For most small and mid-market businesses in the Chicago area, IT compliance comes down to three or four obligations, not thirty: whatever regulation covers your data (HIPAA if you touch health information, the FTC Safeguards Rule if you do any lending or financial services, PCI DSS if you take cards), whatever your largest customers demand in their contracts (usually a SOC 2 report or a security questionnaire), and two Illinois laws that apply regardless of industry, the Personal Information Protection Act and the Biometric Information Privacy Act.
These overlap heavily. Roughly a dozen controls satisfy most of what all of them ask for, which means you build one security program and produce evidence from it in different formats, instead of building three programs that duplicate each other.
This article organizes the landscape. It is not legal advice. Whether a specific obligation applies to your business is a determination for your attorney.
What is the difference between a regulation, a framework, and a contractual requirement?
They get used interchangeably and they are not the same. The distinction tells you who can punish you and what “done” looks like.
A regulation is law. It applies whether or not you agreed to it, and a government body enforces it. HIPAA, the FTC Safeguards Rule, the Illinois Personal Information Protection Act, and the Illinois Biometric Information Privacy Act are regulations. You do not opt out, and under BIPA a private citizen can sue you directly.
A framework is a structured set of controls you choose to follow. NIST Cybersecurity Framework, NIST SP 800-171, CIS Controls, ISO 27001. On its own a framework carries no penalty. Frameworks matter because regulations and contracts point at them: NIST SP 800-171 is a framework, and CMMC is the mechanism that makes it mandatory for defense contractors.
A contractual requirement is something a customer, partner, or insurer makes you agree to. SOC 2 is the clearest example. No law requires a SOC 2 report. Your enterprise customer’s procurement team does, and losing the contract is the penalty. Cyber insurance questionnaires and the security addenda in master service agreements belong here too.
Regulations set a floor you cannot negotiate, contracts set a bar that is negotiable but revenue-linked, and frameworks are the vocabulary both use. When someone says “we need to be compliant,” ask which of the three they mean, because the work and the deadline differ. PCI DSS is the hybrid: not a law, but a contractual standard the card brands impose through your merchant agreement.
Which compliance obligations actually land on Chicago-area businesses?
HIPAA. Covers providers, health plans, and clearinghouses, and also business associates, which is the category that surprises people. Handle protected health information on behalf of a covered entity, as an IT provider, a billing company, a shredding service, or a benefits administrator, and you have direct obligations and a signed business associate agreement. The Security Rule requires a documented risk analysis. That is the first thing requested in an investigation, and the thing most organizations either never did or did once, years ago.
PCI DSS. Applies if you accept, process, store, or transmit card data. Version 4.0.1 is in force and the requirements that were optional through March 2025 are now mandatory. Most businesses this size complete a self-assessment questionnaire rather than an onsite assessment, and the highest-value move is reducing scope: a validated point-to-point encryption terminal or a hosted payment page keeps card data off your network entirely.
SOC 2, as a customer requirement. An attestation report a CPA firm issues against the AICPA Trust Services Criteria. Type I describes controls at a point in time. Type II tests whether they operated effectively over a period, usually three to twelve months, and Type II is what enterprise buyers want. Budget six to twelve months for a first one, because it requires an observation window with the controls actually running.
CMMC, for the defense supply chain. If you hold a Department of Defense contract or subcontract, the Cybersecurity Maturity Model Certification program is in phased rollout. Level 1 covers Federal Contract Information, a self-assessment against 15 basic requirements. Level 2 covers Controlled Unclassified Information and is the 110 controls of NIST SP 800-171, self-assessed or third-party certified depending on the contract. Chicago-area machining, fabrication, electronics, and engineering firms are squarely in scope, and many learn it from a prime contractor’s flow-down clause. Check your contracts for DFARS clauses and check your Supplier Performance Risk System score.
FTC Safeguards Rule. This catches far more businesses than people expect. It reaches “financial institutions” as defined under Gramm-Leach-Bliley, and the FTC reads that broadly: auto dealers arranging financing, mortgage brokers and lenders, tax preparers, many accounting practices, collection agencies, and investment advisors not registered with the SEC. The rule requires a named qualified individual over the program, a written risk assessment, MFA for anyone accessing customer information, encryption in transit and at rest, access controls with periodic review, vendor oversight, a written incident response plan, annual reporting to a senior officer or board, and either annual penetration testing plus semiannual vulnerability assessments or continuous monitoring. Businesses holding information on fewer than 5,000 consumers are exempt from several of those items, not from the rule. If you run a dealership or an accounting firm in the Chicago suburbs and nobody has walked you through this, close that gap.
Illinois Personal Information Protection Act (PIPA), 815 ILCS 530. Requires notice to Illinois residents of a breach without unreasonable delay, reasonable security measures, and notice to the Illinois Attorney General for larger breaches. Personal information here covers medical information, health insurance information, and username-and-password combinations, not just Social Security and account numbers. Your incident response plan needs an Illinois notification path in it before you need it.
Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14. Its own section, below, because it earns one.
What is BIPA, and why should a Chicago business take it seriously?
BIPA is an Illinois law from 2008 regulating the collection of biometric identifiers: fingerprints, retina or iris scans, voiceprints, and scans of hand or face geometry. It matters more than most obligations its size because it gives private individuals the right to sue, with statutory damages, without proving they were actually harmed.
What it requires, in plain terms:
- A written, publicly available policy with a retention schedule and destruction guidelines, destroying data at the earlier of when the purpose is satisfied or three years after the person’s last interaction with you.
- Informed written consent before collection. Tell the person in writing what you are collecting, the specific purpose, and how long it will be stored and used, and get a written release. As amended in 2024, an electronic signature counts.
- No selling, leasing, trading, or otherwise profiting from biometric identifiers.
- No disclosure without consent, with narrow exceptions.
- A reasonable standard of care in storage and transmission, at least as protective as how you handle other confidential information.
Why the exposure is real. BIPA carries statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, or actual damages if greater, plus attorneys’ fees. In Rosenbach v. Six Flags (2019) the Illinois Supreme Court held a person need not allege actual injury to sue. A 2024 amendment (Public Act 103-0769) limited recovery to a single violation per person per method of collection, which reduced the per-scan accumulation behind the largest exposure figures, but it did not change the underlying obligation or the availability of class actions.
This is not a tech company problem. The common Illinois fact patterns involve ordinary employers: fingerprint time clocks where the vendor handles it and nobody collects consent or publishes a retention policy, fingerprint or facial recognition door access at a warehouse, voiceprint authentication in a call center, facial recognition a newer camera system enabled by default, and payroll or workforce platforms collecting biometric data on your behalf. Using a vendor does not move the obligation off you, and your contract has to address it.
What to do, on the IT side. Inventory every system that collects a fingerprint, face scan, hand scan, or voiceprint, including vendor-operated ones and camera features nobody turned on deliberately. For each, confirm a signed written release from every enrolled person, a published retention and destruction policy, a destruction process that actually runs, and access controls and encryption around the stored template. Then have employment counsel review the consent language, because the wording of the release is a legal question and getting it wrong is the whole ballgame.
If you are in Chicago or the Chicago suburbs and you use a biometric time clock, this is the most under-managed obligation on your list.
Where do these overlap, so you do not build three programs?
Across HIPAA, PCI DSS, SOC 2, CMMC, FTC Safeguards, and Illinois PIPA, the same controls appear under different names. Build these once.
| Control | Shows up in |
|---|---|
| Risk assessment, documented and refreshed | HIPAA, FTC Safeguards, SOC 2, CMMC, PCI DSS |
| Multi-factor authentication | FTC Safeguards, PCI DSS 4.x, CMMC, SOC 2, cyber insurance |
| Access control, least privilege, periodic review | All of them |
| Asset inventory | CMMC, PCI DSS (scope), SOC 2, HIPAA in practice |
| Encryption in transit and at rest | FTC Safeguards, PCI DSS, HIPAA, CMMC |
| Logging and monitoring, with retention | PCI DSS, CMMC, SOC 2, HIPAA |
| Vulnerability management and patch cadence | PCI DSS, CMMC, FTC Safeguards, SOC 2 |
| Backup and tested recovery | HIPAA contingency planning, SOC 2 availability, CMMC |
| Security awareness training | HIPAA, PCI DSS, CMMC, FTC Safeguards, SOC 2 |
| Vendor and third-party management | HIPAA (BAAs), SOC 2, FTC Safeguards, CMMC flow-down, BIPA |
| Written incident response plan, tested | All of them, plus Illinois PIPA notification |
| Written policies, approved and dated | All of them |
If a consultant proposes a separate program per obligation, push back. The difference is usually scope and evidence format, not the control itself. HIPAA cares about the same access review SOC 2 does, it just cares about it around protected health information.
What is the minimum evidence set that satisfies most of them at once?
Auditors, enterprise customers, and insurance underwriters all ask for documents. Assemble this set and you can answer most of them without a fire drill. Date everything, keep prior versions, keep it in one place.
- The policy set. Information security, acceptable use, access control, incident response, data retention and destruction, vendor management, business continuity. Approved, dated, reviewed annually.
- A current asset inventory. Endpoints, servers, network devices, cloud tenants, SaaS applications, and who owns each. Everything else depends on this.
- A data map. What sensitive data you hold, where it lives, who can reach it, how long you keep it. This makes scope arguments possible and tells you whether BIPA or HIPAA apply at all.
- A written risk assessment, refreshed annually, with the decision recorded for each risk.
- Identity and access evidence. An MFA coverage report, a signed quarterly access review, and onboarding and offboarding tickets showing accounts get created and disabled on time.
- Endpoint protection coverage report, deployed agents against the asset count.
- Patch and vulnerability reports, showing cadence, exceptions, and the reason for each.
- Backup job logs plus a dated restore test report with start and finish times.
- Security awareness training records and phishing simulation results.
- Vendor file. The list, contracts and their security terms, signed BAAs where HIPAA applies, and collected SOC 2 reports.
- Incident response plan with named contacts, a tabletop exercise on record, and the Illinois PIPA notification steps.
- Log retention evidence, what is collected and how long it is kept.
Keep those twelve current and a customer security questionnaire, a HIPAA inquiry, a PCI self-assessment, an insurance renewal, and a SOC 2 auditor’s first request list all come out of one folder.
What this looks like for a small or mid-market business in the Chicago area
The Chicago metro is manufacturing and distribution, professional and financial services, healthcare, and a defense and aerospace supply chain running through the northwest suburbs. Most businesses here carry more than one obligation at once and none have a full-time compliance person.
Combinations that recur in Chicago and the Chicago suburbs:
- A manufacturer with a defense customer and a fingerprint time clock. CMMC Level 2 through a prime contractor flow-down, plus BIPA on the time clock. Two obligations, one IT environment, one program.
- An accounting or wealth advisory practice. FTC Safeguards applies and most partners have never heard of it, plus Illinois PIPA, plus client security questionnaires.
- A specialty medical practice or healthcare vendor. HIPAA as covered entity or business associate, PCI on patient payments, PIPA on breach notification.
- An auto dealership group. FTC Safeguards, PCI, PIPA, and often BIPA if the service department uses biometric access or time tracking.
- A growing services firm selling upmarket. No regulation applies directly, but a large customer’s procurement team wants a SOC 2 Type II and the deal is on hold.
The sequence is the same every time. Determine which obligations actually apply and put that in writing with your attorney rather than guessing. Build the twelve-item evidence set once. Map each obligation onto the controls you already have and find the real gaps, usually MFA on a legacy application, an access review nobody performs, an untested backup, and vendor contracts nobody has read. Then put it on a calendar, because compliance is not a project that ends. It is a set of recurring tasks with dates on them.
RJ2 Technologies has served Chicago-area businesses since 1998 and is headquartered in Deer Park, Illinois. Engineers working downtown use a drop-in space at 333 S. Wabash Ave., Suite 2700, which is a working space rather than a staffed office. Compliance takes an IT program and legal judgment, and they are not the same work. Your IT provider builds and operates the controls and produces the evidence. Your attorney determines which obligations apply and reviews your consent language, your notices, and your contracts.
RJ2 supports SOC 2 Type 2, ISO 27001 and CMMC requirements, and a partner specialist provides audit assistance and setup under a separate agreement. RJ2 has supported clients through the technology segments of ISO 27001 audits, and for CMMC it works through a partner that is CMMC certified. To find out where your gaps are, start with a compliance gap conversation or an IT assessment: call 847-303-1194 or email sales@rj2t.com.
Frequently asked questions
Which IT compliance rules apply to a small business in Illinois?
Every Illinois business holding personal information about Illinois residents is subject to the Illinois Personal Information Protection Act, which requires reasonable security measures and breach notification, and any business collecting fingerprints, face scans, hand scans, or voiceprints is subject to the Biometric Information Privacy Act. Beyond those two, obligations depend on what you do: HIPAA for health information, PCI DSS for card payments, the FTC Safeguards Rule for lending and financial services including many accountants and auto dealers, and CMMC for Department of Defense contractors. Confirm which apply to you with your attorney.
Is SOC 2 required by law?
No. SOC 2 is an attestation report against the AICPA Trust Services Criteria, and no law requires it. It becomes mandatory when a customer contract requires it, which is common when you sell to enterprises or hold customer data. The penalty for not having one is commercial rather than regulatory, meaning lost or delayed deals.
Does BIPA apply to my company if we only use a fingerprint time clock?
Yes. A fingerprint time clock collects a biometric identifier and puts you within the statute. You need a publicly available written retention and destruction policy, informed written consent from every enrolled employee before collection, and reasonable protection of the stored data. Using a third-party time and attendance vendor does not shift the obligation away from you. Have employment counsel review your consent language, because the wording of the release is a legal question with statutory damages attached.
Do we need to be HIPAA compliant if we are not a healthcare provider?
Possibly. HIPAA reaches business associates, meaning any organization that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. That includes IT providers, billing and coding companies, document management and shredding services, some benefits administrators, and certain software vendors. If you have signed a business associate agreement, you have direct obligations under the Security Rule.
What is the fastest way to satisfy several compliance requirements at once?
Build the overlapping control set once and produce evidence from it in whatever format each obligation asks for. Multi-factor authentication, documented access reviews, an asset inventory, a written risk assessment, encryption, logging with retention, patch cadence reporting, tested backups, security awareness training, vendor management, and a tested incident response plan appear in nearly every framework and regulation on the list. Start with a data map so you know what you are protecting and where it lives.
How long does compliance work usually take for a mid-market business?
Closing the technical gaps commonly takes 60 to 120 days depending on what is missing and how much legacy infrastructure is involved. A first SOC 2 Type II takes longer because it requires an observation window, typically six to twelve months from the start of readiness work to a report you can hand a customer. CMMC Level 2 timelines depend on your current NIST SP 800-171 posture and on whether the contract requires third-party certification.