Our services
Compliance readiness
A customer or a regulator asks for a review, and the application is not ready for it. We scope the framework, find the gaps, and close them in the application: access, logging, change management, backups, encryption, and policies written for how you actually operate. We collect the evidence and stay on as the liaison through the examination. We arrange the compliance platform and the examination. We do not build the software, and a licensed CPA firm issues the report.
- SOC 2
- HIPAA
- PCI DSS
- ISO 27001
Typical engagement
How it starts
A written scope
The SOC 2 report
Issued by a CPA firm
What's included
6 capabilities
- Scoping for SOC 2, HIPAA, PCI DSS, ISO 27001, or another named framework
- Gap assessment against the controls that apply to your application
- Remediation in the application: access, logging, change management, backups, and encryption
- Policies and procedures written for how your company actually operates
- Evidence collection and an index the examiner can use
- Coordination of the compliance platform and the examination
Every project ships with
- Gap report
- Evidence index
- A clear handover
Questions
Common questions
- Do you issue the SOC 2 report?
- A licensed CPA firm examines the controls and issues the report. We prepare the application, collect the evidence, and stay on as the liaison through the examination.
- Do you build the compliance software?
- No. A compliance platform collects the evidence, and a licensed CPA firm performs the examination. We arrange both and stay on through the review.
- Is SOC 2 a certification?
- No. SOC 2 is an attestation report under the AICPA Trust Services Criteria. A Type 1 report describes how the controls are designed at a point in time. A Type 2 report describes whether those controls operated over a period, commonly three to twelve months. We will tell you which one the customer is actually asking for. The observation window is calendar time agreed with the auditor.
- What if the request is not SOC 2?
- The same kind of project covers HIPAA, PCI DSS, ISO 27001, and other frameworks a customer or regulator has named. If a framework is outside what we should take on, we say so on the first call.
A customer asking for SOC 2?
Tell us which framework they named, and we'll outline what the project covers.