Audit-ready, not audit-shocked.
Most "compliance" engagements deliver a binder. We deliver continuous control monitoring, evidence collected automatically, and a posture that holds up under a real auditor — not a friendly one. SOC 2, HIPAA, PCI, CMMC, ISO 27001 and the policies behind them.
Pick your framework.
We've done it before.
SOC 2 Type I & II
Trust Services Criteria — Security, Availability, Confidentiality, Processing Integrity, Privacy. We map your environment, build the controls, and operate them through your audit window.
- Readiness assessment
- Control implementation
- Continuous evidence
- Auditor liaison
HIPAA Security Rule
Administrative, physical, and technical safeguards for ePHI. BAAs in place across our supply chain. Risk assessments performed annually with documented remediation.
- Risk assessment
- Safeguards mapping
- BAA management
- Breach response plan
PCI DSS v4.0
Scope reduction first. We segment cardholder environments aggressively so you have less to defend, then implement and monitor the required controls in scope.
- Scope reduction
- Network segmentation
- Quarterly scans
- SAQ / RoC support
CMMC 2.0 · NIST 800-171
For DoD contractors and their subs. We implement the 110 practices in 800-171, manage the SSP and POA&M, and support C3PAO assessments.
- Gap analysis
- SSP & POA&M
- Enclave design
- C3PAO support
ISO 27001:2022
Information Security Management System aligned to Annex A controls. We help you scope, document, run internal audits, and stay certified through surveillance audits.
- ISMS scoping
- Annex A controls
- Internal audit
- Management review
NIST CSF 2.0
For organizations that want a defensible posture without a formal certification. Govern, Identify, Protect, Detect, Respond, Recover — measured, tracked, improved.
- Tier assessment
- Roadmap
- Maturity tracking
- Board reporting
From signed to audited—a typical timeline.
Numbers below assume SOC 2 Type II for a ~150-person organization with a single SaaS product. Other frameworks vary, but the shape rhymes.
Readiness review
Map current state to the framework. Identify gaps, dependencies, and quick wins. Deliver a written roadmap with effort and timeline by control.
Implementation
Implement controls in your environment — identity, logging, change mgmt, vendor mgmt, BCDR. Stand up the GRC platform and connect evidence collectors.
Observation window
Run the program. Continuous evidence. Quarterly access reviews. Tabletop exercises. Vendor reassessments. We do the work; you sign off on it.
Auditor engagement
We act as auditor liaison — pulling samples, answering walkthrough questions, and tracking the request list. You hear about it when there's a decision to make.
More than a binder.
Things people actually ask.
Are you the auditor?
No, and we shouldn't be — that's a conflict. We get you ready, run the program, and work alongside an independent CPA firm or C3PAO. We can recommend several we've worked with successfully.
How long until we're SOC 2 Type II?
Plan on 9–12 months from signed engagement to final report. The audit observation window is 6 months minimum; the rest is implementation and audit fieldwork.
We already have a GRC tool. Will you use it?
Yes. We work in Drata, Vanta, Secureframe, OneTrust, AuditBoard, Hyperproof, ServiceNow GRC and others. We're the operators; the platform is the system of record.
What does it cost?
Depends on scope, framework, and how much of your environment is in scope. Readiness reviews start in the low five figures; ongoing programs are quoted monthly. We'll scope before we quote.
Have an audit on the calendar?
Or want to avoid panic on the next one?
30 minutes, written gap summary in 48 hours. We'll tell you the three controls most likely to fail and what it takes to fix them.