Find it before they do.
A best-practice security audit of your UniFi network, and the engineering to get you compliant with HIPAA, SOC 2 and NIST CSF. You get a ranked punch list of what is and is not compliant, the fix for each, and the team that makes the changes.
A sample audit · 6 findings, ranked by risk
- SHARED LOGIN · NO MFAVENDOR VPN · SOC 2 CC6.1
- RDP 3389 OPEN FROM WANUDM PRO · SOC 2 CC6.6
- NOT SET UP · 7-DAY LOGSSYSLOG / SIEM · HIPAA §164.312(b)
- CAMS ON USER VLANPRO 24 POE · NIST CSF PR.IR-01
- STAFF WI-FI: WPA2-PSKU7 PRO ×8 · NIST CSF PR.AA-03
- SMBv1, UNPATCHED 14MOEHR SERVER · HIPAA §164.308(a)(5)
Ten areas, checked against best practice.
An engineer reads your configuration the way an attacker would, then the way an auditor would, and ranks what they find by risk.
- 01
Firewall policy & WAN exposure
Every rule, port forward and NAT entry, checked against what actually answers from the internet.
- 02
VLAN segmentation
Guest, IoT, cameras, clinical and payment systems each in their own VLAN, with a reason for every path between them.
- 03
Routing & inter-VLAN policy
Default-deny between trust zones, with no “allow all” rule left over from go-live.
- 04
IDS / IPS
Enabled on the right zones, signatures current, and alerts going somewhere a person reads them.
- 05
Logging & audit trails
Remote syslog, retention that meets your framework, and every admin action tied to a named account.
- 06
Wireless security
WPA3 or 802.1X on staff SSIDs, guest isolation, protected management frames, rogue-AP detection.
- 07
Open CVEs & firmware
Every device on current, supported firmware, known CVEs closed and end-of-life hardware flagged.
- 08
Port security & 802.1X
Unused ports shut down, access ports locked to a MAC, RADIUS or MAC auth where a device cannot do 802.1X.
- 09
Admin access & MFA
Named accounts, MFA on the console, least privilege, and vendor access that expires.
- 10
Remote access & VPN
Who can reach the network from outside, how, and whether that tunnel would pass your framework. WireGuard or Teleport over legacy L2TP.
Three frameworks, implemented.
We implement the network-side controls for the frameworks below and hand you the evidence. Your auditor attests. We do not audit our own work.
HIPAA: Security Rule · 45 CFR Part 164
For anyone who creates, receives, maintains or transmits electronic protected health information. On the network: clinical systems segmented from everything else, encrypted transport, audit logs that can name a person, and access that expires.
- §164.312(a) Access control
- §164.312(b) Audit controls
- §164.312(c) Integrity
- §164.312(e) Transmission security
SOC 2: Trust Services Criteria
For service organizations proving security, availability and confidentiality to their customers. On the network: boundary protection, logical access with MFA, encrypted transmission, and the monitoring that shows the controls are real.
- CC6.1 Logical access
- CC6.6 Boundary protection
- CC6.7 Transmission
- CC7.2 Monitoring
NIST CSF: Cybersecurity Framework 2.0
The common language for government, defense and critical-infrastructure work. On the network: identity and access control, segmentation and resilience, continuous monitoring, and a risk register that lists real CVEs.
- PR.AA Identity & access
- PR.IR Infrastructure resilience
- DE.CM Continuous monitoring
- ID.RA Risk assessment
UniFi can also be configured to meet PCI DSS where card data touches the network. It cannot currently be attested under FIPS 140 or CJIS; see the questions below. Our own posture is published in the Trust Center.
Questions
What we do, what we do not, and what the frameworks require.
Not formally. We are not a recognized auditing firm, so we cannot issue your SOC 2 report or certify HIPAA compliance. What we do is run the technical assessment, hand you a punch list of what is and is not compliant on the network, and then make those changes. When it is time to attest, you bring in an independent firm. We cannot audit our own work, and you would not want us to.
If you want a pass or fail, hire an auditor. If you want to reach compliance, we find the gaps, close them on the network side and leave you with the evidence an auditor needs. Most clients do both: we get them there, and the auditor confirms it.
A punch list ranked by risk. Every item names the finding, the control it maps to and the fix, including which fixes we have already made. With it comes the evidence package: configuration exports, firewall and VLAN documentation, and logging proof your auditor can use.
Read-only access to your UniFi console, the framework you are working toward, and about two weeks. For the implementation phase we schedule change windows from the NOC so nothing moves during your business hours without a plan.
Yes. HIPAA applies to anyone who creates, receives, maintains or transmits protected health information, regardless of size or tax status. A common misunderstanding is that it only applies when money changes hands. It does not: under the law, a transaction is the electronic exchange of health information to carry out care, such as a referral or an eligibility check, not a payment. A nonprofit or free clinic is still covered, and it is federal law. The good news is that HIPAA is one of the easiest standards to achieve on the network side.
Yes. UniFi can be configured to meet HIPAA, SOC 2 and PCI DSS, and we do it regularly: segmentation, encrypted transport, audit logging, MFA on the console, IDS/IPS and current firmware are all there. The two it cannot currently satisfy are FIPS 140 and CJIS. FIPS 140 is the NIST standard for validated cryptographic modules, required by federal agencies and some defense contracts, and UniFi does not ship FIPS-validated cryptography. CJIS is the FBI security policy for anything that touches criminal justice information, such as police, courts and corrections, and it requires FIPS-validated encryption, so it inherits the same gap. If you need either, we will tell you up front and design around it.
Book the audit.
We need read-only access and about two weeks. You get a punch list you can act on.