Measure your security program against the standards your customers and auditors read: SOC 2, ISO/IEC 27001, NIST CSF 2.0, CIS Controls and the NIST SSDF.
A SOC 2 report or an ISO 27001 certificate is read by people deciding whether to buy from you. A readiness and gap review shows where the program stands before an auditor does the asking.
Each review is scoped to your system boundary, your estate and the report or certificate you actually need, and it is worked criterion by criterion from the published text of the standard.
A readiness and gap review against all 61 Trust Services Criteria: the Security common criteria and the Availability, Confidentiality, Processing Integrity and Privacy categories.
A review of your information security management system against all 30 management system requirements in Clauses 4 through 10 and all 93 Annex A controls, scoped to your ISMS boundary and Statement of Applicability.
An outcome-by-outcome review of the CSF 2.0 Core as published in NIST CSWP 29: all 106 subcategories across 22 categories and 6 functions, including the GOVERN function added in 2.0.
A readiness and gap review covering all 153 safeguards across the 18 Controls, scoped to your Implementation Group, estate and operating model.
A review of your software development lifecycle against all 42 tasks in 19 practices and four groups: Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities.
No. A SOC 2 report is issued by a CPA firm and an ISO/IEC 27001 certificate by an accredited certification body. Our review prepares you for that audit: it shows where you stand, what evidence you can already produce and what to fix first.
Yes. Many controls overlap between SOC 2, ISO/IEC 27001, NIST CSF and the CIS Controls, so evidence collected once is reused across the frameworks in scope.
Where the workload runs on AWS we collect the configuration evidence that corroborates what interviews and documents claim, and for most frameworks we provide an AWS Config conformance pack mapped to the controls. We also say which requirements no configuration export can answer.
Book a consultation with our team in Salt Lake City, Bordeaux or Johannesburg and tell us what you are trying to solve.