How We Protect Your Data
P-Bon Consulting is a founder-led practice. Here is, plainly, how we handle the systems and information clients trust us with — the practices we follow today, with no inflated claims.
Six Things We Do to Protect Client Information
Multi-Factor Authentication
Multi-factor authentication is required on the accounts that hold business and client information, including email, hosting, and our client-management system, and on administrative access to client systems.
Least-Privilege Access
We ask only for the access the work requires, keep credentials in a password manager rather than shared or reused, and remove access when an engagement ends.
Encryption and Protected Devices
We use encryption in transit and at rest where reasonable and appropriate, and our work devices run endpoint protection and are kept up to date.
Written Security Policies
Our written policies cover information security, access control, backup and recovery, incident response, data classification, and vendor security. We review them at least annually.
Incident Response Plan
A written plan defines how we classify, contain, and report security incidents, with a first-24-hours checklist and a process for notifying affected clients.
Careful Data Handling
Client information is handled according to its sensitivity and securely returned or destroyed when an engagement ends. Vendors and tools that touch client data are reviewed against our vendor security policy.
Business Associate Agreements
P-Bon Consulting signs a Business Associate Agreement with every healthcare client before we access any system that may contain protected health information. The agreement sets out how we may use PHI, the safeguards we maintain, how quickly we report incidents, and what happens to PHI when the engagement ends.
Ask for a copy during your free Risk Review and we will walk through it with you.
Wlad Pierre-Francois, Ph.D.
Founder of P-Bon Consulting. Certifications: CompTIA Security+, CompTIA Network+, CompTIA A+, and Microsoft 365 Certified. CISSP and ITIL are in progress. Published HIPAA Security Rule researcher.
This page describes practices we follow today. No security program can guarantee protection against every threat, and nothing here is legal advice or a guarantee of regulatory compliance. We are glad to answer specific security questions before you decide to work with us — just ask during your free Risk Review.
Questions About How We Handle Your Data?
Book a free 30-minute Risk Review with Wlad. Ask anything about our security practices, and get an honest picture of your own.
Get My Free Risk Review →