Managed Cybersecurity for Medical, Legal, and Financial Practices in Springfield, Dayton, and Columbus, Ohio
Security controls on every computer, watched around the clock, with a record of each control kept for the insurer, regulator or hospital system that asks. Run since 2004 for offices of 2 to 50 people that have no IT or security staff of their own.
Why a Practice Hires Us for This
In 2018 the Ohio Secretary of State ordered county boards of elections to bring in an outside team to assess their election systems (Directive 2018-15). Clark County’s board chose Clark State Community College, and Capstone’s owner served on its four-person team, checking the county’s systems against all 88 items in the CIS Elections Infrastructure Security Best Practices handbook: voter registration, tabulation equipment, network setup, access controls, written policies and incident response. The same checklist discipline is what a practice gets from us.
Cybersecurity for a regulated practice isn’t about buying a single product. It’s about building a set of layered controls that work together, monitoring them continuously, and producing documented evidence that the controls are operating. Your cyber insurer asks specific questions on their application. Your regulator expects to see specific safeguards during an examination. Your clients and referral sources increasingly require proof that you’re protecting their data. Generic antivirus and a firewall don’t answer those questions.
Capstone builds and manages a security program around your practice — monitoring, detection, response, email security, access controls, training, policy, and documentation. Every control is maintained on an ongoing basis and leaves a record as it runs. When your insurer, examiner, or client asks “what safeguards do you have in place?” the answer isn’t a verbal assurance — it’s put in writing from those records, with timestamps.
How the Security Layers Work
Each card below says what the control does for your office, with the term your insurance application uses in parentheses. Which layers you get depends on the tier you choose, and every tier is priced on the pricing page. Together they form a documented security program that supports insurance applications, regulatory examinations, and client due diligence.
Monitoring and Response, Around the Clock (MDR)
Software on every workstation and server watches for the behavior of an attack, not just known viruses. A 24/7 security operations center reviews what it finds, and a compromised machine can be isolated before your staff arrives in the morning. Deployment records are kept for your insurer.
Blocking Bad Email and Bad Links (Email Security, DNS Filtering)
Filtering stops phishing, spoofed sender addresses, malware attachments and impostor emails asking for a payment before they reach the inbox. Encrypted email is set up for sensitive messages, which HIPAA requires for patient information. Web filtering on every device, in the office and at home, blocks the destination if a bad link does get through and someone clicks it. Retention and archiving settings are matched to your regulatory requirements.
Logins, Passwords and Stolen Credential Alerts (MFA, Dark Web Monitoring)
Multi-factor authentication on email, remote access and administrator accounts. A password manager so everyone uses unique, strong passwords without sticky notes. Access limited by role, so people see only the data their job needs. Login records from all your systems are collected in one place (SIEM), so an odd login time or place becomes one alert for the analyst. We also watch dark web marketplaces and paste sites for your practice’s email addresses and passwords, and tell you right away when one turns up so it can be changed before anyone uses it. Monitoring reports are kept on record.
Finding the Gaps and Writing the Rules (Cybersecurity Risk Assessments, Policy Development)
Written security policies covering acceptable use, incident response, data handling, remote access and business continuity, developed for your practice and aligned to the CIS Controls, the NIST Cybersecurity Framework and the regulations for your industry. Annual policy reviews and staff acknowledgment tracking are quoted as a project. A structured risk assessment against the same frameworks finds the gaps in your current controls, maps them to your regulatory and insurance requirements, and produces a prioritized remediation plan. Most regulatory frameworks and many cyber insurance applications require one every year. We conduct the assessment, deliver the findings, and implement the remediation. The full assessment and the remediation that follows are quoted as project work. The free 15-minute assessment is the place to start.
Teaching Staff to Spot a Phish (Security Awareness Training)
Ongoing training, with practice phishing emails sent to your staff to test how they respond to realistic attacks. Completion tracking and certificates for every staff member, kept on record for your insurer. Phishing results are documented with click rates, report rates and the trend over time. Roughly 2 to 3 hours per employee per year.
Help When Something Gets Through (Incident Response)
When an incident occurs, the 24/7 SOC contains the threat and preserves forensic evidence, and we coordinate the response. A written incident response plan for your practice, and the reviews that keep it current, are quoted as project work. If a reportable breach occurs, we help you work through notification requirements, coordinate with your insurance carrier, and supply the technical documentation the investigation requires, as hands-on work at the published rate.
“Our company started working with Capstone Technologies Group in early 2020 for IT issues that we were having. Brian has been awesome to work with throughout our time with his business. Anytime we call him for assistance he is always prompt helping solve any problems we may have. If the issues cannot be solved from his office he comes out to our work site. Brian is always very friendly and professional. I would highly recommend his company for any IT issues. We look forward to having a long working relationship with his company and would recommend him for anyone else looking for assistance that is reasonably priced and first rate in consumer service.”
What We Can Document for You
When an insurer, auditor or hospital system asks how your controls are set up, we put the answer in writing from the records of what’s actually in place. That’s hands-on work at the published hourly rate.
✓ Privileged access documentation
✓ Password manager status
✓ SOC monitoring summaries
✓ Patch & vulnerability summary
✓ Vulnerability scan results
✓ Secure remote access config
✓ Backup test results
✓ Business continuity & disaster recovery plan
✓ Encrypted email configuration
✓ Retention/hold settings
✓ Phishing simulation results
✓ Policy acknowledgment records
Kept current as the services run. Ready for insurance applications, regulatory examinations, and audit documentation requests.
Frameworks and Standards We Work With
Our controls and records line up with the CIS Controls and the NIST Cybersecurity Framework because those are what insurers and examiners use as their benchmark, so the answers to an underwriter’s questions map straight to them.
“I have worked with Brian over the past 20 years. He has always operated in a professional manner. Brian is a man of integrity and dependability. His commitment to clients and projects is second to none.”
Industry-Specific Cybersecurity
The security controls are the same across industries. What changes is the regulatory framework, the documentation requirements, and the specific systems your practice depends on. Each industry page covers the regulations, controls mapping, and evidence requirements for your vertical.
Frequently Asked Questions
Antivirus and a firewall are two controls out of dozens that your insurer and regulator expect. Managed cybersecurity adds 24/7 monitoring, endpoint detection and response, email security, identity management, DNS filtering, training, policy development, and documented evidence that all of these controls are operating. The difference is both the breadth of coverage and the documentation — a managed program leaves a record of every control in operation, not just a software license.
EDR (Endpoint Detection and Response) is software installed on each workstation and server that monitors for suspicious behavior and can isolate a compromised device. MDR (Managed Detection and Response) wraps EDR with 24/7 human analyst review through a Security Operations Center. EDR detects the alert; MDR ensures a trained analyst evaluates it, determines whether it’s a real threat, and responds appropriately — including at 2am on a Saturday.
A risk assessment evaluates your current IT environment against a security framework (we use CIS-CSAT, CIS RAM v2.1, and NIST CSF) to identify gaps in your controls, prioritize remediation, and produce documentation. Most regulatory frameworks and many cyber insurance applications require one annually. Some regulations, like HIPAA, require a Security Risk Analysis as a specific, documented deliverable. We conduct the assessment and implement the remediation — it’s not a report that sits on a shelf.
Yes. Cyber insurance applications ask specific questions about your security controls — do you have MFA, do you test backups, do you have an incident response plan, do your employees receive security training. We answer those questions in writing from the records of what’s in place; compiling it is hands-on work at the published rate. We also coordinate with your broker during the application or renewal process if they need technical clarification.
The SOC evaluates the alert, determines severity, and responds according to your documented incident response plan. For most threats the first step is automatic: the affected computer can be cut off from the network within minutes while an analyst looks at it. The SOC analyst then investigates, determines the scope, and coordinates any additional response. For reportable incidents, we help navigate notification requirements and work with your insurance carrier. Each incident is documented in the monitoring platform for your tier, and we walk you through the record when you ask.
In most cases, yes. We assess your current environment during the initial review and deploy security controls around what you already have. Our monitoring integrates with Microsoft 365, Google Workspace, all major firewalls, and standard server/workstation configurations. If specific equipment needs to be upgraded to support required controls, we’ll tell you why and give you options at different price points.
Capstone Technologies Group has been providing managed cybersecurity to Ohio practices since 2004. If your current setup doesn’t produce documented evidence of your security controls — or if you’re not confident in how you’d answer the questions on a cyber insurance application — that’s a good starting point for a conversation.
Every security tier we offer is published with its price on one pricing page — you can see exactly what protection costs before anyone asks for your contact information.
We provide managed cybersecurity to practices in Springfield, where we’re based, and in Dayton and Columbus.
Find Out Where Your Security Stands
15-minute call to review your current security posture, identify the gaps, and determine what a managed cybersecurity program looks like for your practice.
Pick a 15-minute slot that works for you
Managed clients: we acknowledge every support request by phone, email or our portal by the end of the next business day.
Send us the details and we’ll follow up by the end of the next business day
