SOC 2
The report most enterprise buyers ask for first. I get you ready for a Type I or Type II examination, help you choose a CPA firm and support you through fieldwork.
Frameworks
One program, every framework your buyers ask for.
I map controls once and reuse evidence across every framework in scope, so adding the next one starts from what you have already proven. For each framework I provide readiness, gap assessment, internal audit and audit support.
Frameworks covered
ISO/IEC 27001 and 42001
Information security and AI management systems for international and enterprise buyers. Readiness, internal audit and support through certification audits by an accredited body.
FedRAMP and GovRAMP
A realistic path to federal and state authorization: boundary and scope, NIST 800-53 baseline gaps, documentation and continuous monitoring readiness.
NIST 800-53, CSF and 800-171
Control baselines for federal systems, a common language for security programs, and protecting controlled unclassified information for government contractors.
Kantara and NIST SP 800-63
Digital identity assurance for identity proofing, authentication and federation. Readiness at your target IAL, AAL and FAL, including the move to Rev 4.
HIPAA
Security and privacy safeguards for health data, a security risk analysis and the documentation healthcare customers expect from their vendors.
PCI DSS
Scoping, segmentation and readiness for organizations that store, process or transmit payment card data, ahead of a QSA assessment or self-assessment.
AI governance
Governance, risk and control practices for AI systems, aligned to ISO/IEC 42001 and the NIST AI Risk Management Framework.
Also covered: privacy obligations (alongside your counsel), SOX ITGCs and customer-specific security requirements. I do not issue SOC 2 reports, ISO certificates, FedRAMP authorizations or Kantara certifications.