IT Compliance and Security Readiness: The Complete Guide

Few schedule the first compliance request. It's more likely to show up in an inbox. A prime wants your SPRS score before the end of the month, or a German customer forwards an ENX portal link and asks when the TISAX label will be ready. Sometimes it's a hospital asking for your HIPAA risk analysis before it renews the business associate agreement, or a county IT director who needs to know that everyone with access to the records system has been fingerprinted.

The frameworks differ, but each of those emails is asking whether you can prove it.

That question sits at the center of IT compliance and security readiness. Plenty of organizations in Michigan and around the Great Lakes have decent security. What they often lack is the paper trail (policies, configuration exports, logs, signed reviews) that lets an outsider confirm the security exists and works the way the framework describes. Assessments tend to go wrong in that gap.

Patching is a good illustration. In its 2026 Data Breach Investigations Report, Verizon found organizations fully remediated just 26 percent of the vulnerabilities on CISA's Known Exploited Vulnerabilities list in 2025. The year before, the figure was 38 percent, and median time to full resolution grew from 32 days to 43. All four frameworks in this guide expect timely patching, and a year of clean patch records is harder to produce than most IT teams expect.

What follows covers what readiness means, how CMMC, HIPAA, CJIS, and TISAX compare, what assessors look at, and how to sequence the work so money goes to the gaps that count. Each framework gets an overview with enough detail to orient you; the deeper requirements of any one of them are a separate read.

1What Does IT Compliance and Security Readiness Mean?

IT compliance and security readiness mean two things at once: your environment meets the requirements of the frameworks you're bound by, and you can show that to someone with no reason to take your word for it.

The difference between being compliant and being ready is mostly about time. Compliance describes a moment (on the day someone checked, the requirement was met). Readiness describes whether you could pass the same check next month without dropping everything. A quick test: if an assessor asked this afternoon for user access reviews from the last two quarters, how long would it take to send them? An hour suggests readiness. A week of digging suggests the reviews may not exist.

Readiness is built in three layers

Readiness has three parts, and they stack. In practice, most of the budget goes to the middle layer, while assessors spend a large share of their time on the first and last.

2Compliance vs. Cybersecurity

Cybersecurity protects systems and data from real attackers. Compliance proves to a regulator, customer, or assessor that a defined list of requirements is met. The work overlaps a great deal, but the two fail in different ways.

Frameworks set a minimum, so passing an assessment won't stop a determined attacker. It works the other way, too. A capable security team can fail an assessment because no one documented how anything works. Organizations that handle cybersecurity compliance well run one program and report on it in two ways. A conditional access policy in Entra ID blocks a stolen password and also satisfies an MFA requirement, and the sign-in logs that prove it to an assessor are the same logs an analyst pulls during an investigation.

To go deeper into the security side, read Cybersecurity Services in Michigan: The Complete Guide, which covers monitoring, identity, and incident readiness. This one shows why a well-run managed cybersecurity program should generate compliance evidence as part of routine work instead of in an annual scramble.

3Who Needs Compliance Support?

If you store, process, or transmit regulated data, or sell to a company that does, you probably carry a cybersecurity compliance obligation already, whether or not anyone has asked about it. A contract clause, a customer questionnaire, or an incident is usually what brings it to the surface.

In Michigan and the surrounding states, it tends to fall into four types of organizations.

Defense manufacturers and their suppliers come first by volume. The Michigan Economic Development Corporation counts more than 4,000 defense suppliers in the state, part of a $30 billion defense economy, and a good share of those shops also quote automotive work. That overlap is how a single Macomb County plant can end up working on CMMC and TISAX in the same quarter.

Automotive suppliers to European OEMs are the second group. Handling confidential design data, prototype parts, or production schedules for a European automaker usually means a TISAX request before the next program award.

Third are healthcare providers (hospitals, physician groups, clinics) and the business associates that handle their data. HIPAA applies to all of them, along with some organizations that don't consider themselves healthcare at all.

The fourth group is anyone who touches criminal justice information. That includes police and sheriff's departments, dispatch centers, courts, the IT providers and software vendors that support them, and noncriminal justice agencies such as school districts that receive fingerprint-based background check results. All of them work under the CJIS Security Policy.

Healthcare catches manufacturers off guard more than any other category. In June 2026, HHS's Office for Civil Rights settled with the employer-sponsored health plan of Spencer Gifts, a national retailer, for $450,000. A ransomware attack had put information on 10,023 people at risk, and OCR's central finding was that the plan had never done an accurate and thorough risk analysis. A self-insured group health plan can be a HIPAA-covered entity on its own, even when the company sponsoring it makes brackets.

Which frameworks are likely to apply

Use this as a starting point, not a legal determination.

If more than one applies, build one control set and map it to each framework so evidence is collected once.

Other regulated industries answer to their own rules, and the readiness steps in this guide carry over. Banks, credit unions, and investment advisers work under GLBA, SEC Regulation S-P, and NCUA rules, covered on our financial services page. Accounting and tax firms often fall under the FTC Safeguards Rule, and law firms have their own duty to protect client data; see professional services. Contractors on defense projects can pick up CMMC through their contracts, which our construction page covers.

One trigger has nothing to do with a framework. Cyber insurers now ask for proof of many of the same controls at renewal, and Cyber Insurance Requirements: A Michigan Renewal Guide covers what underwriters check. Organizations in manufacturing and the defense supply chain and in healthcare and medical practices often face several of these pressures in the same year.

4CMMC, HIPAA, CJIS, and TISAX

The four frameworks protect different information for different authorities, yet they rest on a similar base of controls. Where they really diverge is who checks your work, how often, and what you get at the end.

CMMC compliance and what the Phase 2 pause changed

CMMC compliance covers defense contractors and subcontractors that handle FCI or CUI. The program rule, 32 CFR Part 170, sets three levels. Level 1 is 15 basic safeguarding requirements with an annual self-assessment, and no plan of action is allowed for anything left open. Level 2 is the 110 requirements in NIST SP 800-171 Rev. 2, assessed either by the contractor itself or by a CMMC Third-Party Assessment Organization (C3PAO), depending on the contract. Level 3 adds 24 requirements from NIST SP 800-172, with the government's DIBCAC team doing the assessment.

Then the schedule changed. On July 13, 2026, the Department of War suspended the transition to Phase 2, which would have made C3PAO certification a standard condition of award. Under the department's implementing guidance, new solicitations should require only Level 1 or Level 2 self-assessments during the suspension, and third-party requirements are being removed from active solicitations, though the department can still require a C3PAO assessment case by case. DFARS 252.204-7012 is still in effect, and the department says it will keep enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. A reform task force is reviewing the program, so check the latest guidance before planning around any date.

None of that is a reason to shelve CMMC readiness work. The requirements are still in your contracts. A named senior official still signs the affirmation behind your SPRS score, and that affirmation is a representation to the government. Primes also set supplier requirements for their own reasons. With fewer outside assessments on the calendar, the self-assessment carries more of the load, so it needs to hold up if anyone looks closely.

1. 1
   December 2024. The program rule, 32 CFR Part 170, takes effect and sets Levels 1 through 3.
2. 2
   November 10, 2025. Phase 1 begins: Level 1 and Level 2 self-assessments appear in new awards.
3. 3
   July 13, 2026. Phase 2 is suspended, and third-party requirements start coming out of active solicitations.
4. 4
   Today. Self-assessments, SPRS scores, annual affirmations, and DFARS 7012 obligations all still apply.

HIPAA compliance

HIPAA compliance rests on the Security Rule's administrative, physical, and technical safeguards for ePHI, and above all on the risk analysis required at 45 CFR 164.308(a)(1)(ii)(A). No one issues a HIPAA certificate. An investigator wants to see a current risk analysis, a risk management plan that follows from it, written policies, training records, business associate agreements, and audit logs. Spencer Gifts was OCR's 14th enforcement action under its Risk Analysis Initiative, which says a lot about where an investigation starts.

In January 2025, HHS proposed a substantial rewrite of the Security Rule that would make many of today's flexible safeguards mandatory. An Alston & Bird review of the federal regulatory agenda puts final action at July 2027. Until then, the current rule is enforceable as written, and the delay doesn't buy any extra time on the basics.

CJIS compliance

CJIS compliance applies to anyone with access to criminal justice information. That covers a sheriff's office, and it also covers the outside provider that patches the sheriff's servers. The FBI's CJIS Security Policy reached version 6.1 in June 2026. It continues a modernization that reorganized the policy around NIST SP 800-53-style control families, with multi-factor authentication required for privileged and non-privileged accounts alike.

Some vendors advertise a "CJIS certification." The FBI doesn't issue one. Compliance comes from agreements, personnel screening, training, and audits by the state's CJIS Systems Agency, which in Michigan is the Michigan State Police. MSP audits agencies with direct CJIS access every three years and runs separate compliance reviews for noncriminal justice agencies. For vendors, CJIS mostly arrives through customers: fingerprinting for staff, a signed security addendum, and questions about where data is stored and who can get to it.

TISAX compliance

European automakers and their suppliers use TISAX to check each other's information security. The ENX Association runs it, using the VDA's Information Security Assessment (ISA) catalog. The TISAX Participant Handbook lays out three steps: register, get assessed by an ENX-approved audit provider, then share the result with your partner. At Assessment Level 2, the auditor checks your self-assessment for plausibility, reviews evidence, and interviews whoever is responsible for information security, usually by video call. Level 3 verifies everything and includes on-site work. The results are good for three years.

Your partner's requested assessment objective determines the level, and prototype parts or strictly confidential data both mean Level 3. Pick the wrong objective at registration, and you can spend months earning a label your customer never asked for. That's why TISAX compliance work should start with a conversation with the customer before anyone opens the questionnaire.

5What Does a Readiness Assessment Cover?

A readiness assessment checks your environment against the specific framework and level you'll be assessed on. The output is a list of what's missing, what's partly in place, and what exists but can't be proven yet. It works like a dress rehearsal, with the person running it working for you.

That makes it narrower than a general security review. The broader exercise, described in Cybersecurity Risk Assessment: What Yours Must Uncover, looks for where you're most likely to get hurt and what to fix first. A compliance readiness assessment goes requirement by requirement and asks whether an assessor would mark each one met. Most regulated organizations need both.

The five stages of a readiness assessment

The stages run in a fixed order, since each one depends on what the previous stage produced.

1. 1
   Scoping. Identify in-scope data, systems, locations, people, and third parties, then diagram how regulated data moves between them.
2. 2
   Requirement mapping. List every requirement for the applicable level, objective, or policy area.
3. 3
   Control testing. Review configurations, interview control owners, and sample records. "Is MFA on?" is too broad to be useful. The question that finds gaps is whether MFA is enforced for every in-scope account, service accounts and the vendor's remote support tool included.
4. 4
   Evidence review. Confirm each requirement has an artifact that an assessor would accept.
5. 5
   Gap report and roadmap. Rank findings by risk and assessment impact, and give each one an owner and a date.

Before hiring anyone, know that preparation and assessment should be kept separate. Under the CMMC rule, ecosystem members can't take part in a Level 2 certification assessment of an organization they consulted for in the previous three years. An offer to prepare you and certify you in the same engagement should raise questions.

6Which Technical and Administrative Controls Matter Most?

Across all four frameworks, the most heavily weighted controls govern who gets in, what they can reach once inside, and whether anyone notices when something goes wrong. Numbering and grouping differ by framework, but the underlying set is largely the same.

Technical controls are the ones systems enforce. Administrative controls are carried out by people. Physical controls get less attention than they deserve, particularly on a plant floor or at a busy clinic front desk. All four frameworks expect all three.

Encryption is a useful gauge of how often basics get skipped. In IBM's 2026 Cost of a Data Breach study, only 37 percent of breached organizations said they encrypt sensitive data both at rest and in transit. All four frameworks expect it.

Microsoft environments generate most of the evidence for you

Organizations on Microsoft 365 already license much of what this table calls for. Entra ID handles identity and conditional access, Intune covers device compliance and BitLocker encryption, Defender handles endpoint protection, and Purview handles data classification and audit logging. Set up well, these tools produce a large share of the evidence an assessor asks for, often as exportable reports. Left the way they were configured during migration, they tend to produce findings. A review of your Microsoft 365 security configuration frequently closes more gaps than a new purchase would, and Why Identity Is the New Perimeter explains why identity is the place to start.

The plant floor needs its own plan

Manufacturing raises questions that an office rarely does. A CNC controller may still run Windows 7 because the machine builder never certified anything newer, and programs may move from engineering to the shop floor on USB drives. CMMC's scoping rules treat operational technology, test equipment, and similar machines as specialized assets, which have to be identified and documented even when they can't be fully hardened. Leaving them off the asset list doesn't take them out of scope, and an assessor walking the floor will notice.

Backups need the same scrutiny. A job that reports success hasn't proven much until someone restores from it, a point Why Business Continuity Services Belong in Every IT Strategy covers in more detail.

7Documentation and Evidence an Assessor Will Ask For

Expect requests for three kinds of proof. Documents describe what you do, artifacts show a control is configured, and records show it has kept operating over time. An organization with plenty of the first and little of the third is not ready, however polished the policies look.

The anchor documents for each framework

Each framework has a few core documents that the rest of the evidence hangs from, and a missing one can stop an assessment early.

• CMMC: the system security plan (SSP), which defines the assessment boundary and describes how each requirement is met, plus a plan of action for open items where the rules allow one.

• HIPAA: the risk analysis, the risk management plan built from it, written policies and procedures, and business associate agreements.

• CJIS: agency user agreements, the CJIS Security Addendum for contractors, personnel screening and training records, and state-required policies.

• TISAX: the completed ISA self-assessment and the information security management system documentation supporting each answer.

How assessors work through the evidence

Assessors tend to work from the top of the stack down. They read the policy, ask how it's carried out, ask to see the configuration, and then ask for records showing it has run for the past several months. Good policies with nothing underneath them usually fall apart by the second or third request.

Interviews count as evidence, too. The assessor will want to hear from the person who runs each control, and that person should be able to explain it without reading from the policy. If the only employee who understands the backup process is on vacation during assessment week, expect a long day.

The math of unorganized evidence

A rough calculation shows why evidence management drives timelines. The assumptions below are illustrative, so plug in your own.

CMMC Level 2 has 110 requirements. Suppose each one needs three artifacts: a policy statement, a configuration export or screenshot, and a record showing the control operating over time. That's 330 artifacts. At 20 minutes apiece to locate, check, and label, the collection work comes to 6,600 minutes, or 110 hours, close to three weeks of one person's time before a single gap gets fixed. Teams that file evidence as part of normal operations avoid most of those hours.

8Preparing for a Third-Party Assessment

Settle the scope, rehearse the evidence requests, and make sure each control owner can explain their control in plain language. With those done, the assessment mostly confirms what you already know. Without them, you end up discovering gaps with the assessor in the room.

Who does what in an assessment

Confusion about roles wastes a lot of money. Take the C3PAO: an organization authorized or accredited by the CMMC Accreditation Body to run Level 2 certification assessments and issue the certificate. It doesn't remediate, and it can't assess an organization it recently advised. The other frameworks draw similar lines.

Searches for "C3PAO" climb whenever a deadline gets close, which is understandable. Still, an assessor is an expensive way to discover gaps, so book one after the readiness work is done.

The final 30 days before an assessment

By the last month, the work should be confirmation. If major remediation is still in progress, consider moving the date. The checklist below is a reasonable test of whether you're there:

On assessment day, answer what's asked and don't guess. "Let me pull that record" beats a confident answer that turns out to be wrong. It's also a bad time to change configurations, since a fix with no history behind it invites more questions.

9Seven Readiness Gaps That Keep Showing Up

The same gaps turn up in machine shops, medical practices, and public-sector vendors. Fixing them rarely takes new technology, and finding them yourself costs far less than having an assessor find them.

1. Scope no one wrote down

Regulated data spreads. CUI ends up in email attachments, on shared drives, and in the quoting folder on a salesperson's laptop. ePHI shows up on a scanner's network share or in a fax inbox no one remembers setting up. Until the boundary is written down, there's nothing to defend.

2. Policies written for a different company

Template policies work as a starting point. Problems start when they're adopted as-is, such as a policy that names tools you don't own or describes procedures few follow. These make an assessor skeptical of every document that follows.

3. MFA with exceptions no one tracks

Almost everyone has MFA somewhere. The harder question is which accounts bypass it, and the usual answers include the service account for the ERP integration, an old VPN, a shared login on the shipping station, and a vendor's remote support tool. Each exception should have a documented reason, an approver, and a review date.

4. Patching without a record

Verizon's numbers are worth repeating here. With only about a quarter of known exploited vulnerabilities fully remediated in 2025, many teams will struggle when an assessor asks for 12 months of patch history. Patches applied without a record get scored the same as patches never applied.

5. Logs collected, never reviewed

Collecting logs covers part of most logging requirements. The rest is proof that someone reviews them and acts on what turns up. A SIEM holding a year of unacknowledged alerts shows an assessor exactly where the gap is.

6. Vendors outside the boundary

Vendor access belongs in scope. Verizon found a third party involved in 48 percent of all breaches in its 2026 data, and in 61 percent of manufacturing breaches. That includes the remote management tools your IT provider uses to get into your network, so review who can access your network through a vendor before the assessor asks.

7. Evidence that lives in one person's head

When finding evidence depends on one employee's memory, readiness depends on that person's calendar. Store evidence in a known location, organized by requirement, where more than one person can find it.

10How Should You Prioritize Remediation?

Score each gap on two things: the real risk it carries and its effect on the assessment outcome, then fix the ones that score high on both first. That ties spending to actual exposure and to the result you need, rather than to whichever finding got the most attention in the last meeting.

A simple priority matrix

Sorting findings into four groups gives leadership an order of work it can follow.

Know what cannot wait until after the assessment

How much you can carry into an assessment unfinished depends on the framework. CMMC Level 1 permits no plan of action. Level 2 allows a conditional status only under limited conditions, and open items must close within 180 days. The ENX handbook describes corrective action plans and temporary labels for TISAX. HIPAA has no formal grace period, and a risk management plan needs to show progress against the risks the analysis identified. Check which rules apply before deciding what can wait.

Spend on configuration before you spend on products

A common and expensive mistake is buying new tools before configuring existing ones. A better order is scope, then policy decisions, then configuration of what you already license, then purchases to cover whatever is left. Reversing it tends to leave overlapping products, a larger scope, and the original evidence gaps.

118 Steps to IT Compliance and Security Readiness

IT compliance and security readiness follow roughly the same eight steps across all frameworks covered here. The specifics vary, but the order generally holds.

1. 1
   Confirm what applies. Read contracts, DFARS and FAR clauses, business associate agreements, CJIS agreements, and customer requests, and list each framework with its required level or objective.
2. 2
   Name an owner and a sponsor. Frameworks expect a named person: CMMC's affirming official, HIPAA's security official, the CJIS local agency security officer, or the TISAX contact. That person needs real authority and time set aside for the work.
3. 3
   Define scope and map data flows. Decide what's in, what's out, and why. Narrowing scope with segmentation or an enclave is often the least expensive fix available, and for many defense suppliers, it's the biggest single lever in CMMC readiness.
4. 4
   Run a readiness assessment against the exact framework language rather than a generic checklist.
5. 5
   Remediate in priority order, with configuration taking precedence over purchases.
6. 6
   Build evidence as you go. Each remediation task should end with an artifact filed against its requirement.
7. 7
   Rehearse. Have someone who didn't do the work run a mock assessment and practice interviews with control owners.
8. 8
   Assess, then keep it running. After the formal assessment, put the routine work on a calendar: monthly patch reports, quarterly access reviews, annual policy reviews, and a fresh look after any major change.

Readiness slips fast without an owner, which is why it fits better inside day-to-day IT operations than in a project binder. For leadership deciding where compliance fits in the overall technology budget, Virtual CIO Services in Michigan: Strategy on Retainer covers that executive layer.

Readiness scorecard

Check each statement that is true today. Anything you can't check is a place to start.

12Frequently Asked Questions