Regulatory Compliance for Regulated Industries
The question came in.
Now you need an answer.
The Compliance Snapshot is a 5-minute scoping tool that maps which frameworks apply. The Compliance Risk Diagnostic that follows is where you find out where you really stand — with a detailed report, no cost, no obligation.
We’ve Done This Work In
35+ Healthcare Practices
HIPAA-compliant managed IT, examination readiness, and post-2026 Security Rule alignment.
28 Credit Unions
NCUA examination prep, FFIEC CAT documentation, ACET readiness across NC, GA, AL, FL, SC, LA, VA.
CMMC L2 Certified
DQ itself passed the 110-control NIST 800-171 audit. We’ve done what we ask our defense clients to do.
256 Clients · 25+ Years
In business since 1999. MSP 501 #210. Spire Capital-backed. SOC 1/2 II, HIPAA, CJIS, ITAR.
What’s Changed in the Last 12 Months
Four shifts worth knowing about before your next renewal.
The enforcement, insurance, and client-questionnaire landscape moved meaningfully in 2025.
None of this is theoretical. Here’s what we’re seeing in the market, with sources:
$51,744
FTC Safeguards Rule penalty ceiling
The dollar figure matters less than what it signals: the FTC has shifted from publishing guidance to enforcing it. Non-bank financial institutions — CPA firms, tax preparers, financial advisors, mortgage brokers, RIAs — are now expected to document their information security program, not just have one. The standard is “can you show your work,” not “did you intend to comply.”
Source: FTC, 2024 inflation-adjusted civil penalty ceiling
15–20%
forecast cyber insurance premium movement in 2026
After two years of softening rates, S&P Global is projecting market-wide premium growth of 15–20% in 2026. The driver is loss experience — a 126% rise in ransomware incidents and an 800% jump in credential theft during Q1 2025. The good news: firms with documented, mature controls are seeing meaningfully better outcomes than the market average. Posture and proof now matter more than they used to.
Source: S&P Global Ratings, 2026 Cyber Insurance Outlook
99%
of cyber insurance applications now ask specific MFA questions
A few years ago, underwriters asked “do you have MFA?” Now they ask “where is it enforced, who’s exempted, and can you produce the coverage report?” The bar moved from policy to evidence. Per Marsh McLennan, about 41% of applications come back for revisions on first submission — usually because the documentation wasn’t ready, not because the controls weren’t there.
Source: Marsh McLennan Cyber Insurance Market Report 2025
Q1–Q2
when most cyber insurance renewals fall
Most renewals concentrate in the first half of the year. The shift to evidence-based underwriting means brokers are recommending a 60–90 day pre-submission window for documentation prep — MFA coverage reports, EDR agent health, IR tabletop documentation, backup test logs. Firms that plan for that window tend to have a smoother renewal conversation.
Source: Aon 2026 Cyber Market Report
The pattern across all four: compliance isn’t being asked about — it’s being verified. The shift from “do you have these controls?” to “can you show they were running on the day in question?” is the most consequential change in regulated-industry IT in the last few years. The Compliance Snapshot below is where we usually start when a client wants to map their picture against this new bar.
“From an IT leadership perspective, this was one of the more valuable engagements we’ve done. They connected the dots between our technical controls and the actual compliance requirements — CISv8, FTC Safeguards, and state regulations. The process was detailed without being overwhelming. They validated what we were doing well, identified gaps, and helped us translate everything into policies and procedures that auditors and regulators will actually understand. It’s rare to find a team that can operate at both the technical and compliance level this effectively.”
Director of Technology
Who We Serve
If your industry is regulated, we’ve been here before.
Dynamic Quest specializes in heavily regulated industries — not as a marketing claim, but as a delivery practice with proof points in each one.
CPA & Tax
A top 25 NC CPA firm moved off Rightworks onto Azure VDI with DQ. We’ve done that migration. We know the path.
FTC Safeguards · IRS 4557 · GLBA · State data laws
Healthcare
35+ healthcare practices
across the Southeast and beyond. After the 2026 HIPAA Security Rule update, we added formal HIPAA compliance management
as a named service.
HIPAA Security & Privacy · HITECH · State health data laws
Credit Unions
28 credit union clients
across NC, GA, AL, FL, SC, LA,
VA — one of the densest CU concentrations of any regional MSP. NCUA examination prep, FFIEC CAT, ACET, all in production.
NCUA · FFIEC · GLBA · State CU regulations
Law Firms
Client-confidentiality- driven compliance work for regional firms. Outside counsel guidelines, ABA Formal Opinion 477R, and increasingly — state bar cybersecurity expectations.
ABA 477R/483 · State bar · Client OCGs · State data laws
RIA / Wealth Management
SEC Regulation S-P obligations, DOL fiduciary cybersecurity guidance, and the documentation your custodian and broker-dealer partners now expect at every annual review.
SEC Reg S-P · DOL Fiduciary · GLBA · FINRA
Manufacturing
18 manufacturing clients
anchored by a national packaging manufacturer
(27 plants across the US)
and a North American heavy-equipment subsidiary. Defense subcontractors are part of this mix; non-defense manufacturers face SOC 2 and customer-driven security requirements.
SOC 2 · ITAR · CMMC (defense subset) · Customer security questionnaires
Hospitality
Card payment processing, loyalty data, and franchise-level security requirements. PCI DSS 4.0 enforcement and card-brand attestation deadlines are the most immediate pressure points.
PCI DSS 4.0 · State data laws · Franchise security requirements
Defense Contractors
DQ is CMMC Level 2 certified
— we passed the same 110-control NIST 800-171 audit your DoD contracts now require.
For defense work, our SPRS Calculator and CMMC Readiness Assessment are
the right starting points.
Not seeing your industry? Compliance for accountants, attorneys, consultants, advisors, healthcare administrators, and operations leaders in many regulated businesses are often broadly similar at the framework level, so feel free to take the Compliance Snapshot. Or better yet, reach out to discuss your specific needs, and we can walk through and tailor the snapshot with you.
What kind of firm are you?
This determines the baseline compliance frameworks that apply to your business.
Your Compliance Snapshot
Personalized for your firm
Frameworks that likely apply to your firm
Based on your industry, services, size, and states. Your actual obligations depend on details only a deeper review can determine.
Knowing what applies is the easy part.
Most regulated firms aren’t failing compliance because they don’t know which rules apply. They’re failing because they don’t know where they actually stand against those rules.
- 1Where your existing policies fall short. You probably have a WISP, an IR plan, vendor contracts. Are they actually defensible against the frameworks above?
- 2Which controls you already have vs. need to build. Most firms are 40–70% of the way there. The question is which 30–60% is missing.
- 3Your specific exposure based on the data you actually handle. Two firms in the same industry can have very different obligations.
- 4What an auditor or insurer would actually find. A real review applies the lens regulators and underwriters use.
- 5How to prioritize when frameworks stack. If 5+ frameworks apply, the right order matters more than people think.
Get your Compliance Risk Diagnostic
The Snapshot mapped your surface area. The Compliance Risk Diagnostic tells you where you actually stand — a detailed written gap analysis, executive readout, and forwardable leadership summary. No charge. No obligation.
Request your 15-minute intro call →What We’ll Ask For
Eight documents. Most firms have some. That’s the point.
After the 15-minute intro call, we’ll ask for the eight documents below. Most firms only have three or four — and the ones they do have are usually of varying age and quality. That gap between what you have, what you don’t, and what’s actually current is the first thing the Diagnostic surfaces. You don’t need to have them all to start.
Employee Manual
How your firm operates day-to-day — the baseline against which security and compliance practices are evaluated.
Written Information Security Plan (WISP)
Required by FTC Safeguards, IRS 4557, and most state laws. Most firms have one — few have one that’s current and defensible.
Incident Response Plan
What happens when something goes wrong. Increasingly required by insurers and regulators; rarely tested.
Vendor Management Plan
How you assess and manage third-party risk — one of the fastest-growing exposure areas in regulated industries.
Cyber Insurance Policy
Your current policy and any application materials. Often reveals where your insurer expects you to be vs. where you actually are.
Latest Penetration Test
If you have one. Many firms haven’t had a pen test in 18+ months — or have never had one at all.
Current Cybersecurity Policies
Access Control, Encryption, BYOD, Acceptable Use, etc. Whatever you have, in whatever state it’s in.
Anything else you’d like reviewed
Audit findings, client questionnaires you couldn’t fully answer, prior consulting reports, regulator correspondence. If it’s relevant, we’ll review it.
That’s common — and exactly why the Diagnostic is worth doing. The pattern of what you have, what’s missing, and what’s outdated tells us more than any single document ever could. Many of our most useful engagements have started with firms who had only two or three documents to share.
Even better — but still worth a look. Documents written 2–3 years ago likely predate the 2025 FTC Safeguards amendments, the 2026 HIPAA Security Rule updates, NCUA’s ACET expectations, and the evidence-based shift in cyber insurance underwriting. The most common pattern we see in well-documented firms isn’t missing documents — it’s documents that are technically present but no longer aligned to current requirements. The Diagnostic is the fastest way to confirm what’s still current and what needs an update.
Where the Diagnostic Leads
The Diagnostic is the framework. This is what gets built from it.
Your readout deliverables — the gap analysis, executive deck, and leadership summary — name exactly which gaps need to close. From there, the work takes a clear shape: a fixed-price Managed Compliance project that builds a documented, defensible program, then Continuous Compliance to keep it current. Any technical gaps the readout surfaces are closed through DQ’s Managed IT, Cybersecurity, Cloud, and CMMC service lines. Everything is scoped and quoted against the specific findings in your readout — not against generic frameworks.
The Build · Managed Compliance
A fixed-price project — roughly 8 weeks, about one hour of your team’s time per week — that takes you from scattered documents to a compliance matrix at all greens: a documented, defensible program.
Risk & Security Foundation
Where every program starts
Your enterprise cyber risk assessment, business impact analysis, and security charter — the documents that anchor every downstream compliance decision.
- Enterprise Cyber Risk Assessment
- Business Impact Analysis (BIA)
- Security Charter
Compliance Policy Build
The documentation regulators ask for
Your Written Information Security Program (WISP), Incident Response Plan across six breach scenarios, vendor risk management, and SOP updates aligned to your frameworks.
- WISP (Written Information Security Program)
- Incident Response Plan — 6 scenarios
- Vendor Risk Management Plan
- 4 Standard Operating Procedure updates
Team Readiness & Training
Compliance only works if people execute
Executive briefings for leadership, employee security training, and a facilitated tabletop breach exercise so your team has actually rehearsed a real scenario before they need to.
- Executive Compliance Briefings
- Employee Security Training Program
- Facilitated Tabletop Breach Exercise
The project gets you to all greens. Then, because compliance done once decays
Ongoing · Continuous Compliance
The quarterly program that keeps you audit-ready.
A light, recurring program that keeps your documented posture current quarter after quarter — so your next insurance renewal, regulatory exam, or client questionnaire is a defensible submission, not a scramble.
- Quarterly governance & access-control reviews
- Incident-response tabletop & security awareness training
- Regulatory & framework change analysis
- Scheduled policy rotations & annual vendor review
- Leadership quarterly readout
- Dashboard, checklists & cyber-insurance documentation kept current
The Technical Side
When the readout surfaces IT and security gaps, we close them.
A real gap analysis almost always uncovers technical work that has to happen alongside policy and governance. Missing MFA. Outdated backups. Endpoint controls that don’t match the policy on paper. Identity gaps. Cloud misconfigurations. We don’t hand you a list and walk away — we quote and deliver the remediation through the same DQ service lines our 256 clients rely on every day.
Managed IT Services
Endpoint management, patching, helpdesk, infrastructure — the operational backbone of every compliance program.
Cybersecurity Services
24/7 SIEM/SOC, MDR, email defense, vulnerability management. The controls regulators and insurers actually want to see.
Cloud Services
Azure, Microsoft 365, AVD, backup & DR. Configured to your framework requirements, not generic defaults.
CMMC Services
Defense contractors specifically: SPRS scoring, NIST 800-171 readiness, C3PAO coordination. DQ is itself CMMC Level 2 certified.
“We’ve had a WISP in place for years, but going through this process showed us where we really stood. They didn’t just hand us a checklist—they walked through how our firm actually operates and aligned everything to IRS 4557, FTC Safeguards, and CIS in a way that made sense. What I appreciated most was how practical it was. Every policy, every recommendation tied back to something we’re doing day-to-day. At the end, we walked away not just with updated documents, but with real confidence that we’re compliant—and that we’ll stay that way”
Director of Technology
Compliance isn't getting easier.
Start where it's easiest.
Five minutes to see what applies. Then the Compliance Risk Diagnostic to see where you really stand. Both at no cost. No obligation. The clearest path to knowing.