Feel every ripple in your AWS accounts, and keep the proof.
A trout senses the faintest movement in the water through a line of pores along its flank. We run that line through your cloud: continuous monitoring across every AWS account, each finding triaged and tracked to closure, and a monthly evidence pack for your auditor and board.
The rules ask for monitoring. Auditors ask for the record.
FTC Safeguards Rule
Covered financial institutions must test their safeguards, either with continuous monitoring or with an annual penetration test plus vulnerability scans every six months. The Qualified Individual reports to the board in writing at least once a year.
16 CFR 314.4(d) and (i)
HIPAA Security Rule
Organizations handling ePHI must regularly review information system activity, such as logs, access reports and incident tracking, and periodically evaluate their safeguards.
45 CFR 164.308(a)(1) and (a)(8)
Most teams on AWS already pay for the tools. What's missing is someone wiring them together across accounts, reviewing what they find every month, and keeping a record that holds up.
Two services, one method
Each starts with a fixed-fee setup, then a monthly retainer. Plans have a 6-month minimum, then run month to month with 30 days' notice.
Safeguards Monitoring
For mortgage lenders and brokers, finance companies, collection agencies, tax preparers and other non-bank financial institutions on AWS.
- CloudTrail, GuardDuty, Config, Security Hub, Inspector and IAM Access Analyzer across your whole AWS organization, deployed as reviewed Terraform
- Logs kept in a write-once archive
- Every alert triaged; every finding fixed by its target date or formally accepted
- Managed patch windows and patch compliance reporting
- A monthly evidence pack for your Qualified Individual's board report
| Plan | Setup | Monthly |
|---|---|---|
| EssentialsUp to 3 AWS accounts | $6,000 | $1,500 |
| StandardUp to 8 accounts, patch windows, quarterly review | $10,000 | $3,000 |
| Standard with vulnerability managementAdds monthly external and internal scans, fix list and retests | $13,000 | $4,000 |
HIPAA Monitoring
For healthtech, digital health and pharmacy-benefit companies, and their vendors, that store or process ePHI on AWS.
- A HIPAA Security Review to start: Prowler HIPAA scan, IAM and architecture review against the AWS Well-Architected Framework, and a gap report you can share with customers
- Monitoring across your AWS organization, with every finding tracked to closure
- Information system activity review done and recorded every month
- A monthly evidence pack that feeds your annual risk analysis
- A business associate agreement signed before any access
| Plan | Setup | Monthly |
|---|---|---|
| HIPAA Security ReviewOne-time review and gap report | $7,500 | None |
| EssentialsUp to 3 AWS accounts | $6,000 | $1,500 |
| Standard with vulnerability managementUp to 8 accounts, monthly scans and retests, quarterly review | $13,000 | $4,000 |
Monitoring detects and reports problems. It is not a third-party penetration test and does not produce an attestation letter; if your bank partners or customers require one, we'll scope it with you.
A month on the line
Readiness call
Thirty minutes on where you stand against the rule, whether or not you buy.
Setup
Monitoring deployed across your AWS organization as Terraform your team can read, with a triage runbook and a tested undo plan.
Every week
Alerts triaged, findings assigned target dates, patches and scans run on schedule.
Month end
The evidence pack: findings log, remediation status, risk acceptances and patch compliance, ready for your auditor and board.
How this site is secured
We hold our own front door to the standard we'd hold yours. Every control below is set in Terraform and can be checked from outside.
- No code runs in your browser
- No JavaScript, no cookies, no trackers, no third-party requests. The content security policy blocks scripts outright.
- Private origin
- The site files sit in an encrypted, versioned S3 bucket with all public access blocked. Only this CloudFront distribution can read it, through origin access control.
- Modern TLS only
- TLS 1.2 or newer, HTTP/2 and HTTP/3, and HSTS with preload, so browsers never connect over plain HTTP.
- Strict headers
- Content security policy, frame blocking, no MIME sniffing, a strict referrer policy and locked-down browser permissions.
- Web application firewall
- AWS WAF with AWS managed rule sets and rate limiting in front of every request.
- Signed DNS, authenticated mail
- DNSSEC on the domain and CAA records limiting who may issue certificates. Our email is DKIM-signed, with SPF and DMARC set to reject anything that claims to be from us and isn't.
- A way to report issues
- A security.txt file, as defined in RFC 9116.
Check it yourself: securityheaders.com, Mozilla Observatory, SSL Labs and DNSViz.
Who you'll work with
Lateral Line Security is Donald Maslanka, a cloud security engineer with more than 12 years of HIPAA security experience at the U.S. Department of Veterans Affairs.
The work is hands-on: AWS Organizations, Terraform, CloudTrail, GuardDuty, Security Hub, Inspector, SSM Patch Manager and Prowler, built so your team can read, review and undo every change.
The Department of Veterans Affairs does not endorse this service.
Book a 30-minute readiness call
Find out where you stand on Safeguards or HIPAA testing in AWS. You'll leave with a short list of gaps, whether or not we work together.