COMPLIANCE READINESS FRAMEWORK
Engagements are delivered in three phases at a fixed fee.
You know the cost before the work begins, and the scope is defined by what your customers actually require to successfully pass the certification.
Phase 3
Readiness
and audit support
We validate that your controls are designed correctly and operating as intended, assemble the evidence package, finalize your system description, and coordinate with your auditor through the examination.
DELIVERABLES
an audit-ready evidence package, a finalized system description, and coordination and walkthrough support with your examiner.
Phase 2
Remediation and implementation
This phase carries the bulk of the work. We draft your policies and procedures, advise on the technical and administrative controls you are missing, and establish your evidence collection so it accumulates over time rather than in a scramble before the audit.
DELIVERABLES
a policy and procedure library tailored to your organization, control implementation guidance, evidence collection setup, and a draft system description.
Phase 1
Scoping and gap assessment
We begin by defining what belongs in scope: understanding what you have committed to your customers, which framework categories apply, and whether you should pursue a Type I or Type II examination first. We then assess your existing controls against the requirements and identify the gaps.
DELIVERABLES
a scope definition, a gap assessment mapping requirements to your controls, and a prioritized remediation roadmap.
FRAMEWORKS
SOC 2 is where most engagements begin. We also work with ISO 27001 and adjacent frameworks, and the approach carries across them because the underlying control work overlaps substantially.
Compliance automation platforms such as Vanta, Drata, and Secureframe can streamline evidence collection, and we work on whichever platform you use.
They are, however, optional. Many companies complete their first audit without one, and for a smaller scope the subscription is not always warranted. Whether a platform serves you is a question we address during scoping.
