SOC 2 · HIPAA · PCI DSS · ISO/IEC 27001:2022 · ESG
One control programme. Several buyer and regulator conversations.
We prepare organisations for independent attestation and certification. We do not issue certificates ourselves — we make you audit-ready, stay with you through the examination, and keep the programme alive afterwards.
Enterprise buyers now expect SOC 2 Type II. International customers and public-sector tenders expect ISO/IEC 27001:2022. Healthcare work brings HIPAA. Card data brings PCI DSS v4.0. EU disclosure rules are turning ESG from a slide deck into auditable data. The controls overlap by roughly 70–80%, but the evidence, sampling, and language do not. Running five projects in parallel burns the same engineers five times.
System boundaries, in-scope people and vendors, and a clear decision on Type I versus Type II, Stage 1/2, SAQ versus ROC, or ESG disclosure readiness — before anyone writes a policy.
Access, encryption, logging, change, vendor risk, incident response, and awareness mapped once across SOC 2 Trust Services Criteria, ISO 27001 Annex A, HIPAA safeguards, and PCI DSS requirements.
Current-state versus required evidence, owners, and a sequence that respects change windows — not a 200-page report you cannot action.
We work with your chosen CPA firm or accredited certification body: evidence packs, walkthroughs, finding close-out, and surveillance-year hygiene.
Pick the market you are entering. We start there, then reuse evidence everywhere else it legally and professionally applies.
AICPA Trust Services Criteria. Type I is a point-in-time snapshot of design; Type II tests operating effectiveness over a period — typically 3–12 months. US B2B SaaS procurement still treats Type II as table stakes. We treat it as a continuous evidence operation, not a once-a-year scramble.
Security, Privacy, and Breach Notification Rules. Risk analysis, administrative / physical / technical safeguards, and Business Associate Agreements. We align technical work with what OCR actually samples after an incident — not a checkbox PDF.
Cardholder data environment, MFA on CDE access, targeted risk analyses, and authenticated vulnerability scanning. We help you choose SAQ versus ROC, shrink scope where it is honest to do so, and prepare for the requirements that became mandatory under 4.0.
An Information Security Management System: context, risk, Statement of Applicability, Annex A (93 controls across organisational, people, physical, and technological themes), Stage 1 and Stage 2, then surveillance. 2013 certificates are expired — 2022 is the only live path.
Materiality, governance, and data that can survive assurance. For EU-facing companies we structure work with CSRD/ESRS in mind: policies, processes, and evidence — not marketing claims. We do not greenwash.
Business model, systems, data classes, customers, and which frameworks actually unblock revenue.
Control catalog, SoA or TSC mapping, policy set, and a 90-day remediation plan with named owners.
Access reviews, logging, vendor DD, training, change tickets — the rhythm Type II and ISO surveillance demand.
Auditor coordination, finding remediation, and a calendar so year two is cheaper than year one.
One control programme. Several buyer and regulator conversations.
