Governance, Risk and Compliance (GRC) Services for IT and Physical Security

Governance, risk and compliance (GRC) is how an organization sets security direction, manages risk and proves it meets the laws, regulations, contracts and insurer requirements that apply to it. Governance covers policies, roles and reporting. Risk covers finding and ranking what could go wrong. Compliance covers meeting requirements and keeping the evidence.

Customers, insurers, regulators and auditors judge the whole organization, not only its IT. Contracts and renewals can depend on a security questionnaire, and many standards include physical requirements such as door access, video retention and visitor logs. That is why BTI treats GRC as a business program that covers IT and physical security together.

On the IT and data side, BTI helps with the HIPAA Security Rule, 42 CFR Part 2, CMMC and NIST SP 800-171, PCI DSS, SOC 2 readiness, NIST CSF, ISO 27001, the FTC Safeguards Rule and GLBA, FERPA, AWIA and cyber insurance requirements. On the physical side, BTI helps with HIPAA physical safeguards, 42 CFR Part 2 records security, CMMC physical protection, NDAA Section 889, California SB 553, CTPAT and TAPA, DEA controlled substance security and PCI DSS physical requirements.

A WISP is a written information security program: the document that describes your safeguards, who owns them and how they are reviewed. Some rules require one, such as the FTC Safeguards Rule for covered financial institutions, and many insurers and customers expect one. BTI writes or updates your WISP and the policies under it, and managed security clients receive one through Cyber Liability Essentials.

It covers your systems, data, users, vendors and facilities, measured against the standards that apply to you. Each gap is scored by likelihood and impact and recorded in a risk register with an owner and a due date. Because BTI handles IT and physical security, the assessment can include access control, cameras, visitor management and alarms alongside IT controls.

BTI helps you list the vendors who touch your data, systems or buildings, decide which ones matter most, and review them with questionnaires, contract requirements and evidence. The results go into your risk register and your vendor management policy, so vendor risk is tracked like any other risk.

No. BTI prepares you for audits and assessments by mapping controls, closing gaps and organizing evidence. Formal audits, SOC 2 reports and certifications are issued by independent firms. CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.

Many standards require controls on who can enter sensitive areas, how activity is recorded and how long records are kept. Access control reports, camera retention settings, visitor logs and alarm records become audit evidence. BTI is licensed under CA BSIS ACO 7670, IL 127.001638, AZ BTR 22913-0 and AZ ROC 331189 C-67, and installs and supports access control, cameras, visitor management and alarms, secured with your IT.

GRC is the hub: policies, risk register, vendor reviews and evidence across every standard that applies to you. Compliance management focuses on assessments, policies, controls and audit preparation for a specific framework. A vCISO is a named security leader who owns your roadmap, risk decisions and board reporting. Many clients use all three together.

Not always. BTI delivers GRC to managed, co-managed and select project clients. Most clients get it as part of fully managed IT, or alongside their internal IT team through co-managed IT, where their team keeps day-to-day control and BTI adds compliance, security and physical security expertise. Some organizations engage BTI for a defined project, such as a WISP, a risk assessment or audit readiness. A free consultation is the quickest way to see which model fits.

Start with a free consultation and pen test. We will ask which standards, contracts and insurer requirements apply to you and where you stand today, and the pen test shows how your systems hold up before you commit to anything. Pricing is scoped to the standards, locations and controls involved, so you get an itemized proposal rather than a one-size price.

BTI has local teams in Los Angeles and Southern California, Chicago and Chicagoland, and Phoenix and Tucson. Policy, risk and audit work can be done remotely, and our 24/7 NOC/SOC monitors wherever BTI supports you. Elsewhere in the U.S., BTI coordinates on-site help through partners.