Frequently Asked Questions
Clear answers about your liability, our process, and why "good enough" isn't enough anymore.
🛡️ Why Do I Need This?
Q: How do I know if I actually need these services?
You have a business to run—you can’t be expected to be an expert in evolving Cyber Compliance obligations. Given the financial risk of exposure, a review of your current posture is a sensible first step. Our free risk assessment shows where you stand, and if you want a deeper look, our Gap Analysis Scorecard gives you the exact roadmap to fix what’s missing.
Q: Am I really at risk if my policies are just "a little" outdated?
Yes, it can be. Insurance carriers compare your application answers with what you can actually show. After a breach, regulators and courts ask whether your security was reasonable for your business at the time, and a plan that no longer matches how you work is hard to defend. Some rules require updates outright: the FTC Safeguards Rule says to evaluate and adjust your program as your business and risks change (16 CFR 314.4(g)).
Q: How does this help with my Cyber Insurance application?
Carriers are increasingly denying applications or claims due to "Material Misrepresentation." This happens when you check "Yes" to having a policy but can't produce the document after a breach. Our Cyber Playbook gives you the written WISP and evidence logs that back up the answers on your application.
Q: I'm a small business. Are hackers really targeting me?
Yes. Attackers target SMBs because they know you have valuable data (credit cards, SSNs) but often lack the sophisticated defenses of a large enterprise. We provide the enterprise-grade governance shield at a small business price.
⚙️ How It Works
Q: Does this replace my existing IT Managed Service Provider (MSP)?
No. We are not an IT team, and we do not monitor networks or install software. We provide the administrative Cyber Governance Policies that your IT team needs to follow. Think of us as the "Architects" who draw the blueprints (Policies), while your MSP are the "Builders" who install the locks (Firewalls/AV). We are complementary partners.
Q: Will you need access to our company network?
No. We maintain a strict Zero-Access Policy. Our engine generates your custom policy shield based on your assessment survey data without ever touching your live operational systems, servers, or client data.
Q: Am I exposing my business by uploading my current handbook?
No. We never touch your systems. We only read the administrative governance language in the handbook you upload, to check it against current standards. Our Mutual Non-Disclosure Agreement (NDA) is built into our Terms of Service and covers your documents from the moment of upload.
Q: Why can't I just use ChatGPT?
Generic AI "hallucinates" and cites non-existent statutes. GoCyberCompliant builds your plan from a fixed library of rules and standards (NIST, the FTC Safeguards Rule, HIPAA and Maryland law) with the citations built in, and our risk specialist reviews every paid plan before delivery.
📦 Deliverables & Support
Q: Is this a one-time document or an ongoing service?
Your initial purchase includes the full Policy Pack plus a Free 3-Month Subscription to our Compliance Watch. This ensures your documentation stays updated as new 2026 laws like MODPA and federal standards evolve. After that, you can choose to maintain the subscription for a low monthly fee or keep your static documents.
Q: Can my legal team review these documents?
Absolutely. We provide the expert-level framework specifically so your counsel can perform a final legal sufficiency review without starting from scratch. This saves you billable hours, because your counsel reviews a near-final draft instead of drafting one from a blank page.
Q: Do you service states outside Maryland?
Yes. We’re based in Maryland and build in Maryland’s rules (PIPA, and MODPA where it applies). Every plan is built on federal NIST guidance and the federal rules for your industry, such as the FTC Safeguards Rule or HIPAA, which apply in every state.
Q: What is a "WISP" and why do I need one?
A Written Information Security Program (WISP) is the "Constitution" for your data security. It is legally required for many industries: tax preparers, accountants and auto dealers that arrange financing must have one under the FTC Safeguards Rule (16 CFR 314), and IRS Pub 4557 and Pub 5708 explain how. It documents exactly how you protect customer data. If a rule requires one and you don't have it, you are out of compliance.
Completing Your Compliance Shield
A robust cyber defense requires more than just internal policy. We provide the Governance Layer, but to be fully protected, every SMB should also maintain the following:
Working with an MSP to manage Firewalls, MFA, and Antivirus software.
To provide financial coverage for legal fees and forensics in the event of a successful breach.
Regular 'snackable' security awareness sessions to keep staff alert to phishing.
Professional review of your documents by a licensed attorney in your specific state.
External notice to inform your customers of data collection (Cookies/Forms).