PCS turns the regulation into questions you can actually answer, keeps the supporting document behind every answer, and produces the compliance record on the day somebody asks to see it.
Know what you have. Prove it is secured. Present the evidence. Most organizations run those as three separate projects, and they drift apart. PCS runs them as one loop.
Pistos Compliance Sentinel V1 will be released on September 10!
From that day your compliance lives in one place instead of a folder of spreadsheets and a hope.
New York's Department of Financial Services requires every covered entity to develop, deploy, and maintain a cybersecurity program. Until recently, the Certification of Material Compliance was the finish line: log into the DFS portal, find your agency icon, check the boxes, done.
That era is over. DFS placed strict due diligence obligations on insurance carriers, and carriers are now pushing those obligations downstream to the agencies and aggregators selling their products. Questionnaires that once asked Yes or No now ask if yes, show us the evidence.
The gap is rarely the control. It is the document that proves the control was there — and that is what fails an examination. PCS closes that gap by design: every answer carries its evidence, its date, and the name of whoever accepted it.
23 NYCRR Part 500 · 42 sections · Second Amendment effective 1 November 2023
Every part of PCS is one of these three steps, or feeds one of them. Nothing can be secured, or scored, until it is on a list — so the loop starts there.
Your equipment, your software, and your people.
Those are the three things that can be attacked, and the three that have to be secured. PCS keeps a live list of each: every machine and how it is protected, every application and whether you could survive losing it, every person and what they are allowed to reach.
Saying a control is in place is not the same as it being in place.
PCS scans your workstations, your applications, your Microsoft 365 or Google tenant, your line-of-business systems — your agency management system, your practice management system, your ERP — and everything of yours facing the internet — then reports, control by control, what is switched on and what is not.
When somebody asks, you produce it.
Risk assessment and risk register, the scored results of every scan, who took which training and when, your disaster recovery and incident response plans, your asset inventories, and your security policies. Current, dated, and in one place.
Run them as separate projects and they drift: the inventory goes stale, the scans check last year's machines, and the evidence gets thrown together in the week before an examination. PCS runs them as one loop. Your inventory decides what gets scanned. Your scans become your evidence. Your evidence is ready before anyone asks.
The regulation in language you can actually read, and the policies that answer it section by section. One piece of work, several frameworks satisfied at once.
PCS restates every section of 23 NYCRR Part 500 in plain language, alongside the regulatory text itself. No one has to interpret a statute before they can act on it.
A regulation your staff can read without a lawyer.Every policy carries its mapped references — the DFS sections it answers, and the HIPAA, ISO and NIST requirements that share the same underlying control. Clients with more than one obligation do not do the work twice.
Written once. Counted everywhere it applies.
NY DFS requires two things: that you run a cybersecurity program, and that you can prove it. PCS turns each requirement into a plain question you can answer — and gives you the tools to put evidence behind every answer.
Thirty controls, each a plain question with evidence behind it — scoped, evidenced, weighted, and scored.
Applicability is set per control. A rule about a data center you do not have is marked out of scope — with the reason written down.
Each answer carries a document, a date, and the name of whoever accepted it. Nothing rests on recollection.
Inherent risk and risk addressed are tracked separately, so remediation effort goes where it actually moves your exposure.
Your score, and how it compares with the rest of the portfolio — so the number means something outside your own four walls.
The number on the front page is worked out from the answers — which means it moves when the answers move, and never because somebody decided it should. We do not score you against a rule that does not apply to you, and the reason it does not apply is on the record.
Three inventories sit under everything else PCS does. They are not paperwork — they are the denominator.
Asset tag, serial, operating system, owner, encryption state, and endpoint protection — the record that turns “we encrypt our laptops” into something an examiner can verify.
Application, version, owner, and business criticality — feeding both the supported-software controls and the recovery priorities in your DR plan.
The roster behind access review, offboarding, and training completion. Without it, “are your people trained?” has no denominator.
“Is every machine encrypted?” cannot be answered until PCS knows every machine. “Are your applications supported?” needs the software list. “Are your people trained?” needs to know who your people are. Scripts populate most of each list for you — but the list has to exist before any control above it can be scored honestly.
Your mail, your website, your tenant, and every door facing the internet — scanned by Skopein, with findings that file themselves.
Internal network, external perimeter, web application, and tenant configuration. It runs on its own and reports when it is finished — no analyst has to sit with it.
Findings are framed against the frameworks that govern you and paired with step-by-step remediation instructions — not a generic CVE list somebody still has to interpret.
Every finding lands on the control it answers, with the date it was found. Nobody retypes anything, and your score moves because the scan moved it — not because somebody remembered to update a spreadsheet.
560 courses, 14 documentaries, and 4 games — from what a phishing email looks like, up to governing your agency's use of AI.
Rich infographic modules with generated voice-over and a graded quiz at the end. The syllabus is current — AI governance is on it, which most awareness libraries still lack.
Not decoration. People finish them, and a finished course is the evidence the control needs. Completion is what the framework asks for; engagement is what produces it.
Who took it, which course, what date — recorded against the person and filed against the control that asks whether your staff are trained. When somebody asks for proof of security awareness training, that record is the answer.
The plan for what happens next is written while everyone is calm. A plan written calmly in September is worth more than one improvised at two in the morning in March.
Playbooks for phishing, account compromise, ransomware, and data breach — with roles, escalation paths, and notification obligations already decided.
Recovery priorities tied directly to your application inventory, so the order of restoration reflects what your business actually cannot run without.
Each step is marked off with a time and a note as it is completed, so the record of what you actually did builds itself while you are doing it. “We responded within the hour” is a claim; a timestamped step list is evidence — and that record is what your carrier and your regulator will ask for.
Every artifact is versioned, dated, and mapped against the eight authoritative frameworks Pistos supports. When a regulation amends, the mapping updates — and PCS flags the evidence that needs refreshing before it goes stale.
Skopein produces the technical findings. Mathisi produces the workforce records. Both write directly into the PCS assessment — they are not separate modules to reconcile.
One place to point at, on the day they ask.
One number, worked out from the answers, with the whole assessment standing behind it.
Every document, dated, attached to the control it answers — and to the section of the regulation that control satisfies.
Training taken, scans run, incidents handled — with times, so the sequence of events is not a matter of memory.
Every Aegis engagement runs on PCS. The only question is who fills the CISO role.
A former Big-X partner is responsible for your compliance program, regulatory filings, board reporting, and examiner interactions — with PCS running the program continuously behind them.
Your internal CISO keeps ownership — and gains a platform that produces the configurations, policies, training, DR/IR plans, and reports they would otherwise assemble by hand.
Scripts populate most of each one for you. What is left is the handful of facts only you know.
We load the data, reconcile it, and resolve the inconsistencies every inventory turns up — before the first assessment runs against it.
You supply only what PCS cannot know on its own — your cyber insurance evidence, your organizational structure, and the judgment calls that are genuinely yours to make.
From release day, your compliance lives in one place instead of a folder of spreadsheets and a hope. If the timing is going to be a problem, tell us early rather than on the day — we can work with a late inventory, not with a surprise.
Tell us about your stack, your frameworks, and your headcount. We will show you exactly what PCS produces for an organization like yours.
Request a briefing