SOC 2, HIPAA, PCI DSS, and ISO 27001 readiness consulting, with gap assessments, control design, and evidence preparation for independent review.
A customer asks for a SOC 2 report, your patients are covered by HIPAA, your acquirer wants current PCI DSS validation, and an overseas procurement team wants an ISO/IEC 27001 certificate. Each framework has its own rules and its own independent party at the end: a service auditor, a federal regulator, your payment assessor or your own self-assessment, the body that issues the certificate. We do the work before that step. We scope the system or environment, find the gaps against the standard your customers actually name, build and document the controls with named owners, write the policies, and organize the evidence so it is ready to hand over. Where two frameworks ask for the same control, we map it once and prove it everywhere. Every engagement runs Scope, Assess, Report, Validate, and we never sit on the assessor side for a client we prepared.
SaaS and managed service providers answering customer security questionnaires, healthcare covered entities and business associates, merchants and payment service providers, and companies whose international customers ask for an ISO/IEC 27001 certificate. Most arrive with a contract clause, a renewal date, or a regulator letter already in hand.
We start with the document that created the requirement: the customer contract, the business associate agreement, the acquirer letter, the tender. From it we fix which framework, which edition, which system or environment, and which independent party sits at the end. The scoping memo names in-scope systems, outside vendors, and the observation or reporting period.
We walk each criterion, standard, or requirement with its control owner and inspect the live configuration of your identity provider, cloud accounts, source control, and ticketing systems rather than trusting a questionnaire. Each gap gets an owner, a fix written for that owner, and a note of the evidence that will show it was closed.
You keep a control matrix, a policy set, and an evidence index keyed to the framework’s own numbering, plus a readiness memo that states what is done, what is open, and what to expect from the independent examination or audit. After remediation we retest the closed items and update the index with dated evidence.
Control design, a draft system description, and an evidence index for a SOC 2 Type II examination, built before the observation period starts.
From $7,500
Scope, pricing & FAQsAn accurate and thorough Security Rule risk analysis, safeguard gap assessment, and OCR-ready documentation for covered entities and business associates.
From $4,500
Scope, pricing & FAQsScope reduction, validation-path selection, and a gap assessment against every PCI DSS requirement before your assessor arrives.
From $4,500
Scope, pricing & FAQsISMS scoping, risk treatment, Statement of Applicability, and internal audit ahead of Stage 1 and Stage 2 certification audits to ISO/IEC 27001:2022.
From $18,000
Scope, pricing & FAQsThe selected services, deliverables, access requirements, and any follow-up validation are agreed in your engagement scope.
A focused conversation. A clear scope. A practical path to stronger security.
