Information Security and Compliance 2017-03-02T19:40:00+00:00

Independent, Unbiased, Technically-Qualified Security Assessments

Our Information Security & Compliance practice (formerly 403 Labs) is dedicated to assisting our clients with information security consulting, fraud management, risk mitigation and vulnerability detection and prevention. We have the privilege of working with leading payment card, financial, restaurant, hospitality, health care and educational organizations from around the world.

Our team has the extensive knowledge and experience to help you improve your unique security posture, specializing in compliance audits, penetration tests, computer security assessments and computer forensic investigations. We handle anything having to do with security or protecting data, including credit card data (PCI DSS), patient data (HIPAA), bank account numbers (GLBA), service provider reviews (SOC 1/2/3) or intellectual property.

We hold several certifications within the information security industry, including:

  • Approved Scanning Vendor (ASV)
  • Qualified Security Assessor (QSA)
  • Payment Application Qualified Security Assessor (PA-QSA)
  • Qualified Security Assessor for Point-to-Point Encryption (QSA (P2PE))
  • Payment Application Qualified Security Assessor for Point-to-Point Encryption (PA-QSA (P2PE))
  • PCI Forensic Investigator (PFI)

We take time to learn your business

We take time to learn your business so we can better advise you, because we know that, at the end of the day, you have a business to run.

We are a state-of-the-art company

We employ state-of-the-art facilities, equipment and techniques to perform thorough security tests. Simply doing “enough to get by” is not an option.

We are continually innovating

We are continually innovating, being first-to-market with new tools, better ideas and superior technology supported by patents.

We're active in the community

We’re active in the information security community, presenting seminars, writing articles, conducting webinars and sharing our knowledge.

Information Security Services

We Make Compliance as Painless as Possible.

Achieving compliance with industry standards doesn’t have to be as difficult as it seems. Regardless of the standard, Sikich guides you through compliance validation processes quickly and smoothly to help get your organization in compliance and back to your core competency—running your business.

Our validation process is easy, and scalable for any size environment.  If you need to comply with multiple industry requirements, you can leverage our experience and efficiencies by combining your requirements into a single assessment.

If you’ve never undergone a compliance assessment before, we can help you prepare for your first one. If you’re a veteran to your industry requirements, you’ll benefit from our unique approach. Compliance isn’t a once-a-year process; we’re your partner and here for you when you need us.

Organizations that store, process or transmit payment card data, such as merchants and service providers, need to comply with the Payment Card Industry Data Security Standard (PCI DSS) to protect cardholder data (CHD).
Payment application vendors and service providers can take advantage of the PCI point-to-point encryption (P2PE) framework to develop solutions that reduce merchant handling of payment card data.
Payment application vendors need to validate against the requirements of the PCI Payment Application Data Security Standard (PA-DSS), which supports merchant compliance with the PCI DSS.
Financial institutions are required by law to comply with the Gramm-Leach-Bliley Act (GLBA) and maintain proper security controls to protect consumer financial privacy.
Health care institutions are required by law to protect the privacy of protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA).
Outsourced service providers that touch another organization’s data undergo a Statement on Standards for Attestation Engagements No. 16 (SSAE 16) to demonstrate how client data is safeguarded.

Make Better Information Security Decisions With Insights from Our Experts

Meet Our Information Security & Compliance Partner

D.J. Vogel
D.J. VogelPartner, Security & Compliance

D.J. leads the firm’s security and compliance division. He was the principal founder of 403 Labs in 2005, a world renowned information security consultancy, which he merged with Sikich in 2014. D.J. has extensive experience in information security, vulnerability management, Internet architecture, networking and software design and manages security assessments, forensic examinations and penetration tests. He is a regular speaker at national conferences and conducts training sessions for corporations and compliance organizations. D.J. works closely with the regulatory agencies and card associations to help define and strengthen industry security standards, including the Payment Card Industry Data Security Standard (PCI DSS), Payment Application Data Security Standard (PA-DSS) and forensic procedures.