A deal gated on SOC 2 or ISO
A customer needs a report or certificate within months, and the program behind it does not exist yet.
GRC Program as a Service · Managed
Your governance, risk and compliance program, run for you.
A managed service where I run your GRC program month to month, from the first security questionnaire through a clean audit and every audit after it. Built for your environment from day one, or bolted onto what you already have.
When it fits
Deals and audits need a program nobody owns yet.
Frameworks keep piling up
Each new framework, customer audit or regulation becomes its own spreadsheet and evidence chase.
No one owns the whole program
Founders, engineers or a stretched compliance lead are carrying GRC on top of their real jobs.
Workstreams
Everything a GRC program runs on.
Scope is set to your stage. Most clients start with a few workstreams and add the rest as the program matures.
Risk register and assessments
A living risk register, periodic risk assessments and a clear risk-acceptance process.
Policies and standards
Policies and standards written for how you actually work, reviewed and kept current.
Compliance documentation
System security plans, policies, procedures and narratives that auditors and buyers can follow.
Control mapping and evidence
One control set mapped across your frameworks, with evidence collected once and reused.
Vendor and third-party risk
Vendor due diligence, risk tiering and periodic reviews of the suppliers you rely on.
Audit management
Audit calendar, auditor selection and liaison, request management and fieldwork coordination.
Internal audits
Testing that controls operate as designed, with findings tracked to closure before external audit.
Metrics and board reporting
Program metrics, risk trends and board-ready reporting on posture and progress.
Regulatory change and impact tracking
Monitoring for new regulations and obligations, and what each one means for your controls.
How it runs
Stand it up, get through the audit, keep it running.
Foundation
Policies, risk register, control set and a system of record you own.
Audit-ready
Gap assessment, remediation sprints, evidence and audit support through the report.
Run
Continuous monitoring, internal audits, customer audits and an audit calendar.
Grow
New frameworks start from what is already proven, not from zero.
Questions
Common questions
Do you issue the SOC 2 report or ISO certificate?
No. SOC 2 reports are issued by independent CPA firms and ISO certificates by accredited certification bodies. I get you ready, help you choose the auditor and support you through the audit. You stay free to choose and change your audit firm.
Do we need a compliance platform?
No. I work with the platform you already have, or none. Either way, you own the system of record and the evidence.
We already have a program. Is this still for us?
Yes. I can bolt onto your existing program, close the gaps and take over the workstreams nobody owns.
Can we buy one piece on its own?
Yes. Gap assessments, audits and compliance documentation are also available as standalone engagements.