ComplyIT · IT compliance

When the auditor calls, you have the answers.

Owning IT is in our nature.

You get a plain answer on what “compliant” means for your business, a path to get there, and paperwork that stays ready, so your next questionnaire takes minutes, not weeks.

Send over the questionnaire → See what it costs

Technical specs & details ↓ Or start with a free IT health check →

On every ManageIT plan: a live expert in 5 minutes, or a $100 credit · See your price before you call

In short

ComplyIT is DivergeIT’s compliance-as-a-service program on Secureframe: it turns your security controls into monthly evidence aligned to CIS, NIST, HIPAA, CMMC or ISO 27001. ComplyIT Core is included with every ManageIT plan, Plus is $6,890 a month and Pro is $11,500 a month. Full specs · Pricing

The problem

It’s not just you. Compliance keeps landing on jobs that were already full.

Clients, insurers and regulators all want proof now. Most of it ends up with whoever happens to be closest.

Rules nobody explained

HIPAA, SOC 2, PCI, CMMC, or whatever your biggest client just asked for. Nobody told you which apply.

Questionnaires on a deadline

A client sends 90 security questions and wants them by Friday. Every one starts from zero.

Policies that don’t match reality

They were written once, filed somewhere, and describe a company you used to be.

Audit week eats the office

The people who run the business stop everything to hunt for evidence.

Heard on first calls

“A client sent a 90-question security form and wants it by Friday.”
“I don’t even know which rules apply to my business.”
“The last audit took over the whole office for a month.”
“There are policies. Somewhere.”

The real issue

The problem isn’t the paperwork. It’s that compliance has no owner.

Compliance gets handed to an office manager, a controller or the IT person. They do their best between other jobs, and every audit starts over.

ComplyIT owns it year-round: the framework, the policies and the evidence. On ComplyIT Pro, it works with the auditor too.

Find out where you stand →

A practice manager closing a finished folder at her sunny desk with a quiet smile

So where do you start?

Red to green, in three steps.

First — Alignment

We tell you what applies

Plain words on which frameworks and client requirements apply to you, and where you stand against each one.

Next — Remediation

We close the gaps

Policies written to match how you really work, security controls put in place, risk assessments run and documented.

Ongoing — Audit-ready

We keep you ready

Evidence stays current, questionnaires take minutes instead of weeks, and on ComplyIT Pro, we work with the auditor.

Send over the questionnaire →

Before & after

What changes for you

Before: You’re not sure which rules apply to you.

With DivergeIT: You get the list in plain words: HIPAA, SOC 2, PCI, CMMC or the ones your clients ask for.

Before: Policies are out of date or hard to find.

With DivergeIT: Your policies are written to match how you really work, and kept current.

Before: Every questionnaire starts from zero.

With DivergeIT: Your answers and your evidence are ready to go.

Before: Audit week pulls your team off their work.

With DivergeIT: You go about your day. On ComplyIT Pro, your DivergeIT team works with the auditor.

What's included

Inside ComplyIT

Most IT providers manage technology. We own the outcome — including proving it. Compliance is more than avoiding fines: it reduces risk, protects data, builds customer trust, and increasingly determines who wins contracts.

ComplyIT bridges the gap between doing the right things and being able to prove it — from foundational policies and records through framework-specific evidence and formal audit support.

Framework alignment

Policy and evidence mapping for HIPAA, CMMC, and ISO 27001 on Pro, with CIS Controls and NIST CSF alignment that deepens from Core to Pro.

Policy & documentation

IT policy templates through fully custom policies, onboarding/offboarding checklists, and asset inventory documentation.

Risk assessment & testing

Annual risk assessment reports, monthly vulnerability scans, quarterly backup testing with documented RTO/RPO, and disaster recovery exercises.

Audit support

Evidence gathering, auditor coordination, and framework-specific documentation when certification is the goal.

Security controls

MFA enforcement, endpoint protection, email filtering, patching, and non-compliant device reporting.

Vendor & training programs

Vendor risk assessments, security awareness training tracking, and cyber-insurance evaluation support.

Technical specs & details

ComplyIT, line by line

The evidence each ComplyIT tier produces, the frameworks it maps to, and what your team contributes. Your program runs on Secureframe.

Platforms · Secureframe · RITIS

Tiers at a glance

ComplyIT Core

Baseline security hygiene, asset inventory, policy templates and cyber-insurance readiness.

Endpoint protection, email filtering, monitored backups & patching evidence
Asset inventory and on/offboarding checklist
SLA reporting and starter policy templates
Cyber-insurance evaluation & non-compliant device reporting

Included with every ManageIT plan.

ComplyIT Plus

An active path to compliance.

Everything in Core, plus —
Quarterly immutable-backup tests, RTO/RPO documented
Annual CIS / NIST checklist; core policies deployed
MFA enforced on key systems; monthly vulnerability scans
Annual risk assessment; quarterly compliance trend & risk scoring

Exams, insurer questionnaires and client security reviews.

ComplyIT Pro

Full assurance and audit readiness.

Everything in Plus, plus —
Policy & evidence mapped to HIPAA, CMMC or ISO 27001
Quarterly DR tests with documented restore logs
Training tracking, vendor risk assessments, annual audit support
Full IT asset management; custom SIEM & incident response playbooks

HIPAA, CMMC or ISO 27001 obligations.

Feature matrix

Capability	Core	Plus	Pro
Baseline (included with every ManageIT plan)
Endpoint protection, email filtering, monitored backups, patching	Included	Included	Included
Asset inventory, on/offboarding checklist, SLA reporting, policy templates	Included	Included	Included
Cyber-insurance evaluation & non-compliant device reporting	Included	Included	Included
Active compliance
Immutable backups tested quarterly; RTO/RPO documented	Not included	Included	Included
CIS / NIST checklist completed annually; core policies deployed (AUP, access, incident)	Not included	Included	Included
MFA enforced on key systems; monthly vulnerability scans	Not included	Included	Included
Annual risk assessment; quarterly compliance trend & risk scoring	Not included	Included	Included
Audit readiness
Policy & evidence mapped to HIPAA, CMMC or ISO 27001	Not included	Not included	Included
Quarterly DR tests with documented restore logs	Not included	Not included	Included
Security-training tracking, vendor risk assessments, annual audit support	Not included	Not included	Included
Full ITAM procurement-to-retire workflow; custom SIEM & IR playbooks	Not included	Not included	Included
Framework coverage
Basic cyber-insurance requirements	Included	Included	Included
CIS Controls / NIST CSF	Partial / —	✓ / Partial	✓ / ✓
HIPAA · CMMC · ISO 27001	Not included	Not included	Included

Requirements & what’s not included

How it works

Your program runs on Secureframe.
You provide system access, take part in policy reviews and respond to remediation recommendations; evidence depends on accurate system documentation.
Remediation work is billable. You get guidance and evidence, but no provider can guarantee an audit outcome.

Want this as a document for your team? Book a call and get the full service definitions →

Pricing

Every rate we charge is published in one place

ComplyIT tiers, what each one includes, and the assumptions behind the numbers — on the pricing page, not scattered across the site. On ManageIT, call or chat and you reach a live expert within 5 minutes, or you get a $100 credit.

See pricing →

The guarantees

Promises with consequences, not fine print.

Eligibility & limits → Read the agreements →

Response

On any ManageIT plan, wait more than 5 minutes for a live expert and you get a $100 credit on your next invoice.

All ManageIT plans

Ransomware recovery

Hit by ransomware anyway? Your covered data and servers are restored to their pre-attack state at no DivergeIT charge.

ManageIT Plus & Pro, with DivergeIT immutable backup

Switching

If switching disrupts your operations, your first 30 days of service are credited in full.

New ManageIT agreements

Satisfaction

If your concern still isn’t resolved, you get a $50 gift of your choice.

All ManageIT plans

Annual assessment

Your assessment and prioritized recommendations are free, every year. Any fixes are quoted separately.

Any SecureIT plan (included in every ManageIT plan)

AI payback

Not on track to pay for itself after the first two weeks? You get your Forward Deployed Engineering fees back.

Forward Deployed Engineering with an AI Success Desk plan

What changed for them

“We hired DivergeIT to help us really tighten things up. They customized their approach to our needs and surgically helped us do exactly that.”

Bedrock Fiduciaries More client stories →

FAQ

IT Compliance questions, answered

Which compliance frameworks does ComplyIT support?

The Pro tier maps your policies and evidence to HIPAA, CMMC, or ISO 27001 and maps to CIS Controls and the NIST Cybersecurity Framework. Plus completes an annual CIS or NIST checklist, and Core covers the baseline evidence most cyber-insurers ask for.

How is ComplyIT different from SecureIT?

SecureIT is active protection — threat detection and response. ComplyIT produces the audit-ready documentation, policies, and evidence that prove your controls exist and work.

Do I need ComplyIT if I already have ManageIT and SecureIT?

ManageIT and SecureIT do the right things; ComplyIT proves it. ComplyIT Core already comes with every ManageIT plan. If you face audits, insurance requirements, or customer security questionnaires, ComplyIT Plus or Pro turns that baseline into the proof you need.

How quickly can we get audit-ready?

It depends on your current posture, but many organizations see meaningful progress within 90 days — starting with a gap assessment and a prioritized remediation plan.

From our library