SECURE Pillars
Growth-Tier Service Program
The SECURE Pillars tier is designed for organizations ready to strengthen their security program and build upon a strong foundation. It includes everything needed to meet compliance requirements, manage risks, and create a culture of security awareness. This package combines baseline protections with ongoing oversight, structured reporting, and staff training.
Objectives
- Establish and maintain a clear security and compliance baseline.
- Provide proactive oversight from a dedicated security team.
- Deliver executive-ready reports for leadership and compliance.
- Improve resilience with regular tabletop exercises and vendor reviews.
- Enhance staff awareness with structured training.
What’s Included
1. Security Risk Assessment (SRA)
- HIPAA / NIST CSF baseline assessment.
- Identifies risks across people, processes, and technology.
- Provides a prioritized list of recommendations.
2. Policy Starter Kit
Editable, ready-to-use policies:
- Acceptable Use Policy (AUP)
- Information Security Policy
- Incident Response Policy
- Vendor Management Policy
- Business Continuity Plan (BCP)
3. Discovery & Onboarding Questionnaire
- Collects organizational details, regulatory requirements, and existing controls.
- Ensures recommendations are tailored to your environment.
4. Risk Register Setup & Ongoing Updates
- Creation of a structured risk register (Excel, Google Sheets, or shared platform).
- Risks tracked by likelihood, impact, and mitigation options.
- Updated monthly to reflect changes in operations and emerging threats.
5. Quarterly Security Check-Ins
- One-hour review with leadership every quarter.
- Updates on risk posture, compliance gaps, and progress toward goals.
6. 90-Day Quick Wins Checklist
High-impact improvements implemented early in the engagement:
- Multi-Factor Authentication setup guidance
- Strong password policy implementation
- Phishing protection review (SPF/DKIM/DMARC)
- Patch and software update checklist
- Access control and privilege review
7. Security Team Support
- Fractional analyst hours available as needed.
- Support for vendor assessments, remediation guidance, and compliance questions.
8. Quarterly Security Report Deck
- Executive-ready report summarizing key risks, improvements, and compliance progress.
- Designed for leadership and regulator presentations.
9. Annual Incident Response Tabletop Exercise
- Simulated incident to test readiness and response procedures.
- Post-exercise report and action plan to close gaps.
10. Vendor Risk Review
- Basic review and questionnaire for new vendors.
- Confirms that third parties meet minimum security requirements.
11. End-User Awareness Training (Annual)
- Security awareness training for all staff once per year.
- Focused on phishing, password hygiene, and HIPAA compliance.
12. Semi-Annual Board Briefing Deck
- High-level, non-technical update for senior leadership.
- Links security program results directly to business risk and compliance objectives.
Deliverables
- Security Risk Assessment Report (executive + technical detail).
- Policy Starter Kit (editable templates).
- Risk Register (with monthly updates).
- Quarterly Review Notes.
- Customized 90-Day Quick Wins Checklist.
- Ongoing Security Team Support.
- Quarterly Security Report Deck.
- Annual Incident Response Tabletop Summary.
- Vendor Risk Review Reports.
- Annual End-User Training Session.
- Semi-Annual Board Briefing Deck.
Ideal For
- Organizations needing ongoing oversight and proactive support.
- Healthcare and regulated firms requiring continuous documentation for compliance.
- Leadership teams that want executive-ready reports and structured security growth.
Next Step
SECURE Pillars ensures your security program doesn’t just stay compliant, but evolves with your organization.
For organizations seeking enterprise-level maturity and strategic leadership, the next step is SECURE Comprehensive — a complete security program with executive-level guidance and resilience built in.
Ready to start? Book a call: https://cal.com/secvara/pre-sra