Industries We Serve. Do you understand my industry?
That is the only question that matters when you hire a cybersecurity, compliance, or managed IT partner.
Petronella Technology Group is the vertical-specialist MSP, cybersecurity firm, and compliance consultancy headquartered in Raleigh, North Carolina. For 24 years we have served healthcare and dental, defense contractors and manufacturers, law firms, financial services and accounting, construction and auto dealers, and the nonprofits and small businesses that anchor the Triangle economy. You will not get a generic security stack from us. You will get a team that already knows what your auditor, your regulator, your insurance carrier, and your attackers want.
Penny answers within two rings. Credentialed team member runs the call.
The first question every regulated buyer actually asks
When a dental group owner, a shop floor manager at a defense subcontractor, a managing partner at a boutique law firm, or a CFO at a mid-sized CPA practice calls a cybersecurity company, they are not comparing feature lists. They are listening for one thing. Does this person understand my world? Can they name my auditor? Do they know what my day looks like when the EHR goes down, when the DCMA letter arrives, when opposing counsel subpoenas our backup tapes, when the state bar sends a technology-competence inquiry, when the C3PAO is scheduled for next quarter and nobody has written the System Security Plan?
That question is not paranoia. It is pattern recognition. Every regulated buyer has watched a previous IT vendor get out of their depth at the worst possible moment. A horizontal generalist cannot produce a HIPAA Risk Analysis that an OCR regulator will accept. A solo consultant cannot run a 24/7 security operations program in February when your CPA firm hits peak tax season and attackers know it. A national MSP with a Raleigh help desk sticker has never actually sat across a desk from a Cyber AB assessor watching them audit your CUI boundary. There is a baseline of vertical fluency that either exists in a firm or it does not, and it takes years to build.
We built it across 24 verticals and sub-verticals over 24 years. The team at Petronella Technology Group spends its days inside these industries. Our founder Craig Petronella wrote books on ransomware response and cyber warfare and has testified as a Digital Forensic Examiner (DFE credential number 604180). He is also MIT-Certified in AI and Blockchain. Our entire team holds the CMMC Registered Practitioner credential. The firm is a CMMC-AB Registered Provider Organization (RPO #1449), verifiable on the Cyber AB member registry. We hold PPSB accreditation from the North Carolina Private Protective Services Board. We have been BBB A+ accredited continuously since 2003. Those are not marketing claims; they are filings and registrations a buyer can verify in about three minutes.
If you came here trying to evaluate whether a Raleigh-based cybersecurity company can actually move the needle inside your specific industry, you are in the right place. The rest of this page is organized the way buyers actually think. By vertical identity, by regulator, by the anxieties that keep founders and operators up at night, and by the sub-verticals within each industry where generic coverage falls apart.
Verifiable signals before we go any further
Regulated buyers verify firms before they trust them. Here are the four signals that hold up under that scrutiny, all confirmable by anyone with a browser.
What regulated buyers actually fear, and how we respond
Every vertical has a specific set of bad-day scenarios. If a cybersecurity partner cannot recite yours from memory and walk you through what they would do in the first 60 minutes, they do not yet understand your industry. Here are the scenarios buyers describe most often in the first conversation with us.
An on-call admin loses access to the electronic health record the morning of a surgery schedule. The question is not only how fast you restore. It is whether the incident triggers an HHS Office for Civil Rights notification and what the 72-hour clock looks like. We have the forensics team, the breach counsel relationships, and the playbook ready before the call happens.
A subcontractor gets a clause amendment from a prime that requires CMMC Level 2 certification by the next contract renewal. Nothing is in place. No SSP, no POA&M, no enclave, no assessor relationship. We have shipped this exact 90-day sprint for multiple shops in the Research Triangle and across the Defense Industrial Base.
A cyber insurance underwriter asks for multi-factor authentication coverage on the matter management system. The firm realizes that three equity partners have been refusing to use MFA because it is a hassle. The conversation that follows is equal parts technology, state bar Model Rule 1.1 and 1.6, and human psychology. We have had it many times.
A client receives a wire-fraud email spoofed to look like it came from the CPA. The FTC Safeguards Rule obligations kick in. So do the IRS Publication 4557 notification steps. So does the client relationship. We help you handle all three in parallel, not sequentially, and we do not disappear between April 15 and the next year.
A superintendent leaves a truck at a job site in Durham. The laptop walks. On it are plans, subcontractor banking information, and Microsoft 365 credentials with full mailbox access. We treat field devices as the primary attack surface and design your stack accordingly, not as an afterthought to a corporate network.
A SaaS founder gets deep into a procurement review with a mid-market enterprise customer. The procurement team asks for the SOC 2 Type II report. There is no report. There is no controls program. There are 11 weeks until the deal either closes or moves on. We run the readiness program, the control automation, and the auditor coordination in parallel, so the startup does not have to choose between shipping product and shipping compliance.
The six industries where we go deepest
Each card below represents an industry where Petronella has enough scar tissue to be useful on day one. Click into any vertical to reach the practice area page, where the sub-verticals, the frameworks, and the local context all live. The blog rows underneath each card are the spokes that feed the pillar, written for buyers who are still in research mode. When you want the deployment architecture instead of the identity story, the link at the bottom of each card jumps you to the matching solution stack.
Healthcare, Dental, and Clinical Research
If the EHR goes dark during a surgery morning, who is answering the phone at minute 14?
Threat landscape. Healthcare is the vertical where the cost of a misunderstanding gets written into the federal register. The 2026 HIPAA Security Rule update tightens encryption, access logging, and written risk analysis expectations. Ransomware groups have shifted from general targeting to explicitly hunting Protected Health Information because they know the leverage is higher. Dental practices now live under the same regulator as the hospital systems, but with a fraction of the IT budget. Clinical research organizations and sponsor sites add 21 CFR Part 11 on top of HIPAA. And Office for Civil Rights investigators have grown notably less forgiving over the last five years.
Regulatory pressure. Under this vertical we cover primary care clinics, specialty practices, dental groups running two to twenty chairs, ambulatory surgery centers, behavioral health providers, community health centers, clinical research sites, and the contract research organizations that support them. The question we try to answer first is not which product we will deploy. It is what your next auditor or regulator visit is going to ask, and whether the documentation will be there.
Defense Contractors, Manufacturers, and Engineering
If your prime flows down CMMC Level 2 tomorrow, is your System Security Plan already written?
Threat landscape. The Defense Industrial Base is the vertical where Petronella spends the most time. If you sell to the Department of Defense, touch Controlled Unclassified Information, sit anywhere in a DoD supply chain, or hold contracts covered by DFARS 252.204-7012 or 7020, CMMC 2.0 is the gate between you and your next award. Level 1 handles Federal Contract Information. Level 2 mirrors NIST 800-171 and applies to the majority of subcontractors handling CUI. Level 3 adds the enhanced controls your top-tier program requires. Manufacturers add the operational technology problem on top, because the PLCs and HMIs and SCADA nodes that run your line were never designed for modern threat actors, but now they sit one firewall away from the internet.
Regulatory pressure. Engineering firms and architecture practices bring their own twist. CAD environments are collaborative, file sizes are huge, drawings may be ITAR-controlled, and protecting design IP is both a compliance and a competitive concern. Our clients include machine shops, electronics manufacturers, aerospace engineers, civil engineering firms, and Tier-2 and Tier-3 subcontractors across the country. The shared question is how to reach Level 2 or Level 3 readiness without disrupting production while you do it.
Law Firms and Legal Services
If opposing counsel served a subpoena for your backup tapes today, could you produce them without exposing three other matters?
Threat landscape. Over the last decade law firms have moved from peripheral target to headline target for attackers. The reason is simple. Firms sit on privileged matter information, deal terms, intellectual property, personal data on every party, and in many cases client funds in escrow or IOLTA trust accounts. The American Bar Association's Model Rule 1.6 created a comment-level expectation that firms deploy competent technology safeguards. Model Rule 1.1 raised the bar on technology competence. North Carolina State Bar Formal Ethics Opinion 2011-6 specifically addressed cloud storage and client confidentiality. Cyber insurance carriers now underwrite the way a CISO would, and they price accordingly.
Regulatory pressure. Inside this vertical we work with solo practitioners running on Clio or PracticePanther out of a single office, boutique firms of five to twenty lawyers with a full practice management and document management stack, regional mid-market firms with multiple offices, specialty practices in intellectual property and healthcare law, and the occasional AmLaw 200 satellite office that needs NC-local field presence. The starting question is usually whether your current controls will satisfy the next malpractice insurance renewal, the next cyber insurance renewal, and the next state bar inquiry. Often all three have changed since the firm last looked.
Financial Services, Banking, and Accounting
On April 12, when a wire-fraud email spoofs your managing partner, which of the next five calls do you make first?
Threat landscape. Money attracts attackers. The financial services vertical stacks GLBA, SOC 2, PCI DSS, the FTC Safeguards Rule, state-level banking regulations, NYDFS (when a client operates into New York), and SEC cybersecurity disclosure requirements on top of every transaction. CPA firms and tax preparers became explicitly Safeguards-Rule-covered when the rule was updated, and most are still working out the specifics. Wealth management firms and registered investment advisers face SEC examiners who evaluate cybersecurity the same way they evaluate fiduciary hygiene. Community banks and credit unions operate under FFIEC examiners who are not advisory visits. Broker-dealers carry FINRA cybersecurity expectations on top of everything else.
Regulatory pressure. In this vertical we serve CPA practices from two-person shops through hundred-person mid-market firms, registered investment advisers with single-digit billions under management, insurance agencies, community banks and credit unions across the Carolinas, and the broker-dealer and wealth-management affiliates adjacent to them. The question we get asked first is almost always the same. How do we prepare for an examiner without spending the next 90 days pulling our team off client work to hand-assemble documentation that should have been produced on a schedule anyway?
Construction, Trades, and Auto Dealers
When a field laptop goes missing from a jobsite truck in Durham, who takes the next call from your payroll bank?
Threat landscape. Field-heavy businesses operate everywhere except inside a clean office. Construction crews carry tablets and rugged laptops between job trailers, portable scanners, cellular hotspots, and the main office. Auto dealers run a Dealer Management System, customer financing data, OEM partner integrations, a finance-and-insurance desk, and a service department that share one network and often one WiFi password. Both verticals became attacker targets over the last five years because operational downtime in a construction company or a dealership is measurably expensive, which justifies a ransom, and because high staff turnover plus shared logins create endless footholds.
Regulatory pressure. Within this vertical we cover general contractors, specialty trades (electrical, plumbing, HVAC, roofing), design-build firms, concrete and site work, and the engineering-construction hybrids common across the Carolinas. On the automotive side we cover single-rooftop and multi-rooftop dealers, independent service shops, body shops, and the F&I and fleet operations that sit alongside them. The starting conversation is usually about whether your field device program is actually enforceable in practice and whether your mobile workforce has a path to MFA that does not break productivity on a jobsite with bad cellular coverage.
Nonprofits, SaaS Startups, and Small Business
When procurement asks your founder for a SOC 2 Type II with 11 weeks on the clock, who runs the readiness sprint?
Threat landscape. Smaller and mission-driven organizations carry the same attack surface as enterprises on a fraction of the budget. Nonprofits hold donor lists, grant records, board governance documents, and, in many cases, client data protected under state privacy laws. They almost never have a dedicated IT person, and they often discover their security posture only after a wire fraud or a ransomware event. SaaS startups bump into SOC 2 Type II as soon as they move up-market, and they learn that building the controls while shipping product is a very different workstream from either one alone. Local small businesses discover cybersecurity through a payroll diversion, a CEO-fraud wire, or the cyber insurance renewal that unexpectedly comes back with new questions.
Regulatory pressure. Inside this vertical we serve 501(c)(3) nonprofits across arts, education, human services, and healthcare-adjacent missions; seed and Series A SaaS startups pursuing mid-market and enterprise customers; and small businesses across the Triangle and the Triad with anywhere from five to a hundred employees. The starting question is usually how to buy the right level of protection at a budget that does not require a capital raise, and how to make the board or the founders confident that the money is going somewhere that actually reduces risk.
The sub-verticals inside the sub-verticals
A vertical specialist who cannot go down a level is really a generalist in disguise. Inside each of the six industries above, the day-to-day reality splits further, and so does the Petronella playbook. Here is a partial map.
Healthcare is not one thing. A 12-operatory dental group in Cary does not operate like an ambulatory surgery center in Charlotte, which does not operate like a rural federally qualified health center in eastern North Carolina, which does not operate like a behavioral health telepsychiatry practice serving the whole state. A dental practice is dominated by practice management software (Dentrix, Eaglesoft, Open Dental), imaging archives, and claim clearinghouse connections. A surgery center adds anesthesia machines, scheduling integrations, and infection control software. A research site adds IRB workflows, sponsor portals, and 21 CFR Part 11 controls. An integrated system adds HL7 interfaces, FHIR endpoints, and patient portal entanglement. We have worked in all four shapes, and we scale the assessment and the controls to the shape you actually operate.
Defense is not one thing either. A 40-person machine shop supplying a Tier-1 aerospace prime is operationally nothing like a 300-person electronics manufacturer supplying radar subsystems, which is operationally nothing like a boutique engineering firm doing structural analysis for a shipyard, which is operationally nothing like a small software company whose only government exposure is a subcontract schedule line. CMMC Level 2 looks different inside each of these. Whether the right architecture is a full enclave, a segmented VLAN, a managed cloud CUI tenant, or a hybrid depends on your actual workflows, not a brochure. Our starting point is mapping the CUI lifecycle in your environment, then sizing the boundary to the workflow rather than the other way around.
Law firms split by matter type and size. A transactional M&A boutique has dramatically different document security expectations than a family-law practice, a public-defender office, or an intellectual property firm handling patent portfolios. A five-lawyer firm with one office is a different operational animal than a twenty-lawyer firm with offices in Raleigh and Charlotte, which is a different animal again than a mid-market firm with an eDiscovery practice area serving corporate clients. The controls, the document management hardening, and the incident response playbook all have to fit the firm.
Finance is a ladder. A two-person CPA practice using QuickBooks Online and Drake Tax has a very different technology reality than a 60-person regional firm with a tax, audit, and advisory practice, which is different again from a wealth manager with multiple registered investment advisers and a broker-dealer affiliate. FTC Safeguards Rule obligations hit all three. SOC 2 becomes relevant for the larger firms handling outsourced services. FINRA and SEC posture is only relevant further up. We map the obligation set to your actual license and client mix, then build the controls on top.
Field services and dealerships split by geographic span and asset count. A single-rooftop dealer in Garner is a different operation than a four-rooftop dealer with a centralized F&I and a regional service network. A general contractor running one job site in Cary is a different operation than the same firm running five concurrent jobs across the Triangle and the Triad. The number of field devices, the number of cellular endpoints, the number of payment touchpoints, and the number of OEM or supplier integrations all scale differently. We design field architectures for the operational shape you actually run.
Nonprofit and SaaS is a maturity curve. A 4-person 501(c)(3) running on Google Workspace and a single grant database has a very different posture than a 60-person social services nonprofit with case management, accounting, and a donor CRM. A pre-revenue SaaS startup has a different control burden than a Series A company with paying enterprise customers and a SOC 2 deadline. We meet you where you are on the curve and build the next 12 months of program work, rather than trying to install a Fortune-500 control set on day one.
Headquartered in Raleigh. On site across the Carolinas. National reach for everything that runs remote.
Our office is at 5540 Centerview Drive, Suite 200, Raleigh, NC 27606. From there we run on-site field support across four North Carolina economic regions plus managed services, security operations, and incident response to clients across the rest of the United States. The Triangle is the anchor. The rest of the state is the daily territory. The rest of the country is where our cloud-delivered practice serves clients who want our vertical depth without the geography constraint.
Local matters more in this industry than some buyers realize. When a CUI assessment is in progress, when an auditor arrives on site, when a ransomware incident requires physically rebuilding servers, or when a court-rule retention matter needs evidence handling by a credentialed examiner, a team inside the Carolinas answers faster and in person. Our primary on-site delivery footprint covers North Carolina. For national clients we partner with vetted field technicians under our quality system and manage them from Raleigh, so the buyer experience stays consistent.
24 years of narrowing in, not fanning out
Craig Petronella founded Petronella Technology Group in 2002. The firm started the way most MSPs start, doing mixed break-fix and managed services for local businesses. Over two decades, two things happened that reshaped what the firm does and the customers we serve.
The first was the slow migration from generalist managed services into regulated industries. As HIPAA enforcement matured, healthcare clients needed real HIPAA expertise rather than a best-effort friend. As CMMC emerged from the DFARS 252.204-7012 baseline, defense clients needed a Registered Practitioner on the engagement. As the ABA, the NC State Bar, and cyber insurance carriers all moved technology competence to the center of the conversation, law firms started requiring a firm that actually reads state bar ethics opinions and can quote them. We followed the work. By year ten, more than half our revenue was regulated-industry work. By year twenty, essentially all of it was.
The second was the deepening of our cybersecurity practice beyond managed services. Craig wrote books on ransomware response. He earned an MIT certification in Artificial Intelligence and Blockchain. The firm earned Digital Forensic Examiner credentials and PPSB accreditation for private-sector forensics work in North Carolina. We built the capacity to respond to a breach, run the investigation, handle the evidence, work with breach counsel, and stand up recovery, end to end, without handing the client off to three different firms.
The combination is unusual. Vertical specialists often do not have operational IT capacity. Generalist MSPs often do not have vertical or forensic depth. We sit in the middle with both. The trade-off is that we are picky about the industries we enter. If we cannot get to the depth that buyers in that vertical actually need, we do not pretend we can.
The four lessons that repeat across every regulated industry
Working in six headline verticals for 24 years surfaces patterns. Regulators differ, frameworks differ, and the specific control mappings differ, but a small number of mistakes show up in every industry. These four are the ones we now flag on the first call, because watching a buyer walk into any of them is the most painful preventable conversation in this work.
The first pattern is paperwork that was assembled, not produced. In every framework we touch (HIPAA, NIST 800-171, SOC 2, GLBA, FFIEC, FTC Safeguards), the difference between a passing assessment and a finding is whether the documentation looks like a record of ongoing operations or a hand-assembled artifact built in the week before the assessor arrived. Auditors and regulators can tell the difference instantly. The metadata, the version history, the cross-references, and the tone of the writing all leak the truth. A vertical specialist's first job is to make sure the documentation cadence matches the operational cadence so the artifacts produce themselves on schedule. We build that cadence into every engagement, regardless of industry.
The second pattern is treating compliance as a project rather than a program. Compliance projects end. Compliance programs continue. A SOC 2 Type II report is not the finish line; it is the receipt that proves you had a program for the prior observation period. A CMMC Level 2 certification is good for three years and assumes you continue to operate the control set during that window. A HIPAA Risk Analysis is supposed to be reviewed at least annually and after any material change. The buyers we see succeed are the ones who internalize that compliance is a steady state, not a sprint, and who treat their MSP partner as the operating arm of that steady state.
The third pattern is underestimating the human attack surface. Every breach we have investigated for a healthcare, defense, legal, financial, or nonprofit client traces back to a human at some point in the chain: a credential reused across services, a wire transfer authorized on a spoofed email, a USB drive plugged in by a contractor, a phishing link clicked on a phone during a busy week. Technical controls help, but a vertical specialist also has to build the awareness program, the executive scenario walk-throughs, the simulated phishing campaign, and the post-incident debriefs that change behavior. We treat the human layer as a discipline equal to the technical layer.
The fourth pattern is letting the assessor relationship become adversarial. A C3PAO, an OCR investigator, a state-bar ethics counsel, an FFIEC examiner, an SEC staffer, and an FTC enforcement attorney are not your enemy. They are the people who get to make a decision about your business, and they make it based on the evidence in front of them. The clients who handle these relationships well treat them with respect, candor, and prepared documentation. The clients who handle them poorly stonewall, hedge, or invent answers under pressure. A vertical specialist's job is to coach the management team into the first mode and out of the second. We do that explicitly with every client whose framework brings a regulator visit into play.
These four patterns are not industry-specific in their root cause, but the surface they appear on is always industry-specific. The healthcare version of "paperwork that was assembled" looks like a back-dated Risk Analysis with a signature page from a former employee. The defense version looks like an SSP whose control implementations contradict the actual network diagram. The legal version looks like a written information security policy that none of the partners have ever read. The financial-services version looks like an annual board report that no one delivered. Recognizing the pattern across verticals and translating it back into the vertical's own vocabulary is part of what a specialist does that a generalist cannot.
Every claim here is independently verifiable
We do not list awards or testimonials on this page. The list below is limited to credentials and registrations a buyer can confirm in under five minutes, because that is the bar a regulated buyer actually applies.
The regulators, auditors, and carriers we deal with every week
A vertical specialist's value shows up when an external party from one of these organizations sends your team a letter, opens an examination, or asks for a documentation package on a deadline. Knowing the regulator culture is half the job. Here is the operating reality of the ones we live with most often, organized by vertical so you can see whether your auditor or examiner shows up on the list.
HHS Office for Civil Rights (OCR). The OCR investigator who picks up your HIPAA breach notification has a procedural rhythm. They want a written Risk Analysis dated before the incident. They want documented evidence of access controls, encryption, audit logging, and workforce training. They want a Security Incident Report that distinguishes events from incidents. They escalate fastest when the documentation looks back-dated, sparse, or inconsistent with the actual technical environment. We have walked clients through OCR inquiries, corrective action plans, and resolution agreements, and the through-line is always the same: the work has to look like it was done on a normal cadence, not assembled in a sprint after the breach.
The Defense Contract Management Agency (DCMA) and Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). DCMA contract administrators and DIBCAC assessors both care about NIST 800-171 implementation, but they ask different questions. DCMA tracks contract compliance and flow-down clause performance. DIBCAC runs the high-confidence assessments that confirm a prime's or subcontractor's CMMC posture against the actual control set. We have helped clients prepare for both kinds of conversation, and the prep work is meaningfully different. The good news for buyers is that a single well-built program addresses both, if it is built honestly.
C3PAO assessors and Cyber AB Provisional Assessors. The C3PAO performing your formal CMMC assessment is doing a defined exercise: walking your System Security Plan and Plan of Action and Milestones against the 110 NIST 800-171 controls, sampling implementation, and producing a scored result. They are not consultants and they cannot help you remediate during the assessment. Our role as a Registered Provider Organization is to make sure your environment, your documentation, and your team are ready to be examined cleanly. We have coordinated assessments with multiple C3PAOs and we know what each one tends to focus on.
State bars and ethics counsel. The North Carolina State Bar's Authorized Practice committee, the State Bar Ethics committee, and the lawyer assistance program each have a distinct intake. When a firm gets a technology-competence inquiry, the question is rarely about the technical implementation; it is about whether the firm can demonstrate a written policy, an acknowledged training program, and a documented assessment of the risks. We help firms produce that documentation in language that aligns with Rule 1.1 and Rule 1.6 commentary, so the response shows the lawyer side as well as the technical side.
The FTC under the Safeguards Rule. CPA practices, tax preparers, auto dealers, insurance agencies, and a long tail of financial-services firms now sit under the FTC's Safeguards Rule. The FTC's enforcement posture has shifted in the last 24 months: the agency expects a designated Qualified Individual, a written Information Security Program, a written Risk Assessment, encryption, MFA on customer-information systems, secure development, an Incident Response Plan, and an annual report to the board or senior leadership. We have built and operated all of those for clients in each of the covered industries.
FFIEC and NCUA examiners. Community banks and credit unions live under examiner visits that are not advisory. The FFIEC Cybersecurity Assessment Tool, the FFIEC Information Technology Examination Handbook, and the NCUA's ACET have explicit expectations that examiners check against. We have helped client teams prepare for examination cycles by mapping their existing controls to the relevant FFIEC categories, identifying the most common findings before the examiner does, and rehearsing the conversation.
SEC and FINRA. Investment advisers and broker-dealers face SEC examiners and FINRA Risk Monitoring Analysts who evaluate cybersecurity controls during routine examinations and sweep exams. The SEC's amended Regulation S-P, the cybersecurity disclosure rules, and the new Cybersecurity Risk Management rules all impose documented program expectations. We help registered investment advisers and broker-dealers translate those requirements into a working program that survives an examiner walk-through.
Cyber insurance carriers and brokers. Underwriters now ask insured-quality questions: MFA coverage on all administrative access, EDR on every endpoint, immutable backup architecture, email security with brand impersonation protection, security awareness training, incident response retainer in place, and a maintained Business Continuity Plan. We help clients align their controls with the renewal questionnaire so the premium reflects the actual posture rather than a guess. We have caught renewals coming back lower year-over-year for clients who improved measurable controls in the prior cycle.
Customer security questionnaires. A modern mid-market or enterprise customer's vendor security questionnaire (SIG, CAIQ, or a bespoke spreadsheet) is now the most common cybersecurity touch a SaaS or services firm experiences. We help clients produce a defensible response, attach the right policy excerpts, and build an evidence repository that scales to the next 20 customer questionnaires without manual rebuilding each time.
What we say no to, and why that is part of the offer
A vertical specialist's value is also defined by the work they decline. Saying yes to everything is what produces the "out of their depth" moments that regulated buyers have learned to dread. Here is what we deliberately do not do, and why declining those engagements protects you when you do hire us.
We are not a C3PAO. Petronella Technology Group is a CMMC-AB Registered Provider Organization (RPO #1449). The Cyber AB framework requires legal separation between the firm that prepares you for a CMMC assessment and the firm that conducts the assessment. We could not be your C3PAO even if we wanted to, and we believe that separation makes both roles work better. We refer clients to accredited C3PAOs we trust and coordinate the assessment logistics on your behalf.
We do not run mobile phone forensics in the Cellebrite or Graykey style. Tablet and mobile forensic work in our practice is scoped to BYOD and corporate-mobile breach response only. We do not perform iPhone or iPad chip-off extraction. We do not jailbreak devices. We do not take private-investigator engagements or custody disputes. That work belongs with specialty forensic labs, and we will name three good ones if you need a referral.
We do not chase verticals where we cannot reach depth. If your industry sits outside our six headline verticals and the adjacent overlap is too thin to give you a fluent engagement on day one, we will say so on the first call. Examples we have declined: pure capital-markets institutional buy-side stacks, large-scale higher education central IT, niche petrochemical SCADA programs, professional sports franchise IT. Each of those requires specialist depth we have chosen not to build.
We do not offer break-fix without a security floor. Mixed break-fix and managed services with no security program underneath is how MSPs end up as the headline in a ransomware article. Every managed engagement we accept includes a security baseline, an EDR layer, a backup architecture, and a documented incident response path. If you only want IT support without a security floor, we are not the right firm, and we will tell you on the first call.
We do not publish testimonials for regulated clients. Most of our clients hold protected data: PHI, CUI, privileged matter information, GLBA-covered information, donor and client data. They do not want to be marketed with, and frankly we do not want to advertise them either. We will describe anonymized archetypes on the discovery call. We will not name clients without explicit written approval. That is the trade-off for working with us, and most buyers in regulated industries prefer it.
We do not stack discounts that we cannot honor at renewal. Some MSPs win the first year on aggressive pricing and recoup it on year-two renewal increases. Our pricing model is custom-quote for fixed-fee work, with the assumption that your engagement is multi-year. We would rather price honestly on day one than rebuild the relationship at the first renewal.
We do not run social media outreach against regulated buyers. Cold automation against healthcare CISOs, defense subcontractor program managers, or law firm CIOs is brand suicide and a slow path to LinkedIn account bans. If we meet you, it is because you searched for us, you were referred by a client or partner, or you accepted a polite intro. The same restraint we expect from a vertical specialist firm we apply to our own outreach.
Want the stack details rather than the industry story?
This page is the identity pillar, the answer to "do you understand my industry". If you are past that stage and you want the architecture diagrams, the capability matrices, the service-level commitments, the reference stacks, and the deliverables we ship on every engagement, visit the companion page built for that conversation.
See the deployment architecture we ship per industry: what Petronella Technology Group actually builds and operates in your environment >The other top-level pillars buyers visit from here
Industry identity is the first question. Once you know we understand your world, the next questions are usually about capabilities, compliance, AI, and operational IT. Each of those has its own dedicated pillar.
Solutions
The master catalog of service families: cybersecurity, compliance, AI, managed IT, and the programs that cut across every vertical.
Cyber Security
Managed XDR, SOC-as-a-service, penetration testing, security awareness, and the operational security posture that keeps every vertical defended.
Compliance
HIPAA, CMMC, SOC 2, PCI DSS, GLBA, FTC Safeguards, NIST 800-53, NIST 800-171, and the programs that satisfy regulators and underwriters.
AI Solutions
Private AI cluster, on-prem inference, voice agents, chat agents, and the regulated-industry AI deployments that keep data sovereignty intact.
Managed IT
Help desk, infrastructure management, Microsoft 365, Google Workspace, unified communications, backup and disaster recovery, and cloud hosting.
Digital Forensics & Breach Response
DFE-credentialed incident response and forensic investigation for ransomware, BEC, SIM-swap, crypto theft, and civil litigation evidence handling.
The "do you get my world?" questions buyers actually ask
Do you work with my industry?
If you are in healthcare (including dental or clinical research), defense contracting or manufacturing, law, financial services or accounting, construction or automotive retail, or the nonprofit / SaaS / small-business cluster, yes, and we go deep. If you are outside those six headline verticals, the honest answer is "probably, but let us verify." Most regulated industries we have not named directly share enough control DNA with one of the six that we can adapt. A few highly specialized verticals (pure insurance underwriting stacks, institutional buy-side finance, large-scale higher education) may be a better fit for a boutique specialist. We will tell you either way on the first call.
What makes a vertical specialist different from a typical MSP?
A typical MSP is optimized to keep your computers running and your tickets answered. A vertical specialist is optimized to keep your regulator, your auditor, your insurance carrier, and your attackers off your back. The day-to-day work overlaps (help desk, patching, backup, endpoint protection) but the outer layer changes. A vertical specialist writes a HIPAA Risk Analysis that OCR will accept, produces a CMMC System Security Plan a C3PAO will actually read, and runs the control cadence that keeps SOC 2 evidence flowing quarter after quarter. That outer layer is where vertical fluency shows up, and it is what buyers in regulated industries are really paying for.
How deep do you actually go in healthcare, defense, law, or finance?
Deep enough that the first technical conversation does not feel like a discovery call. In healthcare we can discuss practice management systems, EHR vendors (Epic, Cerner, athenahealth, eClinicalWorks, Dentrix, Eaglesoft), HL7, FHIR, and the 2026 HIPAA Security Rule changes without a glossary. In defense we can talk about DFARS clauses, NIST 800-171 control families, CUI boundary design, C3PAO logistics, and POA&M scoring. In law we can cite Model Rules 1.1 and 1.6, reference North Carolina FEO 2011-6, and walk through practice management and DMS integration choices. In finance we can discuss FTC Safeguards Rule specifics, GLBA safeguards, SOC 2 CC and TSC mappings, FINRA WSP expectations, and SEC cyber disclosure rules. Depth, not breadth, is the point.
Do you serve clients outside the Raleigh and Triangle area?
Yes. Our headquarters is at 5540 Centerview Drive, Suite 200, Raleigh, NC 27606, and on-site delivery runs primarily across North Carolina: the Triangle, the Triad, Charlotte metro, Wilmington and the coast, Asheville and the mountains. For remote delivery work (cloud, security operations, incident response, compliance program management) we serve clients across the rest of the United States with the same SLAs. For verticals that benefit from in-person presence, we partner with vetted regional field technicians under our quality program.
Have you worked with a client like us before?
This is the question we prefer to answer over a 15-minute call rather than in a sentence on a page, because the honest answer depends on shape, size, and regulatory posture. We will happily describe the anonymized archetype of the closest engagement we have delivered, the work that was in scope, and the outcome. We do not publish named testimonials on this page because many of our clients hold regulated data and prefer not to be used in marketing. If your industry, size, and framework mix closely match one of our existing archetypes, we will say so plainly and tell you where the fit is strong and where we would expect new work.
What if my industry is not listed?
Start with the closest of the six headline verticals and call us. Most regulated or revenue-critical SMB industries share enough framework overlap with healthcare, defense, law, finance, field services, or nonprofit/SaaS that we can tailor an engagement quickly. For a genuinely unique vertical we will run a discovery engagement to confirm fit before we take on a full managed program. We would rather tell you "we are not the right firm" on day one than watch a 12-month engagement wobble because we overreached.
Are you a C3PAO or the assessor for CMMC?
No, and that is intentional. Petronella is a CMMC-AB Registered Provider Organization (RPO) number 1449, which means we help clients prepare for CMMC assessments and operate the control program, but we do not perform the C3PAO assessment itself. That separation is required by the Cyber AB framework: the firm that helps you get ready cannot be the same firm that formally assesses you. We maintain relationships with accredited C3PAOs and coordinate your assessment when the time comes, but the readiness side and the assessor side are legally distinct roles.
If I am in an active incident right now, what do I do?
Call (919) 348-4912 immediately and tell Penny or our on-call team that you are in an active incident. Incident response has a different onboarding path than managed services. We move straight to evidence preservation, containment decisions, and breach counsel coordination within hours, not days. Our DFE-credentialed team handles the forensic and evidentiary side so that anything that ends up in litigation, insurance claim, or regulator filing has been handled by a credentialed examiner from minute one.
More Industry Depth
Additional entry points for buyers who want a different lens on industry coverage or a vertical-specific managed IT engagement.
Let us answer "do you understand my industry?" in 15 minutes
Schedule a free 15-minute industry assessment. No generic discovery templates, no pressure, no required procurement pipeline. A credentialed team member will tell you what is working, what is not, and whether Petronella is actually the right partner for your vertical. If we are not, we will say so and point you somewhere that is.
Headquartered at 5540 Centerview Drive, Suite 200, Raleigh, NC 27606. Serving regulated industries across North Carolina and the United States since 2002. BBB A+ accredited since 2003. CMMC-AB RPO #1449. PPSB accredited.
See also: CPA firm cybersecurity.
See also: quantum risk for financial services.
See also: quantum risk for government.
See also: quantum risk for healthcare.