Compliance
Readiness and implementation support for ISO 27001, SOC 2 Type II, GDPR and HIPAA.
Overview
We prepare you for, and help you maintain, compliance with security and privacy frameworks by mapping requirements to controls, evidence and owners.
- FrameworksISO 27001 Annex A, SOC 2 Trust Services Criteria, GDPR and the HIPAA Security Rule.
- Control mappingEach requirement maps to a control, an owner, a test and evidence.
- RiskRisk assessment drives the treatment plan.
- AssuranceInternal audits and continuous monitoring between external audits.
Technical scope
- Gap assessment against ISO 27001, SOC 2 Type II, GDPR and HIPAA
- Policy and procedure development
- Risk assessment and treatment plan
- Control implementation and evidence collection
- Internal audit and readiness review
- Vendor and third-party risk reviews
- Continuous compliance monitoring
Architecture and how it works
Each framework requirement maps to one or more controls, and each control to an owner, a test and evidence. One shared control library serves several frameworks, so the same work is not repeated for each audit.
Delivery process
- 01
Scope
Define systems, data and applicable frameworks
- 02
Assess
Run the gap analysis and risk assessment
- 03
Remediate
Implement controls and write policies
- 04
Evidence
Collect and organise audit evidence
- 05
Audit
Support internal and external audits
Tools and deliverables
Outputs include a control library mapped to each framework requirement, a risk register with treatment decisions, and an evidence index showing owner, test method and collection date. These let auditors trace any requirement to its supporting proof.
Deliverables
- Gap assessment report
- Statement of applicability and risk register
- Policy pack
- Evidence matrix
- Audit-readiness report
Common questions
How are framework requirements mapped to controls?
Each requirement from ISO 27001 Annex A, SOC 2, GDPR or HIPAA maps to one or more controls, and each control to an owner, a test and evidence. One shared control library serves several frameworks, so an access-control or logging control is implemented and evidenced once and reused across every audit that needs it.
What does a gap assessment produce?
A gap assessment compares your current controls against the framework, with each gap rated by risk and linked to a remediation action. The output feeds the risk treatment plan and the implementation roadmap, so effort goes first to the gaps that matter most for certification and for reducing real exposure.
How is audit evidence collected and kept current?
Evidence is tied to specific controls and collected on a regular cycle, such as configuration exports, access reviews, training records and policy approvals. Auditors can trace any requirement back to its proof without a last-minute scramble, because the owner, test method and collection date are recorded for each control.
How is compliance maintained between audits?
Continuous monitoring checks control status, internal audits test whether controls are effective, and vendor and third-party reviews cover supplier risk. Findings are tracked until they are closed, so the organisation stays audit-ready throughout the year instead of rebuilding evidence ahead of each external audit.