United States · Honolulu hub · Mainland account leadership
U.S. mid-market security and compliance, run by a U.S. team.
Most U.S. MSSPs either chase Fortune 500 deals or sell cookie-cutter small-business packages. We sit in between — running 24/7 SOC and managed compliance for the regulated mid-market. CMMC for DoW contractors. HIPAA for healthcare. SOC 2 and GLBA for fintechs and credit unions. Operations from our Honolulu hub, account leadership on the mainland.
U.S. compliance landscape
The frameworks U.S. mid-market actually answers to.
We don't pretend to do everything. We do the U.S. frameworks that produce the most pain for mid-market companies — and we do them deeply.
DoW & defense supply chain
CMMC 2.0 Levels 1 & 2
Final rule active since Dec 2024. Phase 1 enforcement live since Nov 2025. Full compliance mandated Nov 2026. We do scoping, gap analysis, GCC High migration, SSP authoring, evidence collection, and ongoing monitoring through assessment and beyond.
CMMC 2.0 readiness →
Healthcare
HIPAA Security Rule
Covered entities and business associates. Risk analyses, ePHI monitoring, breach response. Tracking the 2026 HIPAA Security Rule update — the biggest change since 2013.
Healthcare practice →Financial services
SOC 2 · ISO 27001 · GLBA · NCUA
Auditor-grade evidence collection, third-party risk programs, and the ongoing controls monitoring SOC 2 Type II and FFIEC examiners actually want. Credit unions, RIAs, fintechs.
Financial services practice →State-level requirements
CCPA · NYDFS · TX DIR · state breach laws
All 50 states have breach notification laws. CCPA in California, NYDFS Part 500 for NY-regulated finance, Texas DIR for state contractors. We track them and bake them into your IR plan.
Talk to us →How we cover the U.S.
A 100% U.S.-staffed SOC — East Coast through Hawaii.
U.S. customers are served exclusively by U.S. analysts. Our shifts span East Coast through Hawaii — about 10 hours of continuous in-country coverage during business hours, with on-call rotations covering the rest. No offshore handoffs. No foreign-national handling of CMMC, DFARS, or ITAR-adjacent telemetry.
Account leadership and field engineering are mainland-based to meet you on your time zone. Cebu doesn't touch U.S. customer data — they run our APJ region only.
-
01
Honolulu SOC
Primary U.S. operations hub. Hawaii Standard Time anchors the late half of the U.S. business day.
-
02
Mainland analyst rotation
U.S.-based analysts working from East Coast through Pacific time zones. All U.S. persons; CMMC- and DFARS-eligible.
-
03
Mainland account leadership
Customer success, technical account managers, and field engineers based on U.S. mainland time zones. Meetings happen on your clock.
Talk to us
A 30-minute call beats six months of RFPs.
Tell us where you operate, what you're regulated under, and what's on your CISO's plate this quarter. We'll tell you whether we're the right fit — and what the first 90 days actually look like.