Core Services
HIPAA, PCI DSS, CMMC, SOC 2 — the frameworks are complex, the penalties are real, and the auditors don’t give partial credit. Fairway IT makes compliance manageable for Chicago businesses, with expert guidance from gap assessment through ongoing management. plus possible prison time for covered entities assessed by payment brands to acquiring banks mapped to NIST SP 800-171 — required for most CUI contractors The Health Insurance Portability and Accountability Act requires any organization that handles Protected Health Information (PHI) — including providers, insurers, and their business associates — to implement rigorous technical, administrative, and physical safeguards. ✓ Security Risk Analysis (SRA) — required under 45 CFR §164.308 ✓ Access controls, user authentication & audit logging ✓ Encryption of ePHI in transit and at rest ✓ Business Associate Agreement (BAA) management ✓ Workforce training and sanctions policies ✓ Breach notification policies and incident response plans ✓ Annual review and policy documentation updates per violation, up to $1.9M annually per category plus possible prison time for covered entities The Payment Card Industry Data Security Standard applies to any business that stores, processes, or transmits cardholder data. Non-compliance puts you at risk of fines, increased processing fees, and — worst case — losing your ability to accept card payments entirely. ✓ Cardholder Data Environment (CDE) scoping & segmentation ✓ Network firewall configuration and access controls ✓ Vulnerability scanning and penetration testing ✓ Encryption of card data in transit and at rest ✓ Log monitoring and intrusion detection ✓ Self-Assessment Questionnaire (SAQ) preparation and support ✓ Remediation guidance for failed controls assessed by payment brands to acquiring banks plus potential loss of card processing privileges The Cybersecurity Maturity Model Certification (CMMC 2.0) is now required for all DoD contractors and subcontractors that handle Controlled Unclassified Information (CUI). Level 2 — required for most contractors — maps directly to the 110 security practices of NIST SP 800-171. Enforcement is active and contracts are now at stake. ✓ NIST SP 800-171 gap assessment against all 110 practices ✓ System Security Plan (SSP) creation and documentation ✓ Plan of Action & Milestones (POA&M) development ✓ Access control, configuration management & audit controls ✓ Incident response planning and media protection ✓ Multi-factor authentication and encryption deployment ✓ Readiness preparation for third-party C3PAO assessment mapped to NIST SP 800-171 — required for most CUI contractors False Claims Act violations can result in treble damages Enterprise customers increasingly require SOC 2 Type II reports before signing contracts with SaaS providers or service organizations. A SOC 2 report demonstrates that your organization has formal controls over security, availability, processing integrity, confidentiality, and privacy — giving prospects the confidence to sign on the dotted line. ✓ Trust Services Criteria gap analysis (Security, Availability, Confidentiality) ✓ Control environment design and implementation ✓ Policy and procedure documentation ✓ Evidence collection and audit trail setup ✓ Vendor and third-party risk management program ✓ Ongoing monitoring and control testing ✓ Coordination with your audit firm for Type I and Type II reports confirms controls are designed appropriately at one moment confirms controls operated effectively over the audit period Fairway IT supports HIPAA (healthcare), PCI DSS (payment processing), CMMC/NIST 800-171 (defense contractors), and SOC 2 (service providers). We help businesses assess their current posture, close gaps, document policies, and maintain ongoing compliance. HIPAA compliance is an ongoing program, not a one-time event. Initial gap assessment and remediation typically takes 60–90 days for most small practices. Fairway IT handles the technical controls — encryption, access controls, audit logs, and backup — while helping you build the policies and documentation required by HHS. CMMC (Cybersecurity Maturity Model Certification) is required for all organizations in the Defense Industrial Base (DIB) that handle Controlled Unclassified Information (CUI). If your company holds a DoD contract or subcontract and handles CUI, you will need CMMC Level 2 certification — which maps to the 110 practices of NIST SP 800-171. Enforcement is underway and non-compliant contractors risk losing contract awards. HIPAA civil penalties range from $100 to $50,000 per violation, with an annual maximum of $1.9 million per violation category. Criminal penalties for willful neglect can reach $250,000 and include prison time. OCR investigations are typically triggered by data breaches, patient complaints, or mandatory breach notifications — making proactive compliance essential. Yes. We provide policy templates, gap assessment reports, risk analysis documentation, and evidence packages tailored to your specific framework. For HIPAA, this includes a Security Risk Analysis (required under 45 CFR §164.308), policies and procedures, and Business Associate Agreements (BAAs). For CMMC, it includes a System Security Plan (SSP) and Plan of Action & Milestones (POA&M). A compliance gap assessment from Fairway IT gives you a clear picture of your current posture — and a realistic roadmap to get you compliant without the chaos. We work with healthcare, financial, manufacturing, and government contractor organizations throughout Chicago. About Fairway IT →
IT Compliance — Chicago, IL
Compliance Without the Confusion
✓ HIPAA, PCI, CMMC & SOC 2
✓ Gap assessments & documentation
✓ Ongoing compliance management
Criminal Penalty (Willful Neglect)
Up to $250,000
Fines (Per Month Non-Compliant)
$5,000 – $100,000
CMMC Level 2 Requirement
110 Practices
HIPAA Security Rule Compliance
Civil Penalties
$100 – $50,000
Criminal Penalty (Willful Neglect)
Up to $250,000
PCI DSS Compliance
Fines (Per Month Non-Compliant)
$5,000 – $100,000
Post-Breach Penalty
Forensic audit + card replacement costs
CMMC & NIST 800-171 Compliance
CMMC Level 2 Requirement
110 Practices
Consequence of Non-Compliance
Contract Loss + FCA Liability
SOC 2 & ISO 27001 Readiness
Type I Report
Point-in-Time
Type II Report
6–12 Month Period
Frequently Asked Questions
IT Compliance Questions, Answered
Know Where You Stand Before Your Auditor Does