201 CMR 17.00
Massachusetts requires any business holding a single MA resident's personal information to maintain a written information security program, enforceable at up to $5,000 per violation. We build WISPs that hold up, not shelf documents.
Defend
Security built for how attacks actually happen now.
Risk assessments, compliance, penetration testing, and incident readiness from a senior team headquartered in Boston, working with clients wherever they operate. Every project is fixed scope with deliverables in writing, and the same team can carry the work into 24/7 operations through bcxBastion.
The threat, measured
The attacks changed. Most defenses did not.
Attackers use AI to write flawless phishing, clone voices, and move faster once inside, and mid-sized companies are carrying the risk.
88%of breaches at small and mid-sized businesses involve ransomware.Verizon Data Breach Investigations Report
40%of SMB leaders say an incident costing $100K or more could close their business.VikingCloud SMB research
$3.04Bin business email compromise losses reported to the FBI in 2025, increasingly AI-assisted.FBI IC3 annual report, 2025
Risk assessments
Start with what is true, not what the last vendor claimed.
We map your assets, data, and threats against the controls you actually have, verified with evidence: whether MFA covers every account, whether backups restore, whether file permissions match what anyone intended. Findings come ranked by likelihood and business impact, with a remediation roadmap that names owners.
Leadership gets the risk picture in plain language and dollar terms, and your IT team or MSP gets the detail to execute. Not a hundred-page PDF; a working document that becomes next quarter's plan.
Compliance
Three deadlines that are not optional.
CMMC 2.0
New DoD contracts require CMMC certification starting October 31, 2026. We run gap analyses against your required level and manage remediation to assessment readiness.
HIPAA Security Rule
The Security Rule overhaul makes MFA and encryption mandatory rather than addressable. We translate the rule into a project plan.
Compliance work feeds one evidence library that also serves your insurance renewals and customer security reviews. For the Massachusetts requirements in checklist form, read our 201 CMR 17.00 compliance checklist, and see our vCISO service for ongoing compliance ownership.
Penetration testing
Find out what an attacker finds out. On your schedule.
Tests are scoped to how you actually run: external and internal network, web applications, cloud configurations, and social engineering including AI-generated phishing. Senior testers do the work, every finding comes with a specific fix, and we retest after you remediate.
Most clients test because an insurer, customer, or assessor asked for proof, and we deliver reports those audiences accept.
Incident readiness
Rehearse the bad day before it happens.
We write the response plan, assign the roles, and run tabletop exercises against realistic scenarios: ransomware on a Friday afternoon, a compromised email account moving money, a deepfake video call from your CEO authorizing a wire. Each exercise ends with a written gap list and fixes sequenced into your roadmap. Rehearsal is the cheapest control you can buy.
After the project
Consulting finds the gaps. bcxBastion keeps watch.
Assessments are snapshots; attacks are continuous. bcxBastion extends our consulting into 24/7 operations, with bcx analysts triaging alerts around the clock, and the consultants who assessed your environment hand off to the team that watches it. See how the platform works.
Questions
Straight answers on cybersecurity consulting
Does 201 CMR 17.00 apply to my business?
If you hold personal information about even one Massachusetts resident, including an employee, it applies. The regulation requires a written information security program, risk assessments, access controls, encryption, and vendor oversight, enforceable at up to $5,000 per violation.
When do we need CMMC certification?
If you sell to the Department of Defense or sit in a defense supply chain, new DoD contracts require CMMC certification starting October 31, 2026. Assessments take months and remediation often takes longer, so start the gap analysis now rather than waiting for the contract clause.
What does a risk assessment include?
We inventory your assets and data, map threats against the controls you actually have, verify claims with evidence, and deliver findings ranked by likelihood and business impact, with a remediation roadmap that names owners.
How does consulting connect to bcxBastion?
Consulting finds and fixes gaps; bcxBastion keeps watch afterward. It is our managed detection and response platform built on Google SecOps, CrowdStrike, and Palo Alto Networks, operated by bcx analysts around the clock.
Know your exposure by Friday.
The free Business AI Maturity Assessment takes about 8 minutes and scores AI maturity across six dimensions, including governance, risk, security and resilience.
Take the free AI Assessment