About Cyvela · Decatur, TN

6:15 p.m., the last row of your parking lot. a headlamp in the glovebox, because server closets never have a working bulb.

Cyvela is a security consultancy that does one thing for one kind of client: it assesses small medical and dental practices, for a fee written down in advance, and tells them in order what to fix. This page covers who shows up, what they carry, and what they decline to sell you.

A small medical office at dusk with warm light in the reception windows and a single car parked in the last row of the lot

How it started

a risk analysis is supposed to describe your office. not somebody else’s.

Cyvela began with a binder. A small dental office had paid for a HIPAA risk analysis, filed it, and felt fine about it for two years. When someone finally read it page by page, the footer on page nine still carried the name of a different practice, in a different state, with a different number of operatories.¹

Nothing in it was false, exactly. It just wasn’t about them. It didn’t know the imaging PC was on Windows 10, or that the backup drive sat on the shelf directly beneath the server, or that the whole front desk shared one login.² It had been written without anyone walking through the building.

So the rule became: nobody writes a finding about a room they haven’t stood in. The walk-through happens in person, after your last appointment. The report names your machines the way your staff do — “the computer by the panoramic,” “Op 3.”³

And the fee is fixed before any of it. An office manager deciding whether to spend money on security shouldn’t also have to guess how much.

1Templates aren’t the problem. Unread templates are. We use a consistent structure; we don’t use anyone else’s answers.
2You may recognise all three from the sample report page on the home page. They tend to travel together.
3Your IT person gets the asset tags and IP addresses in the technical appendix. Your office manager gets “Op 3.”

From the walk-through notes

one evening in your office, as it appears in the log

Every walk-through gets a time-stamped log, and the log goes in the binder. This one is a composite — it shows the order things happen in, not any single practice’s night. Two to three hours, depending on the number of operatories and the depth of the closet.

6:15pm
Park in the last row. Wait for the final patient’s car to leave. Nobody in a waiting room needs to see a stranger with a clipboard.
parking lot
6:22
The office manager unlocks, points out the light switches and the alarm panel, and is then allowed to go home.
front door
6:30
Front desk. Count workstations, note which are still logged in, photograph every sticky note before touching anything.
reception
6:58
Operatories, one at a time. Screen-lock timer, local admin accounts, and what is plugged into the USB ports that shouldn’t be.
ops 1–4
7:40
Server closet. Headlamp on. Age of the UPS battery, location of the backup drive, whether the door locks, whether the door exists.
closet
8:10
The printer that emails scans, the fax, and the Wi‑Fi. Check whether the guest network can see the imaging PC. It occasionally can.
network
8:45
Everything back exactly as found, including the sticky notes. Lights off, door checked twice, one text to the office manager: “Locked. Report in ten business days.”
done

Nothing on the list above changes a setting. Changes come later, in the hardening pass, with your IT person present or in writing for them.

Packed the afternoon before

what the assessor carries in, and the one thing that stays in the car

An overhead flat-lay of an assessor’s kit: laptop, headlamp, clipboard checklist, label maker, ethernet cables, adapter, painter’s tape, and shoe covers

packing slip

Walk-through night

×1Cyvela laptop, encryptedNever joined to your domain, never connected to your patient database.
×1HeadlampFor the closet. See the headline.
×1Workstation checklist, 41 lines, on a clipboardFilled in by hand at each machine, then typed up the next morning.
×1Label makerSo “WS-07” in the report matches a sticker on the actual machine.
×2Ethernet cables, one short and one longThe long one is for the closet that’s further from the switch than anyone remembers.
×1Roll of blue painter’s tapeMarks the cables already traced. Peels off without residue.
×1Pair of shoe coversFor surgical suites and practices that ask.

×0 Anything to sell you. It stays in the car because it was never in the car.

Turned down, politely, on the scoping call

five things we don’t do, the reason for each, and what happens instead

Things Cyvela declines to do, why, and what it does instead
We don’t	Because	Instead
i.resell firewalls, antivirus, or backup software	A consultant earning a commission on the fix has a reason to find a bigger problem.	We name two or three suitable products with their list prices. You buy from whomever you like, including nobody.
ii.monitor your network every month	That’s your IT provider’s job. We’d rather check their work than compete with it.	They get the technical appendix, and we take their follow-up questions by email.
iii.touch settings during patient hours	A locked-out front desk at 9:10 a.m. is a patient standing at the counter.	Walk-throughs start after the last appointment. The phishing emails are the one exception, by design.
iv.name the staff who clicked	A front desk that’s afraid of the test will quietly delete the next real one.	Results by role — front desk, clinical, billing. Names only if the practice owner asks in writing.
v.write findings for rooms we haven’t entered	See tab 01. Page nine. The other practice’s footer.	Every finding traces back to a line in the walk-through log, a photo, or a phishing result.

Where the hatchback goes

ninety miles from Lamontville Rd, no travel charge

Measured as the crow flies from 2900 Lamontville Rd. If the road disagrees by a few miles, we go with the crow. Past the outer ring, mileage is quoted on the scoping call, in writing, alongside the fee.

0–30 mi

Athens
Dayton
Spring City
Sweetwater
Madisonville
Cleveland

30–60 mi

Chattanooga
Crossville
Knoxville
Maryville
Lenoir City
Decatur, TN

60–90 mi

Cookeville
Sevierville
Decatur, TN
Tullahoma

Practices in two towns at once get one walk-through per location, priced per workstation, not per drive.

The 25-minute scoping call

bring your workstation count. we’ll bring the headlamp.

Call before 3 p.m. on a weekday and the written fixed fee arrives the same day. After 3, the next morning. The call itself costs nothing.

(805) 427-0080

Book the scoping call Email instead