Compliance posture · for regulated SMBs
Frame your SOC around the audits your customers, prime contractors, and regulators already ask for — not around a generic NIST checklist.
stwp.compliance / covered frameworks
CMMC
Cybersecurity Maturity Model Certification — Level 1 vs Level 2 readiness for defense subcontractors
PCI DSS 4.0
Payment Card Industry Data Security Standard — version 4.0
HIPAA
Health Insurance Portability & Accountability Act
State privacy
State consumer privacy laws — CA, CO, CT, VA
Why this page exists
When a healthcare practice bids on hospital contracts, when a defense sub primes a tier-1, when a law firm pitches enterprise clients, when a financial advisor stores non-public personal information — the buyer (or the regulator) asks for the same artifact: proof that someone was watching. That’s the SOC's job.
Framework · 1 of 4
Cybersecurity Maturity Model Certification — Level 1 vs Level 2 readiness for defense subcontractors
What the framework requires
How Straitwatch produces the audit artifacts
Detection logs → AU family (L2)
Every alert captured with timestamp, source, analyst disposition, and outcome — the AU-2 / AU-3 trail mapped 1:1 to what a C3PAO samples at the L2 assessment.
Incident records → IR / RA family (L2)
Containment, eradication, and lessons-learned entries per incident; root-cause evidence shipped as the running record the assessor reads, not assembled on the eve of the assessment.
Access evidence → AC family (L1 + L2)
Periodic access reviews, joiner/mover/leaver events, and privileged-account changes captured continuously and surfaced to the C3PAO on demand — the maturity evidence L2 demands and L1 still needs.
Response timelines → RA / IR evidence (L2)
Detection-to-containment timelines with the named analyst attached — closes the L2 maturity-evidence gap by proving controls are running, not just documented.
Framework · 2 of 4
Payment Card Industry Data Security Standard — version 4.0
What the framework requires
How Straitwatch produces the audit artifacts
Detection logs → Req 10 (logging & monitoring)
Continuous logging of all in-scope system components with daily review — Req 10's continuous-monitoring bar met, not sampled quarterly.
Access evidence → Req 7 & Req 8
Per-account access reviews, privileged-account inventories, and authentication-failure trends shipped in cadence with the assessor's review window.
Incident records → Req 12.10 incident response
When Req 12.10.1 fires, the plan executes with named roles, decision logs, and a post-incident review already in the SOC's records.
Response timelines → Req 12.10.5 evidence
Alerts-to-response timelines with alert severity, triage time, containment time, and resolution — the "lessons learned" Req 12.10.5 calls for.
Framework · 3 of 4
Health Insurance Portability & Accountability Act
What the framework requires
How Straitwatch produces the audit artifacts
Access logs → §164.312(a)
Per-user, per-resource access events flow into the SOC's log store and are searchable on demand by PHI-adjacent systems.
Audit controls → §164.312(b)
Every privileged action and every ePHI-touching service event is recorded; immutable retention makes the §164.312(b) audit-control claim provable.
Incident records → breach notification rule
When an incident touches ePHI, the record — scope, containment, notification decision — is already written, ready for the §164.404 disclosure clock.
Response timelines → OCR inquiry response
Detection-to-containment timelines with hand-off timestamps, formatted as the chronology an OCR investigator will ask for first.
Framework · 4 of 4
State consumer privacy laws — CA, CO, CT, VA
What the framework requires
How Straitwatch produces the audit artifacts
Access evidence → reasonable safeguards due-diligence
Proof that the safeguards the statute calls for were running when an incident happened — not a post-hoc policy relic.
Response timelines → breach-notification clock
Detection-to-confirmation timelines that anchor the state-specific notification deadlines, written before the AG's office asks.
Detection logs → reasonable-security evidence
The detection records, retention posture, and response cadence attributable to the period the AG is scrutinising.
Incident records → AG inquiry response
When the AG writes, the SOC already has the dated, named, attributable record of what happened, who responded, and what changed.
Tier coverage matrix
The four frameworks your auditors and prime contractors ask about, mapped against the three tiers Straitwatch ships. Pick the tier that matches the framework set you have to answer for.
| Framework | Essentials | Pro Most chosen | Defense |
|---|---|---|---|
| PCI DSS 4.0 — Req 10 monitoring + Req 12.10 IR | Annual posture report | Quarterly evidence pull | Continuous monitoring + audit artifacts |
| HIPAA — §164.312 safeguards + breach notification | Annual posture report | Quarterly evidence pull | Quarterly + on-demand breach pack |
| CMMC L1 vs L2 — NIST 800-171 maturity evidence | Not covered | Not covered | Audit-ready artifacts + named engagement lead |
| State privacy — CA / CO / CT / VA | On request | On request | On request + dedicated engagement lead |
CMMC, HIPAA, PCI DSS 4.0, or state privacy — name the compliance work your customers, prime contractors, or auditors are asking for now. We map Straitwatch against that list and tell you which tier already produces the artifact and which one closes the gap.