Compitav, we help you conform to the relevant ISO standards in your sector so that you can obtain certification from ISO.

The General Data Protection Regulation unifies data privacy laws in countries within the European Union. It imposes penalties for non-compliance by any business that collects the personal data of citizens of the EU. We help our clients understand the implication of this Act on their operations.

The California Consumer Privacy Act (CCPA) is meant to give more power to consumers in California to know what kind of data businesses are collecting on them. The law guarantees them the right to delete or opt-out of the sale of personal information.

Payment Card Industry Data Security Standard (PCI DSS:) These are sets of standards developed by Visa, MasterCard, American Express, Discover Financial Services, and JCB International. These influential brands are heavily invested in ensuring the safety of customer information to prevent data and theft. Though not legally enforceable, PCI certification is regarded as the best way to provide assurance on the safety of sensitive customer information and helps build trust with your customers.

NIST is a U.S. government agency that develops standards and measurements across multiple industries. Its mission is mainly to support innovation and industrial competitiveness. The guidelines developed by NIST help organizations build technology that can scale to an industrial level.

FedRAMP essentially provides guidance on the adoption and use of cloud services by federal government agencies. It heavily emphasizes security and protection of information. We help businesses that are FedRAMP stakeholders understand the provisions of the guidelines provided.

This Act concerns financial products and service providers. It imposes responsibility on companies to disclose their information-sharing practices to their customers and also requires measurement initiatives to ensure information security.

Service Organization Control 1 & 2 provide guidance for financial information reporting and handling. Specifically, SOC 2 gives a framework for reporting cloud and data center security controls. At Compitav, we unpack the complexities of these frameworks and help your company to prepare proper SOC 1 and 2 reports.

The Personal Information Protection and Electronic Documents Act is a law that was passed in Canada originally in 2000 but has since been revised, most recently in 2019. It requires that organizations obtaining personal information obtain an individual’s consent when collecting, using, and disclosing such information to third parties.