Start here
Security Baseline
A fixed-price external pentest and Microsoft 365 or Google Workspace review, with a written fix plan.
What's includedWhat we do
Managed IT services in Portland, built around security
One team for your help desk, your security and your audits. Start with a Baseline, then add the rest when you're ready.
Monthly
Managed IT and security
Help desk, endpoint protection with 24/7 monitoring, email security, patching and backups, on one monthly plan.
See plans
Per test
Penetration testing
Network, web app and API, cloud, phishing and wireless testing, with quarterly retests to prove the fixes held.
Testing services
Per framework
Compliance programs
HIPAA risk assessments, SOC 2 readiness, PCI DSS, CMMC and NIST 800-171, plus Oregon privacy and breach law.
Compliance helpHow we work
Most IT companies start by installing tools. We start by attacking.
Tools don't show you what an attacker can reach. A test does. So that's where every client starts, and where we come back to every quarter.
-
01
Test
We run a penetration test and review your Microsoft 365 or Google Workspace, so the plan is built on what an attacker can actually reach.
-
02
Fix
We close the gaps that matter most first, and document every change for your auditor and your insurer.
-
03
Run
Help desk, patching, backups, email security and 24/7 monitoring every month, with one named point of contact.
-
04
Retest
Every quarter we test again and send a report on what's fixed, what's still open and what needs your call.
Want to see the deliverable first? Every finding comes with evidence, a risk rating and how to fix it.
Get a sample reportWho we work with
Built for businesses that answer to someone
Auditors, examiners, insurers and big customers all ask about your security. We know what each one wants to see.
Healthcare and dental
Clinics, dental offices and behavioral health practices that need a real HIPAA risk assessment, not a checkbox.
HIPAA
Credit unions and finance
Credit unions, lenders and advisors with examiners to answer to and customer data to protect.
GLBA · FFIEC
Manufacturing and defense
Oregon manufacturers and defense suppliers getting ready for CMMC and NIST 800-171.
CMMC · NIST 800-171
Accounting and law
CPA and law firms with client files to protect. Tax preparers also need a written security plan under the FTC Safeguards Rule.
FTC Safeguards Rule
Technology and SaaS
Software companies that need a pentest report for a SOC 2 audit or a big customer's security review.
SOC 2
Retail and hospitality
Shops, restaurants and hotels taking cards in person and online, with a PCI DSS assessment to pass.
PCI DSS
Oregon compliance
Oregon already expects you to protect this data
If you hold personal information about Oregonians, state law sets the bar. A pentest and a written security program are how you show you cleared it.
Ask what applies to youGeneral information, not legal advice.
Every business
Reasonable safeguards and a 45-day breach notice
The Oregon Consumer Information Protection Act requires reasonable security for personal information, and notice to affected Oregonians within 45 days of finding a breach.
Larger data holders
No more grace period
The Oregon Consumer Privacy Act covers businesses that process data on 100,000 or more Oregonians (fewer if you sell data). Since January 1, 2026, the Attorney General can enforce it without a cure period.
Defense suppliers
NIST 800-171 applies today
If you handle Controlled Unclassified Information on defense contracts, the NIST 800-171 controls and CMMC self-assessments already apply.
FAQ
Questions we get asked
Don't see yours? Email hello@portlandsecureit.com and you'll get a straight answer.
How much do managed IT services cost in Portland?
Most Portland providers charge per user per month, and so do we: one flat rate per user on a 12-month term, plus a one-time onboarding fee. We quote it after a short call, once we know how many users and devices you have. The Security Baseline is one fixed price, credited to your plan if you sign within 30 days.
What is a penetration test?
An authorized, controlled attack on your network, apps or staff, done the way a real attacker would. You get a report of what we got into, how we did it and how to fix it.
Can you work with our in-house IT person?
Yes. Some businesses keep their IT person and bring us in for security, testing and compliance. We hand them the findings, help fix them and retest.
Do you only work in Portland?
We're onsite across the Portland metro, including Lake Oswego, Beaverton, Tigard, Tualatin and Hillsboro. Penetration testing and compliance work is remote, so we take those clients anywhere.
Will this help with our cyber insurance application?
Yes. We go through the questionnaire with you, show where you stand on controls like MFA, backups and endpoint protection, and fix the gaps before renewal.
See what an attacker sees, before they do
Book a Security Baseline. We test, you get a written fix plan and a live walkthrough, then you decide what's next.