IT that already knows your industry

Every business runs on two or three applications that matter more than everything else combined. For a medical practice it is the EHR and the imaging archive. For a dental office it is Dentrix or Open Dental plus the sensor drivers on the operatory PC. For a CPA firm it is Lacerte or Drake between January and April. For a distribution center it is the WMS and the handheld scanners on the pick line. An IT provider who has never touched those systems will keep your email working and still let your revenue engine sit dead for a day.

We started Orca IT in Gilbert in 2015 and we have spent the years since going deep instead of wide. That means we know that a dental image database and the image files themselves live in two different places and both have to be backed up. It means we know that a legacy CNC controller cannot be patched, so it gets isolated instead. It means we know that a real estate brokerage’s single largest financial risk is not ransomware. It is a spoofed wire instruction sent from a mailbox nobody enabled MFA on.

Vertical experience also changes the schedule. A manufacturer’s maintenance window starts when second shift ends, not at 5pm. A restaurant cannot take a firewall reboot at 7pm on a Friday. A school does its entire hardware refresh in the six weeks between graduation and the first in-service day. When we build a managed services plan, the calendar is part of the design.

The other half is regulation. Most of our clients sit under at least one framework, HIPAA, PCI DSS, FERPA, the GLBA Safeguards Rule, ATF recordkeeping, or a customer flow-down clause from a defense prime. We are an IT firm, not an auditor or a law firm. What we do is implement and document the technical controls those frameworks ask for, so that when your compliance officer, your insurer or your inspector asks a question, the answer already exists in writing.

Below is the map. Fifteen practices, each with its own checklist, its own vendors and its own failure modes. If you do not see yours, the commercial office page covers the standard professional-services stack we deploy most often, and we are happy to build something specific for you.

HIPAA, medical and dental

The Security Rule’s technical safeguards are the part IT owns: unique user IDs, automatic logoff, encryption of data at rest and in transit, audit controls, and integrity checks. In practice that means no shared logins at the front desk, full-disk encryption on every laptop, screen locks measured in minutes, EHR audit logs that are actually reviewed, and a signed business associate agreement from every vendor that can touch protected health information, including us.

• Unique named accounts and role-based EHR access
• BitLocker or FileVault on every device that leaves the suite
• Encrypted email or a portal for anything with PHI in it
• A current risk analysis your compliance officer can hand over

PCI DSS, retail, hospitality, any card acceptance

Card data is a scope problem before it is a security problem. The cheapest path to a clean self-assessment questionnaire is to shrink what is in scope: put payment terminals on their own VLAN, keep guest and staff traffic off it entirely, use EMV and point-to-point encrypted readers so raw card numbers never land on your network, and lock down remote access to the point-of-sale server.

FERPA and CIPA, schools and training centers

Student education records need controlled access and a defensible record of who saw what. Filtering, rostering and single sign-on all touch student data, so every ed-tech vendor needs a data privacy agreement. Schools taking E-Rate funding also carry CIPA filtering and internet safety policy obligations.

GLBA and the FTC Safeguards Rule, accounting, tax, advisory, lending

The amended Safeguards Rule expects a named qualified individual, a written information security program built on a documented risk assessment, multi-factor authentication for anything holding customer information, encryption, access reviews, vendor oversight and a written incident response plan. Tax preparers carry the parallel IRS obligation to maintain a written security plan.

ATF recordkeeping, FFL dealers, ranges, gunsmiths

Electronic acquisition and disposition records and electronic 4473s are permitted under specific ATF conditions covering retrievability, backup, protection from unauthorized alteration and the ability to produce printed records on request. The IT side is retention, controlled access, verified backup and an audit trail.

CMMC-adjacent manufacturing

If a defense prime flows DFARS clauses down to you, the underlying control set is NIST SP 800-171: controlled unclassified information has to be identified, segmented, encrypted, logged and access-controlled. Most East Valley shops we meet are somewhere in the middle of that, and the first useful step is knowing which machines and shares actually hold covered data.

The regulator does not care that your vendor did not know. Neither will your insurer.Orca IT, Gilbert AZ