Audits don’t start with technology; they begin with questions: Who has access to sensitive data? How quickly can you detect malicious traffic? Where is the evidence? ThreatSTOP’s Protective DNS offers clear, evidence-based answers. By analyzing every domain request in real time and recording each decision, our platform aligns seamlessly with various regulatory frameworks. As numerous customers have demonstrated, it achieves this without the need for extensive projects or hardware upgrades.
Key mandate
The HIPAA Security Rule requires “reasonable and appropriate” technical safeguards that preserve the confidentiality, integrity, and availability of electronic protected health information (ePHI).
Protective DNS in action
Blocks command-and-control domains that attempt to siphon patient data.
Applies granular application controls to keep risky consumer apps off clinical networks.
Delivers per-query logs that demonstrate continuous monitoring for auditors.
Real-world proof: Geisinger Health
When the 12-hospital Geisinger system added ThreatSTOP DNS Firewall, it gained full visibility into previously unknown malware and blocked threats proactively, all without new hardware.
References:
https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
https://www.hhs.gov/hipaa/for-professionals/security/index.html
Key mandates
Requirement 1: Restrict connections to trusted destinations.
Requirement 10: Log security events and retain them for forensic review.
Protective DNS in action
Enforces outbound domain policies that close gaps attackers exploit to bypass firewalls.
Updates every few minutes, satisfying the “continuous protection” intent of PCI DSS 4.0.
Generates tamper-evident logs ready for 12-month retention.
To meet complex OFAC and payment-card obligations across eight global sites, TopCashback attached ThreatSTOP’s managed rules to its AWS WAF. The service automatically blocks sanctioned geographies and updates itself continuously, eliminating a workload the team deemed “difficult if not impossible” to manage in-house.
References:
https://www.pcisecuritystandards.org/document_library
(select “PCI DSS v4.0.1 PDF”)
Key mandate
CIP-005-5 R1.5 requires Electronic Access Points to detect inbound and outbound malicious communications.
Protective DNS in action
Serves as an electronic perimeter that blocks malicious domains before any packet crosses into operational technology (OT).
Extends identical block policies to routers, firewalls, and IDS appliances via IP Defense.
Supplies continuous, machine-readable logs that feed existing SIEMs.
Real-world proof: South Coast Water District
In Southern California, South Coast Water District deployed ThreatSTOP IP Defense, DNS Defense, and Roaming Defense to cut mean time to detection and response by 40 percent while blocking thousands of malicious domains and IPs every month.
Reference:
https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-005-5.pdf
|
Regulation |
Example Control Text |
ThreatSTOP Capability |
Customer Proof |
|---|---|---|---|
|
HIPAA §164.312(e) Integrity and transmission security |
Block and log malicious domains targeting ePHI |
Protective DNS with real-time logs |
Geisinger Health |
|
PCI DSS v4.0 Req 1 Restrict network connections |
Managed allow- and deny-list policies |
Protective DNS rule engine |
TopCashback |
|
PCI DSS v4.0 Req 10 Log and monitor |
Immutable DNS query logs |
SIEM export APIs |
TopCashback |
|
NERC CIP-005-5 R1.5 Detect malicious communications |
DNS and IP perimeter control |
DNS Defense + IP Defense |
South Coast Water District |
Ready-made controls: Thousands of curated feeds from our Security, Intelligence, and Research team cover phishing, ransomware, DDoS, data exfiltration, and more.
Layered accuracy: Hundreds of allow lists remove known-good domains before policies ship, eliminating false positives.
Granular overrides: User-Defined Lists let you fine-tune any rule without losing inherited protection.
Audit-friendly reports: Drill-down dashboards show who queried what, when, and why it was blocked or allowed.
Proven across industries: From e-commerce to critical infrastructure and healthcare systems, customers trust ThreatSTOP to meet strict regulatory demands.
For those interested in joining the ThreatSTOP family, or to learn more about our proactive protections for all environments, we invite you to visit our product page. Discover how our solutions can make a significant difference in your digital security landscape. We have pricing for all sizes of customers. Get started with a Demo today!
|
ATT&CK Tactic |
Technique ID |
ThreatSTOP Mitigation |
|---|---|---|
|
Initial Access |
T1566.002 Spearphishing Link |
Blocks malicious domains before users connect |
|
Command and Control |
T1071.004 DNS protocol |
Cuts off DNS-based C2 channels in real time |
|
Command and Control |
T1568 Dynamic Resolution |
Stops domain-generation algorithms via continuous updates |
|
Exfiltration |
T1048.003 Unencrypted Non-C2 |
Blocks DNS tunneling and direct IP exfiltration with IP Defense |
|
Defense Evasion |
T1090.003 Domain Fronting |
Detects and blocks fronting domains |
|
Impact |
T1499.004 Reflection or Amplification |
Neutralizes DDoS command vectors at the resolver |
|
Collection |
T1114.001 Email Client Collection |
Prevents malicious tracking domains from loading |
Connect with Customers, Disconnect from Risks