Compliance management that pulls evidence on autopilot so your audit doesn't eat Q4
SOC 2, HIPAA, PCI, CMMC, ISO 27001, NIST CSF. Drata or Vanta wired into your stack. We design the controls, write the policies, run the gap assessment, and sit beside your auditor when they ask the hard questions.
Read-only review of your current control coverage. 1-page gap report.
Three lanes for compliance management. One contract. Pricing the CFO can sign without a meeting.
Every tier runs the same playbook: scope, gap, remediate, evidence, audit. The difference is how many frameworks you're carrying, how often we sit down with your team.
- One framework: SOC 2, HIPAA, PCI, CMMC, ISO 27001, or NIST CSF
- Drata or Vanta license + integrations included (no separate bill)
- Policy library: 38 policies drafted to your environment
- Quarterly user-access reviews and vendor reviews run for you
- Monthly 60-minute working session with a GRC engineer
- Audit firm referral
- Up to two frameworks (e.g. SOC 2 + HIPAA, or ISO 27001 + PCI)
- Everything in Starter, plus a weekly 30-minute working session
- On-call audit-day support: GRC engineer joins your fieldwork sessions live
- Tabletop exercises (incident response, ransomware, vendor outage) twice a year
- Cyber insurance questionnaire completed on your behalf
- Dedicated Slack or Teams channel
- Multi-framework: 3+ frameworks managed under a single control library
- Board-level reporting: quarterly risk register, KRI dashboard, audit committee deck
- Vendor risk program: TPRM intake, SIG/CAIQ reviews, annual re-assessments
- Continuous control monitoring with named-person remediation owners
- M&A diligence support and post-deal control integration
Seven frameworks. Pre-vetted auditors.
Every framework has a different control count, a different evidence bar, and a different auditor culture. Here is what we actually deliver across the seven we run most often.
| Framework | Controls covered |
|---|---|
| SOC 2 Type II | 150 controls (Trust Services Criteria) |
| HIPAA | 54 standards (Security, Privacy, Breach Notification) |
| PCI-DSS Lvl 1 | 277 sub-requirements (v4.0) |
| CMMC Lvl 2 | 110 NIST 800-171 controls |
| ISO 27001 | 93 Annex A controls (2022 revision) |
| NIST 800-171 | 110 controls (DoD subcontractor baseline) |
| NIST CSF | 108 subcategories (CSF 2.0) |
Ask for the sample evidence packet.
Eight frameworks. One control library. Map a control once, satisfy four audits.
Most compliance vendors silo your controls per framework. We map every control once into a unified library, then re-use it across SOC 2, HIPAA, PCI, ISO, and NIST. Add a new framework later? You're already 60 to 80 percent of the way there.
Honest answers.
Do we still need an external auditor?
Yes, for SOC 2, ISO 27001, PCI-DSS Level 1, and CMMC Level 2 you need a third-party CPA firm or C3PAO. We do not issue the report. What we do is run the program, write and maintain the policies, collect the evidence, sit beside you in fieldwork meetings, and answer auditor questions in real time so your team is not buried for six weeks. We work with pre-vetted audit firms across SOC 2, HIPAA, PCI, and CMMC. You can also bring your own.
How is this different from just buying Drata or Vanta?
Drata and Vanta are tools. They will not write your policies, design your controls, train your engineers, run a tabletop exercise, or sit on a Zoom with your auditor when a control fails on Day 2 of fieldwork. We deploy the tool you pick (or pick one with you), wire it into your stack, write the 30 to 60 policies a SOC 2 needs, fix every red control on the dashboard, and run the audit alongside you.
What if our existing security stack isn't ready?
That is the normal starting point. The first 30 days is gap assessment: we map your current controls to the framework, surface the gaps (typically MFA on every admin account, log retention, asset inventory, vendor reviews, change management, BCP/DR), and rank them by audit-blocker risk. Then we remediate together.
Will you write our policies or just review them?
We write them. You get a starting library of 38 policies (information security, access control, incident response, vendor management, change management, data classification, BCP/DR, secure SDLC, acceptable use, and the rest) drafted to your environment, not generic templates. You review, redline, and sign. We then maintain them annually as part of the retainer. Clients on the Pro and Enterprise tiers also get tailored runbooks for the controls that need procedure, not just policy.
Stop losing two engineers to evidence collection.
Our free compliance gap assessment maps your current controls to your target framework, surfaces the audit blockers (the ones that fail you on Day 1), and sends a 1-page gap report. Read-only review. No tool installs. No sales call attached.