COMPLIANCE READINESS FRAMEWORK
Engagements are delivered in three phases at a fixed fee. You know the cost before the work begins, and the scope is defined by what your customers actually require.
Phase 3
Readiness and audit support
We validate that your controls are designed correctly and operating as intended, assemble the evidence package, finalize your system description, and coordinate with your auditor through the examination.
DELIVERABLES
• Audit-ready evidence package
• Final system description
• Auditor coordination and walkthrough support
Phase 2
Remediation and implementation
This phase carries the bulk of the work. We draft your policies and procedures, advise on the technical and administrative controls you are missing, and establish your evidence collection so it accumulates over time rather than in a scramble before the audit. We guide; your team implements and owns the changes.
DELIVERABLES
• Policies and procedures tailored to your company
• Control implementation guidance
• Evidence collection setup
• Draft system description
Phase 1
Scoping and gap assessment
We begin by defining what belongs in scope: understanding what you have committed to your customers, which framework categories apply, and whether you should pursue a Type I or Type II examination first. We then assess your existing controls against the requirements and identify the gaps.
DELIVERABLES
• Scope definition
• Gap assessment mapped to your controls
• Prioritized remediation roadmap
FRAMEWORKS AND PLATFORMS
SOC 2 is where most engagements begin. We also work with ISO 27001, and the approach carries across both because the underlying control work overlaps substantially.​
Â
Compliance automation platforms such as Vanta, Drata, and Secureframe can streamline evidence collection, and we work on whichever platform you use.
Â
They are, however, optional. Many companies complete their first audit without one, and for a smaller scope the subscription is not always warranted. Whether a platform serves you is a question we address during scoping.