Compliance & certification
From first policy to final audit, with no surprises along the way.
Certification and attestation are not document exercises. We design, implement and validate a security program that fits how your business operates, then stand beside you through the external audit and every cycle after it.
What’s included
Practical expertise, shaped around your business.
Scoping that fits
We define exactly which systems, data, teams and suppliers are in scope. No gaps you discover at audit time, and no excess work you did not need.
Policies and risk register
Tailored policies, a practical risk assessment methodology and a risk register your leadership actually owns.
Statement of Applicability and control library
Every control selected, justified and mapped to your environment. Exclusions agreed and documented properly.
Control implementation guidance
Hands-on guidance on access reviews, secure cloud configuration, endpoints, backups, vulnerability management and secure development.
Business continuity and incident response
Business impact assessment, continuity planning and simulation exercises that auditors respect.
Auditor selection and audit support
We help you choose the right audit firm and represent you through Stage 1, Stage 2 and SOC 2 Type 1 and Type 2 audits.
How it works
A clear, structured engagement.
- Step 1
Design
Scope, policies, risk assessment and your Statement of Applicability or SOC 2 control library.
- Step 2
Implement
Controls operating, evidence flowing, incident response and continuity plans tested.
- Step 3
Validate
An independent internal audit and management review, with corrective actions closed before the auditor arrives.
- Step 4
Certify and maintain
External audit support, then ongoing operation through annual surveillance audits.
The outcome
What you can expect.
- A program your team understands and can run
- Controls adapted to how you actually operate
- Fewer findings and less rework at audit time
- A certificate that unlocks enterprise deals
FAQ
Common questions.
How long does certification take?
It depends on your starting point, scope and how quickly your team can make decisions. Most programs move from kickoff to audit-ready in a few months. We give you a realistic, dated roadmap in the first weeks.
Who does the work?
We carry the documentation: policies, procedures, the risk register, the Statement of Applicability and the audit pack. You bring decisions, access and evidence. Technical remediation stays with your engineers, guided by us.
Can we work towards more than one framework at once?
Yes, and it usually saves time and cost. ISO 27001, SOC 2 and ISO 9001 overlap heavily, so we build one program and map it to each framework.
Are you the auditor?
No. We are independent of your certification body or CPA firm. That separation is what lets us advise you candidly and represent your interests during the audit.
Other services
Let’s get your compliance program right.
Tell us where you are and where you need to be. We will spend 30 minutes understanding your situation and give you an honest view of the fastest sensible path.