Your local cybersecurity and IT partner for Puget Sound small businesses. We secure email, help with cyber-insurance questionnaires and run HIPAA risk assessments. You deal with a real person, not a call center. Ongoing protection or one-off projects. No long contracts.
// What we do
Choose ongoing protection or one-off projects. Every engagement is scoped to your business.
Email is where fake invoices and stolen passwords show up. We secure Microsoft 365 and Google Workspace so a password is not the only lock on your business email.
Plain-English help with cyber-insurance questionnaires and HIPAA security risk assessments, including for small medical and dental practices. A risk assessment does not certify or guarantee HIPAA compliance, and it is not legal advice. Coverage and pricing decisions are made by your insurer.
We look for the gaps in your IT, rank them by risk, and hand you a remediation roadmap you can act on.
SIEM monitoring and response, so a person reviews alerts on your environment during the hours in your service agreement, without you hiring a security team.
Review and tighten AWS, Azure and Google Cloud with least-privilege IAM, network segmentation, posture management and data protection policies.
Gap analysis, policy development and readiness work for the frameworks your customers, insurers and regulators ask about. Readiness work only: we do not certify you or perform your compliance audit.
When something goes wrong, we help contain the problem, preserve forensic evidence and guide recovery. Response times are set in your service agreement.
Phishing simulations and role-based training help your team spot a suspicious email and report it.
Put AI to work. Keep client data where it belongs. We review how your team uses AI tools, model the risks in the AI systems you build, and set guardrails for what goes in.
// Why Cybearr
A local partner for small businesses across the South Sound and Puget Sound. Plain English, clear priorities and a next step every time.
// Frameworks & standards
Whether you're a healthcare practice under HIPAA, a SaaS company preparing for SOC 2, or a small DoD contractor working toward CMMC, we help you find the gaps and fix them. Cybearr is not a CPA firm, a C3PAO or a HIPAA-certifying body.
NIST CSF 2.0 organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. We map your current controls to the framework and build a prioritized improvement plan.
The Department of Defense's cybersecurity requirement for contractors that handle federal contract information or controlled unclassified information (CUI). Level 2 is based on NIST SP 800-171 Revision 2. This is readiness work. It is not an official CMMC assessment, and it does not certify or guarantee a result.
Customers and partners sometimes ask for a SOC 2 report. We guide you through the AICPA Trust Services Criteria and help you get ready for an examination by a licensed CPA firm, which issues the report. Cybearr does not issue SOC 2 reports.
The international standard for managing information security. We advise on risk assessments, policy development and audit preparation. Certification is issued by an accredited certification body, not by Cybearr.
Advisory for cloud providers preparing for federal authorization, including documentation and control implementation guidance. Cybearr is not a FedRAMP 3PAO and does not grant authorization.
Security risk assessments, Security Rule gap assessments and technical safeguard help for small medical and dental practices and other covered entities and business associates. A risk assessment does not certify or guarantee HIPAA compliance, and it is not legal advice.
// How it works
Engagements are structured and transparent. You'll know what's happening at every stage and what you get out of it.
A 30-minute conversation about your environment, your business and what you're trying to protect.
Hands-on review of your network, cloud setup, endpoints and security controls against the standards that matter to you. We look for gaps so you can fix them first.
Prioritized implementation of controls, tooling, policies and configurations, with full documentation and knowledge transfer.
Optional. Monitoring and regular reviews on an agreed schedule. Prefer a one-off project? Stop after step 3.
# sample company, 44 accounts, 3 admins MFA enforced ........ 41/44 Legacy auth ......... enabled Backups last tested . 14 months ago DMARC policy ........ enforced # 3 findings, ranked in the written report $ _
// Where to start
Attackers often go after whatever is easiest to reach, whatever the size of the business. The useful question is which gaps you have and which to fix first.
// How we engage
Security isn't one-size-fits-all. We scope every engagement around your environment, risk profile and business goals, so you only pay for what you need.
Point-in-time engagements scoped to a specific need: a vulnerability assessment, compliance gap analysis, cloud security review or incident investigation. Delivered with a clear report and remediation roadmap.
For organizations that want a steady partner: monitoring, recurring assessments, compliance support, vCISO leadership and someone who knows your environment. No long contracts.
Ongoing security leadership as your virtual CISO (vCISO): a plan, policies and priorities for your security program, without hiring a full-time executive.
// Common questions
Quick answers to what people ask before reaching out. If your question isn't here, email contact@cybearr.com.
// Get started
Reach out and we'll set up a 30-minute conversation about your environment, your risks and where Cybearr can help.
// Get in touch
Fill out the form and we'll follow up to set up a conversation about your environment and how we can help.