IT Compliance Services in Chicago
An audit date, a customer security review or an insurer questionnaire has landed, and someone has to prove your controls work. BTI Communications Group's Chicago IT team, based in Downers Grove, finds the control gaps, fixes them, collects the evidence and stays with you through audit day. BTI started in Chicago in 1985. Over 40 years later, that same local team still prepares Chicagoland organizations for HIPAA, 42 CFR Part 2, PCI DSS, SOC 2 readiness, CMMC and NIST SP 800-171, Illinois BIPA and PIPA, and similar requirements.
- Gap assessment that maps your systems to the controls your auditor will test
- Remediation of the gaps: patching, MFA, logging, encryption, backups and access reviews
- An organized evidence binder, ready before the auditor or insurer asks
- Audit day support: walkthroughs, sample requests and follow-up findings
- Penetration testing and vulnerability scanning that back up your answers
Start with a free consultation and pen test, so you see real findings before any proposal.
Call the Chicago IT team at 312-492-2613.
- Over 40 years in business
- Started in Chicago in 1985
- 24/7 NOC/SOC
- ISO 27001 compliant
- GSA contract holder (47QTCA21D00BA)
- Axis certified Gold Solutions Partner
What IT compliance means
IT compliance is the proof that your controls work
IT compliance services turn a framework's requirements into working controls and the evidence to show them. For Chicago organizations, that work is often driven by an audit date, a hospital or payer questionnaire, a defense contract, or Illinois privacy rules such as BIPA and PIPA. It is narrower and more hands-on than a full governance program: one audit, one assessment or one customer requirement at a time, done properly.
An audit or assessment date is set
Your auditor, assessor or examiner has a date on the calendar and a list of controls to test. The evidence has to exist before they arrive.
A customer or contract asks for proof
Security questionnaires, vendor reviews and contract clauses ask for SOC 2 readiness, PCI DSS, CMMC or HIPAA answers. Weak answers stall sales and renewals.
Your insurer wants evidence
Cyber insurance applications ask about MFA, backups, patching and incident response. Answers that do not match reality can put a claim at risk.
The last audit left findings
Open findings and corrective action plans need owners, fixes and proof that the fix stuck.
If you need the program around it, such as a written information security program (WISP), a risk register, vendor risk reviews and leadership reporting, that is governance, risk and compliance (GRC). If your internal IT team owns the environment and needs hands to do the work, see co-managed IT security and compliance execution.
Frameworks
Compliance frameworks we prepare you for in Chicago
Most Chicagoland organizations answer to more than one. We map overlapping controls once, so one fix and one piece of evidence can satisfy several requirements, including Illinois-specific rules.
| Framework | Who it applies to | What auditors and assessors look for | Learn more |
|---|---|---|---|
| HIPAA Security Rule | Healthcare providers, medical groups, dental practices, behavioral health, health plans and their business associates | Risk analysis, access controls, audit logs, encryption, backups, business associate agreements and workforce training | What is HIPAA compliance |
| 42 CFR Part 2 | Programs that hold substance use disorder treatment records | Who can see Part 2 records, consent tracking, segmentation of records and breach procedures. The rule was updated in 2024 to align more closely with HIPAA. | Healthcare cybersecurity |
| PCI DSS 4.0 | Any business that stores, processes or transmits card data, including Chicago retailers, parking operators and venues | Network segmentation, MFA, logging and review, vulnerability scans, penetration tests and the right self-assessment questionnaire or report | What is PCI compliance |
| SOC 2 readiness | Service providers and SaaS companies whose customers ask for a SOC 2 report | Controls mapped to the Trust Services Criteria, policies, change management, access reviews and evidence collected over the audit period | What auditors want to see |
| CMMC and NIST SP 800-171 | Defense contractors and suppliers that handle controlled unclassified information (CUI) | The 110 NIST SP 800-171 requirements, a system security plan (SSP), a plan of action and milestones (POA&M) and an assessment score | What is CMMC |
| Illinois BIPA (740 ILCS 14) | Organizations that collect biometrics from Illinois residents, such as fingerprints or face geometry on timeclocks, door readers and sign-in tools | A written retention policy and written consent before collection. Public Act 103-0769, effective August 2, 2024, limits recovery to one per person. BTI flags biometric systems in scope so your counsel can review them. | Chicago IT projects and BIPA planning |
| Illinois PIPA (815 ILCS 530) | Organizations that hold personal information of Illinois residents | Breach notification duties, including notice to the Illinois Attorney General when a breach affects more than 500 Illinois residents. Controls and projects should keep the logs needed to scope a notice. | Chicago cybersecurity services |
| FTC Safeguards Rule (GLBA) | CPA and tax firms, insurance agencies, auto dealers and other financial firms the rule covers | A qualified individual, written risk assessment, MFA, encryption, monitoring and an incident response plan | Financial services cybersecurity |
| NIST CSF and ISO 27001 alignment | Organizations that want a recognized framework to measure against | A gap analysis against the framework and a prioritized roadmap | GRC services |
We also support SOX IT general controls, GDPR security requirements, ITIL-based service management, TAPA, CCPA and CPRA where they apply, and cyber insurance requirements. BTI prepares you for the audit; the audit itself is performed by an independent firm, such as a CPA firm for SOC 2, a QSA for PCI DSS or an authorized C3PAO for a CMMC Level 2 assessment. BTI is not a law firm and does not give legal advice. Regulatory summaries of BIPA and PIPA are for planning only. Sources: Illinois Biometric Information Privacy Act, 740 ILCS 14; Illinois SB 2979, Public Act 103-0769; Illinois Personal Information Protection Act, 815 ILCS 530/10.
CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
What we do
IT compliance services in Chicago, from gap to audit day
BTI does not stop at a gap report. The Downers Grove engineers who find a gap can close it, then collect the evidence that shows it is closed.
Gap assessment and control mapping
- Scope the systems, data and locations in play
- Map each control to how you meet it today
- A scored gap report with owners and dates
Remediation
- Patching and vulnerability fixes
- MFA, identity and device security
- Logging, encryption and secure configuration
- Backup and recovery that is tested
Evidence collection
- Screenshots, exports, logs and reports collected as controls run
- Policies and procedures tied to the control they support
- An evidence binder organized by framework
Penetration testing and vulnerability scanning
- Internal and external vulnerability scanning, monthly by default
- Quarterly penetration tests by default, or as your framework requires
- Penetration testing, starting with the free consultation and pen test
- See pen testing vs vulnerability scanning
Audit day support
- Pre-audit walkthrough and mock interviews
- Help answering auditor and assessor sample requests
- Technical staff on hand for system demonstrations
After the audit
- Corrective action plans for any findings
- Proof that each fix stuck
- Ongoing monitoring through our 24/7 NOC/SOC, so you are ready next year
Testing frequency varies by client requirement and compliance scope. By default, BTI recommends monthly vulnerability scans and quarterly penetration tests as part of its ongoing security monitoring program.
Audit preparation timeline
How audit preparation with BTI works
- ScopeWe confirm which frameworks, systems and locations are in scope and when the audit, assessment or renewal is due.
- AssessWe run the gap assessment and the pen test, and score each gap by audit risk and business impact.
- RemediateBTI and its partners close the gaps in priority order, starting with anything an auditor would flag as a finding.
- Collect evidenceEvidence is gathered as controls run and organized by framework, so nothing is assembled the night before.
- Audit dayWe walk through the evidence with your team, then stay on call for auditor questions and sample requests.
- Close findings and maintainAny findings get a corrective action plan, and monitoring keeps the controls working until the next cycle.
Timelines depend on the framework. A SOC 2 Type II report, for example, covers controls operating over a period of months, so evidence collection has to start well before the report date.
Evidence
The evidence auditors ask for, and where it comes from
Most audit findings are not missing tools. They are missing proof. When BTI runs the controls, the evidence comes out of daily operations at your Chicago sites and at the Downers Grove office that supports them.
| Control area | Typical evidence | BTI service that produces it |
|---|---|---|
| Access control | User access reviews, MFA enrollment reports, terminated user removals | Identity and device security |
| Vulnerability management | Scan reports, patch status, remediation tickets and dates | Managed patching and vulnerability management |
| Logging and monitoring | Log retention settings, alert reviews, incident tickets | Managed SIEM and MDR |
| Endpoint protection | Coverage reports and policy settings | Endpoint protection |
| Backup and recovery | Backup job reports and restore test results | Backup and disaster recovery |
| Security awareness | Training completion and phishing test results | Security awareness training |
| Policies and incident response | Approved policies, acknowledgments, an incident response plan and tabletop results | GRC services and Cyber Liability Essentials |
Further reading: what IT compliance auditors and assessors want to see and why siloed security fails compliance audits.
Proof
Compliance work built around real requirements
BTI completed a multi-campus security upgrade across the Valley for a Phoenix-area behavioral health and recovery provider, built around HIPAA and 42 CFR Part 2 requirements for protecting patient records.
Requirements first
The work started from what HIPAA and 42 CFR Part 2 require for protecting patient records, not from a product list.
Several sites, one standard
Every campus was brought to the same standard, so the evidence reads the same at each location.
Built to be shown
Controls were documented as they were put in place, so the organization can show its work to auditors and insurers.
Chicago and Chicagoland clients get the same approach from the Downers Grove team: requirements first, evidence collected as the work is done, and local engineers for the on-site walkthroughs that an auditor or insurer may ask to see.
Your cybersecurity roadmap
Six Steps From First Test to a Program You Can Prove
Most Chicago and Chicagoland clients start at step 1 with the free assessment and pen test. The findings tell you which of the next steps deserve your budget first, so you are not buying tools on a hunch.
Assess
Know where you stand with a tested baseline.
Prevent
Close the common ways in.
Detect and respond
Someone watching, day and night.
Govern and prove
Policies, evidence and leadership reporting.
Recover
Get back to work after an incident.
Run it with your team
Pick the support model that fits.
See the full program on the Chicagoland cybersecurity services page, or call the Chicago IT team at 312-492-2613.
Compliance Support by Industry
Chicago and Chicagoland organizations answer to different rules. Pick your industry to see how BTI brings IT, cybersecurity and physical security together for it.
-
Healthcare
HIPAA risk assessments, safeguards and audit evidence for medical groups, dental and behavioral health.
Healthcare technology solutions → -
Government & Public Sector
Documented security controls and audit support for city, county and agency IT and facilities.
Government technology solutions → -
Education
Student data privacy controls, policies and evidence for K-12 districts and colleges.
Education technology solutions → -
Manufacturing & Logistics
NIST aligned controls and supplier security questionnaires for plants, warehouses and 3PLs.
Manufacturing and logistics technology solutions → -
Financial Services
FTC Safeguards Rule programs, WISPs and evidence for CPA, tax, title and insurance firms.
Financial services technology solutions → -
Utilities & Critical Infrastructure
AWIA risk and resilience support and network segmentation for water utilities.
Utility and critical infrastructure technology → -
Construction
Payment fraud controls and cyber insurance evidence for contractors and builders.
Construction technology solutions → -
Nonprofits & Faith-Based
Donor data protection and PCI basics for churches, ministries and nonprofits.
Nonprofit and church technology solutions → -
Parking & Entertainment Venues
PCI scope reduction and LPR data protection for parking operators and venues.
Parking and venue technology solutions →
Why BTI
Why choose BTI for IT compliance in Chicago
- Over 40years in business
- 1985BTI started in Chicago
- 24/7NOC/SOC
Find it and fix it
The team that finds a control gap can close it, so you are not left holding a report and a to-do list.
A 24/7 NOC/SOC behind the evidence
Monitoring, alert review and incident response run around the clock, and the records become audit evidence.
Governance that holds up
BTI is ISO 27001 compliant and runs a 24/7 NOC/SOC. Cybersecurity services have been part of the practice since the 2010s.
A local Chicago team
Work is served from 1441 Branding Ave, Suite 200, in Downers Grove. BTI provides 4-hour onsite emergency response under BTI support agreements. Call 312-492-2613.
Specialists where needed
CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
Federal experience and partners
BTI is a GSA contract holder (47QTCA21D00BA) and an Axis certified Gold Solutions Partner. See BTI on GSA.
Local team
IT compliance services in Chicago and Chicagoland
Gap assessments, evidence and audit support can be done remotely. Local engineers from the Downers Grove office handle on-site walkthroughs and the remediation work that closes gaps.
BTI Communications Group, Ltd., Downers Grove
1441 Branding Ave, Suite 200
Downers Grove, IL 60515
The Chicago IT line is 312-492-2613.
Service planning for this page covers the city of Chicago, including the Loop, River North, the West Loop and Fulton Market, the Near South Side, the South and West Side industrial corridors and facilities near O'Hare and Midway. The same team covers DuPage County, the Northwest Suburbs, Lake County, the Fox Valley, Will County and Northwest Indiana.
Chicagoland cybersecurity hubs
See the program on the Chicago cybersecurity services page, plus nearby hubs for DuPage County, the Northwest Suburbs, Lake County, the Fox Valley, Will County and Northwest Indiana.
Other BTI offices
See IT compliance in Los Angeles or call the Los Angeles IT team at 323-510-8003. The Phoenix team covers the Phoenix metro area and Tucson. Call 480-272-8728. The national IT compliance page covers how the service works across all three metros.
Explore BTI in Chicago
- All BTI services in Chicago
- Managed IT services in Chicagoland
- IT project services in Chicago
- Managed AI automation in Chicago
- Outsourced IT support in Chicago
- On-site IT support in Chicago
- IT infrastructure services in Chicago
Elsewhere in the U.S., BTI coordinates on-site help through partners.
Questions
IT compliance services FAQs for Chicago
What are IT compliance services?
IT compliance services help an organization meet the security requirements of a law, regulation, contract or insurer and prove it. At BTI that means a gap assessment, fixing the control gaps, collecting the evidence and supporting you through the audit or assessment.
How is IT compliance different from GRC?
IT compliance is focused on a specific audit, assessment or requirement: the evidence, the control gaps and audit day. Governance, risk and compliance (GRC) is the ongoing program around it, including the written information security program, policies, risk register, vendor risk reviews and leadership reporting. Many clients start with one and add the other.
Which compliance frameworks does BTI help with in Chicago?
BTI helps Chicago and Chicagoland organizations with HIPAA, 42 CFR Part 2, PCI DSS, SOC 2 readiness, CMMC and NIST SP 800-171, Illinois BIPA and PIPA, the FTC Safeguards Rule, NIST CSF and ISO 27001 alignment, SOX IT general controls, CCPA and CPRA where they apply, and cyber insurance requirements.
Does BTI perform the audit or issue the SOC 2 report?
No. The audit is performed by an independent firm, such as a CPA firm for a SOC 2 report, a QSA for PCI DSS or an authorized C3PAO for a CMMC Level 2 assessment. BTI prepares you for it, fixes the gaps, organizes the evidence and supports your team on audit day.
What is included in the free consultation and pen test?
We review which frameworks, contracts and insurer requirements apply to you and where you stand today, and the pen test shows how your systems hold up before you commit to anything. You get real findings before any proposal.
How long does audit preparation take?
It depends on the framework, the number of systems and locations in scope and how many gaps the assessment finds. Start as early as you can. Some reports, such as a SOC 2 Type II, cover controls operating over a period of months, so evidence collection has to begin well before the report date.
What evidence do auditors ask for?
Auditors usually ask for user access reviews, MFA reports, patch and vulnerability scan reports, log and alert reviews, backup and restore tests, training records, approved policies and an incident response plan. When BTI runs those controls, the evidence is collected as part of daily operations.
Can BTI fix the gaps it finds?
Yes. BTI and its partners remediate the gaps, including patching, MFA and identity, logging and monitoring, encryption, endpoint protection, network security and backup, then collect the proof that each fix is in place.
Does BTI help with CMMC and NIST SP 800-171?
Yes. BTI helps defense contractors and suppliers with the NIST SP 800-171 requirements, a system security plan, a plan of action and milestones and assessment preparation. CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
Do we need to be a BTI managed IT client?
No. BTI provides IT compliance services to managed, co-managed and select project clients. If you have an internal IT team, BTI can work alongside it through co-managed security and compliance execution.
How do Illinois BIPA and PIPA affect IT compliance?
BIPA (740 ILCS 14) covers fingerprints and face geometry used by timeclocks, door readers and sign-in tools, and requires a written policy and consent. PIPA (815 ILCS 530) sets breach notification duties, including notice to the Illinois Attorney General when a breach affects more than 500 Illinois residents. BTI flags biometric systems and helps keep the logs a notice review would need. This is not legal advice.
Where is BTI's Chicago office, and which areas does the team cover?
BTI's Chicagoland office is at 1441 Branding Ave, Suite 200, Downers Grove, IL 60515. The Chicago IT line is 312-492-2613. The same team covers the city of Chicago, DuPage County, the Northwest Suburbs, Lake County, the Fox Valley, Will County and Northwest Indiana. Assessment, evidence and audit work can be done remotely, and elsewhere in the U.S. BTI coordinates on-site help through partners.
More answers on the IT compliance FAQs and GRC pages.
Get ready for your next audit
Book a free consultation and pen test with a BTI compliance specialist. We will look at which frameworks apply to your Chicago or Chicagoland organization, where the control gaps are and what evidence you will need.
Call the Chicago IT team at 312-492-2613.
Already a BTI client? Use the dedicated support number assigned to your organization.
Talk to a compliance specialist
Tell us where to reach you and a BTI specialist will follow up within business hours. Chicago and Chicagoland requests go to the Downers Grove team.
Business inquiries only. No cost and no obligation for the consultation and pen test. Call 312-492-2613.