Audit-ready is a state, not a project.
Every framework asks the same underlying questions: who has access, what is patched, what is logged, and can you prove it. We answer them once, continuously, and export the evidence in whatever format your auditor or customer asks for.
Nine frameworks · One control matrix · Seven-year evidence retention
SOC 2 Type II
SaaS and services selling to enterprise buyers
4–6 months
Trust services criteria mapped to your stack, policy suite, continuous evidence and auditor liaison.
HIPAA
Healthcare providers, payers and their vendors
60–90 days
Security risk analysis, administrative and technical safeguards, BAA review, workforce training records.
HITRUST r2
Healthcare enterprises and their business associates
9–12 months
Control inheritance from SOC 2, assessment preparation, remediation plan and validated assessment support.
PCI DSS 4.0
Anyone storing, processing or transmitting card data
3–5 months
Cardholder data scoping, network segmentation testing, SAQ preparation and quarterly evidence.
CMMC Level 2
Defense contractors handling controlled unclassified information
6–9 months
NIST 800-171 implementation, SPRS score management, POA&M ownership and C3PAO assessment preparation.
ISO 27001
Organisations selling into global enterprise and EU markets
6–9 months
ISMS design, Annex A control implementation, internal audit and certification body support.
GDPR
Businesses processing EU personal data
90 days
Records of processing, lawful basis review, data subject request workflow and processor agreement review.
NIST CSF 2.0
Any organisation needing a defensible baseline
30 days
Current-state profile, prioritised gap register and a costed roadmap your board can fund in stages.
Your sector decides the first framework, not the last.
Select the sector you operate in to see the frameworks a customer, auditor or contracting officer will ask for first.
Frameworks in scope
PHI safeguards, business associate agreements with every vendor, and access reviews on clinical systems.
What we hand over
Annual risk analysis · Six-year evidence retention
Map once
Controls are written against your environment, then cross-referenced to every framework. Adding a second framework usually adds 12–18% new work, not a second project.
Evidence continuously
Access reviews, patch reports and configuration states are captured on a schedule and stored with immutable timestamps, so audit fieldwork is a file transfer.
Answer questionnaires fast
We maintain a reusable answer library tied to live evidence. Enterprise security reviews that take peers three weeks take us three days.
Start with the assessment, not a contract.
Tell us what you are being asked to prove and who is asking. We will show you where the gaps are, what it costs to close them, and how long it takes.
- 01A 30-minute scoping call with a senior analyst, not a salesperson.
- 02A written assessment: risk register, framework gaps and a costed remediation plan.
- 03No obligation to engage. The report is yours either way.