Know exactly what we cover — and what we don't.
Compliance frameworks are complex. We believe in being specific about which controls we actively manage at each service tier, so you can make informed decisions without surprises at audit time.
Compliance support is not the same as compliance certification.
When Wayfinder says we "support" a compliance framework, we mean we actively manage the technical controls that fall within our scope — the tools, configurations, access policies, logging, and security stack that your auditor or insurer will ask about.
What we don't do: certify you, act as your compliance officer, write your policies from scratch, or guarantee audit outcomes. Compliance involves people, processes, and technology — we own the technology layer.
What we actively manage
- ✓ Technical security controls in your M365 environment
- ✓ Endpoint protection, patching, and monitoring
- ✓ Identity, access, and conditional access policies
- ✓ Logging, alerting, and incident response (Premium)
- ✓ Backup, DR, and business continuity (per tier)
What remains your responsibility
- — Physical security of your office and devices
- — Staff training and policy enforcement (Standard: advisory; Premium: KnowBe4)
- — Business Associate Agreements with other vendors
- — Compliance officer / DPO role
Important: Compliance framework support is included in Standard and Premium tiers and is not guaranteed. Our role is to manage the technical controls that fall within our scope of service. Achieving and maintaining certification or regulatory compliance is a shared responsibility between your organization and your service providers.
Which frameworks we support, and at what tier
Each framework below maps to the specific controls Wayfinder actively manages. "Supported" means we handle the technical layer — not that we're your compliance team.
Cyber Insurance Readiness
Most cyber insurers require a documented set of technical controls. Wayfinder's Basic tier satisfies the majority of standard requirements.
HIPAA
The technical and some administrative safeguards of HIPAA fall within our scope at Standard tier. Physical safeguards remain the client's responsibility.
PCI DSS
Wayfinder manages the network security, access control, monitoring, and vulnerability management requirements within our scope. Cardholder data environment scoping remains the client's responsibility.
NIST 800-171
Required for businesses handling Controlled Unclassified Information (CUI) — common in defense contracting, government supply chains, and regulated industries. Premium's full stack covers the majority of the 110 controls.
CIS Controls v8
The CIS Controls are a prioritized set of 18 safeguards. Wayfinder's Premium stack directly maps to Implementation Group 2 (IG2) — appropriate for most SMBs handling sensitive data.
Which tier do you need?
Framework coverage by tier
| Framework | Basic | Standard | Premium | Who needs this |
|---|---|---|---|---|
| Cyber Insurance requirements | ✓ Supported | ✓ Supported | ✓ Supported | Any business carrying cyber liability insurance |
| HIPAA | — | ✓ Supported | ✓ Supported | Healthcare providers, business associates |
| PCI DSS | — | ✓ Supported | ✓ Supported | Businesses that accept credit card payments |
| NIST 800-171 | — | — | ✓ Supported | Defense contractors, federal supply chain (CUI) |
| CIS Controls v8 (IG2) | — | — | ✓ Supported | Any organization wanting a proven security baseline |