Compliance Overview
Every SentinelSMB detection is tagged to the compliance frameworks that apply to your industry. When your auditor, insurer, or enterprise client asks for evidence, you have it.
Framework map
They look different on paper, but they ask for the same evidence: who accessed what, when it happened, and a record you can show. Tap any rule to jump to the details.
Applies to every business, in every industry. The timing clock starts at detection.
Once you tell us your industry, every detection is tagged to the frameworks that apply to you.
Frameworks mapped
These are the frameworks we map detections to. You do not need to know which ones apply to your business — the mapping is automatic once you tell us your industry.
ABA Model Rule 1.6
Lawyers owe a duty of confidentiality to their clients. Rule 1.6 requires reasonable efforts to prevent inadvertent disclosure.
IRS Publication 4557
Tax professionals must keep a written information security plan (WISP) under the FTC Safeguards Rule, and IRS Publication 4557 is the IRS guide to building one. SentinelSMB supplies the monitoring evidence a WISP calls for.
FTC Safeguards Rule
The amended Safeguards Rule (effective June 2023) requires a qualified individual, a written incident response plan, and either continuous monitoring or annual penetration testing with vulnerability scans every six months.
SEC Reg S-P
The 2024 amendment gives RIAs and broker-dealers 30 days to notify clients of unauthorized access to their sensitive information. Continuous monitoring starts the clock on time.
NAIC Model Law 668
28 jurisdictions have adopted NAIC Model Law 668, which requires insurance licensees to maintain an information security program.
CMMC 2.0 Level 2
Federal contractors handling Controlled Unclassified Information must meet CMMC 2.0 Level 2, which maps to the 110 NIST SP 800-171 security controls.
GLBA Safeguards
Financial institutions under the Gramm-Leach-Bliley Act must protect customer nonpublic personal information (NPI).
NY DFS 23 NYCRR 500
Financial services companies regulated by NY DFS must comply with 23 NYCRR 500, including access-control, audit-trail, and user-activity monitoring requirements.
NIST SP 800-171
The 110 NIST 800-171 controls protect Controlled Unclassified Information in nonfederal systems. Foundation for CMMC 2.0 and many federal contract clauses.
State Breach Notification
Every US state requires notification to affected individuals when personal information is accessed without authorization. The timing clock starts at detection.
How the mapping works
You tell us your industry once. From then on, every detection is tagged to the frameworks that matter to you. No manual mapping, no consultant required.
One of the 36 engines flags an event — a foreign sign-in, a new forwarding rule, an OAuth consent grant. The detection carries a timestamp, severity score, and attack-pattern label.
The detection is matched against the frameworks registered for your industry. A credential-theft event for a law firm gets tagged ABA 1.6. The same event for an RIA gets tagged SEC Reg S-P and GLBA. Automatic.
Every tagged detection becomes part of your live compliance record. Pro subscribers get the Cyber Insurance Evidence Report quarterly — a 7-page audit-ready PDF built from real detection data.
Pro Feature
The 7-page quarterly PDF generated from your real monitoring data — formatted for cyber insurance underwriters, auditors, and enterprise-client security questionnaires. Every framework mapping included, every detection timestamp referenced, every audit trail linked.
See Pro pricingConnect your accounts in under 10 minutes. Let the monitoring data answer the questions for you.