// Compliance readiness
Compliance work with someone driving it forward.
We manage the agreed compliance work from gap assessment through audit preparation and ongoing control upkeep. Get hands-on support for SOC 2, ISO 27001 and other requirements, with clear priorities and ownership.
// The problem
Turn requirements into work your team can maintain.
Readiness work connects requirements to controls your team can run and evidence you can explain. We agree the scope, owners and remediation priorities. For SOC 2, an independent CPA firm examines the controls and issues the report.
// What we do
How we help
Gap assessment
We map where you are against the framework and what it will really take to close the gap.
Controls that fit
We help implement controls around how your team works, then maintain the agreed policies, evidence and control checks after the audit.
Audit support
We help organise evidence, prepare your team for assessor requests and support you through the assessment.
Multiple frameworks
We identify overlapping requirements and reuse suitable evidence while keeping each framework's scope and assessment requirements clear.
// Scope
Frameworks we cover
SOC 2 Type I and Type II
ISO 27001
HIPAA
GDPR
India DPDP
PCI DSS, where relevant to your payment environment
// How we work
Find. Fix. Verify.
We identify gaps, manage agreed remediation and verify controls and evidence for your assessment. Ongoing engagements keep the agreed programme and evidence up to date.
01
Find
We map your current controls against the requirements and rank the gaps by risk.
02
Fix
We manage the agreed control and evidence work with the people who own each system.
03
Verify
We check the agreed control changes and evidence, and make unresolved gaps clear before assessment.
// Related work
Case
See an anonymised client engagement covering cloud findings, endpoint coverage and intrusion containment.
// FAQ
Questions, answered.
How long does SOC 2 take?
Timing depends on scope, existing controls, remediation and the assessor's process. A gap assessment helps us plan the work. We do not guarantee an assessment outcome or a fixed completion date.
What outcome do we work towards?
We support readiness for a SOC 2 examination and report, ISO 27001 certification, HIPAA compliance or PCI DSS validation, as relevant. Independent assessors issue reports or certifications where applicable. HIPAA is a compliance obligation, not a government-issued certification.
Which framework do we need?
We discuss your customers, industry, data and contractual requirements, then agree the relevant scope. This can include security work supporting GDPR or India DPDP obligations, alongside your legal advice.
Build a clear path to your assessment.
Start with a free security review to discuss the requirements your business faces and where to begin.