HIPAA, ISO/IEC 27001, SOC 2, GLBA, and FFIEC guidance differ in scope, terminology, and what counts as evidence. We assess your controls against the framework that applies, plan the remediation, and prepare you for the auditor or examiner. When several frameworks apply, we map them to one control set so evidence is collected once.
Deliverables are yours to keep and are written so your team can maintain them after the engagement ends. Documentation supports implementation and evidence; it does not establish compliance on its own.
Start with the one a contract, regulator, or customer requires today. If several apply, we map them together so one control set and one evidence library satisfies all of them.
No. SOC 2 reports are issued by licensed CPA firms, and ISO 27001 certificates by accredited certification bodies. We get you ready, help you select the right auditor, and support you through the audit.
Most readiness efforts run three to nine months, depending on scope, the maturity of existing controls, and how quickly remediation can happen. The gap assessment produces a specific timeline.
We discuss what is driving the need and when it is due.
You receive a scope, deliverables, timeline, and fee.
We send a document request and schedule interviews with your team.
Risk analysis based on NIST SP 800-30 that ends in a prioritized remediation plan.
Policies, standards, and procedures written around how your organization operates.
Internal testing of IT general controls and access reviews ahead of the external audit.
Tell us what is driving the need and when it is due. We will tell you plainly what it would take.
