01 Program pillar
Compliance
Audit-ready, continuously — not a binder you rebuild every year.
The problem
Compliance is treated as an event. Attackers don't wait for your audit window.
Most teams scramble for weeks before an audit — screenshotting consoles, chasing evidence, rebuilding the same binder they built last year. The moment the auditor leaves, the posture drifts. Compliance becomes a snapshot of a day, not a description of how you actually operate.
The arm flips that: framework requirements live in the knowledge base as structured data, evidence is collected continuously, and the audit-ready report is a query against the registry — not a quarterly fire drill.
What it does
From the registry, not from scratch.
Framework mapping
SOC 2, PCI-DSS, ISO 27001, HIPAA, and more — each control mapped to the assets, policies, and evidence that satisfy it, in one schema.
Continuous evidence
Evidence is gathered as the environment runs, timestamped and logged — not screenshotted the week before the audit.
Audit-ready reporting
The report generates from the registry: control status, gaps, owners, remediation. The same data answers a security questionnaire.
Cross-framework reuse
One piece of evidence satisfies the same control across multiple frameworks — map once, reuse everywhere.
Coverage areas
Identity, data, and vendor risk — all from the registry.
If you're trying to place where you sit, these enterprise risk areas live inside the compliance pillar — named, so we can have the conversation directly:
Identity & access (ITDR — posture side)
Access reviews, privilege creep, stale and orphaned accounts, service-account sprawl. Identity is where most 2026 breaches actually start, so the governance and review cadence lives here; real-time identity threat detection lives in AI-SOC.
Data security / DLP
Where sensitive data lives, who can touch it, and residency exposure — adjacent to PCI scope and the offshore-development data-residency question. Classification and handling tracked against the frameworks that demand it.
Third-party / vendor risk
The mirror image of the questionnaires you answer: assessing your vendors' security posture, access, and breach exposure — scored and tracked in the register, not assumed.
The difference
A questionnaire, a CVE check, a PCI evidence pull, and the board ask are the same data — asked different questions.
Because compliance shares the brain with testing and the SOC, a finding from a pentest or a triaged alert updates the compliance picture automatically. The posture is live, not reconstructed.
Honest limits
What it is and isn't.
Honest limit
Not a compliance guarantee
We make you audit-ready and keep you there; the auditor still audits. We don't sign your attestation for you.
Honest limit
Evidence quality depends on integration
The more of your stack the bridge can read, the more evidence is automatic. Gaps need manual input.
Honest limit
Frameworks evolve
Control mappings are maintained as standards change — that maintenance is part of the retainer, not a one-time build.
Honest limit
A human owns the sign-off
The fractional CISO is accountable for what's attested. The registry informs; the human decides.
Buy it à la carte
Services in this pillar
Each can be scoped on its own, before or without the full program.
Continuous Attack Surface Monitoring
Comprehensive continuous monitoring of your external attack surface with regular assessments and testing.
Active Directory Security Assessment
Comprehensive security assessment of Active Directory infrastructure, focusing on privilege escalation, lateral movement, and domain compromise scenarios.
Business Continuity Planning Assessment
Comprehensive evaluation of your organization's business continuity capabilities and operational resilience through detailed Business Impact Analysis (BIA), risk assessment, and continuity planning. Our specialized approach combines regulatory compliance requirements with practical business resilience strategies to ensure your organization can maintain critical operations during disruptions and recover effectively from various business interruption scenarios.
Cannabis Industry Security Program
Comprehensive security assessment for cannabis operations, including cultivation facilities, retail operations, and supply chain compliance with state-specific regulations.
Educational Institution Security Program
Comprehensive security assessment for educational institutions, covering student data protection, campus infrastructure, and remote learning systems.
Executive Travel Privacy & Security Assessment
Comprehensive international travel security and privacy assessment for executives, high-net-worth individuals, and VIPs. Ensures secure and private travel across borders while protecting digital assets, communications, and financial transactions.
Hospitality Sector Security Program
Specialized security assessment for hotels, resorts, restaurants, and hospitality organizations, addressing the unique challenges of securing guest data, payment systems, property management systems, and physical-digital security convergence. Our assessment helps hospitality businesses protect guest privacy, ensure PCI compliance, and maintain operational continuity while delivering exceptional guest experiences.
Retail & E-commerce Security Assessment
Comprehensive security assessment designed specifically for retail and e-commerce organizations, addressing the complex challenges of securing omnichannel retail environments, payment processing systems, customer data, and inventory management. Our specialized assessment helps retailers protect their brand, customer trust, and operational continuity across physical and digital retail channels.
Security Architecture Review
Comprehensive analysis of your organization's security architecture design, evaluating defense-in-depth strategies, security control effectiveness, and alignment with business objectives and threat models.
AI Governance & TRiSM Program
Stand up AI governance (TRiSM): inventory AI systems, classify risk, map to EU AI Act / NIST AI RMF / ISO 42001, and operate ongoing AI risk, trust, and security management with human oversight.
CMMC 2.0 Level 1 & 2 Readiness (NIST SP 800-171)
For contractors handling FCI or CUI. We scope the CUI boundary, assess all NIST SP 800-171 practices, calculate and document your SPRS score, write the System Security Plan and POA&M, and prepare you for self-assessment or a C3PAO assessment. CMMC phase-in dates have moved more than once; NIST SP 800-171 and DFARS 252.204-7012 obligations apply regardless, so we plan against the requirement rather than a single deadline.
California Privacy Law Assessment (CCPA/CPRA)
Comprehensive evaluation of your organization's compliance with California's privacy regulations, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). Our assessment examines data handling practices, consumer rights processes, and disclosure requirements to identify compliance gaps and provide a detailed remediation roadmap.
Compliance Automation Implementation & Managed Compliance
Compliance automation platforms collect evidence; they do not write your policies, fix failing tests, scope your audit or answer your auditor. We implement the platform against your real environment, author policies that match how you work, close the failing controls, prepare you for the audit and stay on as the managed compliance team if you want one. Platform-neutral: we work with the tool you chose and never take a fee from an auditor.
Data Privacy Compliance Program
Comprehensive data privacy compliance program covering GDPR, CCPA, and other international privacy regulations with implementation support.
Data Privacy Impact Assessment
Systematic evaluation of data handling practices to ensure compliance with privacy regulations and identify potential privacy risks.
Data Security Posture Management (DSPM) Assessment
Discover known and shadow data across cloud and on-prem, classify sensitive data, map access and flows, and remediate exposure. Establishes a continuous data security posture aligned to privacy regimes.
Employee Security Awareness Assessment
Comprehensive assessment of employee security awareness levels to identify training needs and security culture gaps.
FTC Safeguards Rule & IRS WISP Compliance Package
The FTC Safeguards Rule and IRS Publication 4557 require tax preparers, auto dealers, mortgage brokers and other small financial institutions to keep a Written Information Security Program, name a qualified individual, assess risk and train staff. This annual package delivers a WISP that reflects your firm, the risk assessment behind it, staff training and the yearly review that keeps it valid — with a practitioner who can act as your qualified individual.
FedRAMP Compliance Program
Specialized compliance program for cloud service providers seeking FedRAMP authorization, including readiness assessment, documentation preparation, and implementation support.
Financial Services Compliance Program
Comprehensive compliance assessment and implementation program for financial institutions, covering SEC, FINRA, SOX, PCI-DSS, and banking regulations.
GDPR Compliance Assessment
Comprehensive evaluation of your organization's compliance with the European Union's General Data Protection Regulation (GDPR). Our assessment examines data processing activities, privacy controls, and governance frameworks to identify compliance gaps and provide a detailed remediation roadmap for organizations handling EU resident data.
HIPAA Security Risk Analysis — Small Practice
The Security Rule requires every covered entity and business associate to perform a security risk analysis. This engagement delivers exactly that for small and mid-sized practices: an asset and ePHI inventory, threat and vulnerability analysis, risk ratings, and a remediation plan you can show OCR, a payer or a cyber insurer. It is the entry point below the full HIPAA/HITECH Compliance Assessment.
HIPAA/HITECH Compliance Assessment
Comprehensive evaluation of your organization's compliance with HIPAA and HITECH regulations, focusing on the protection of electronic protected health information (ePHI). Our assessment examines technical, administrative, and physical safeguards, providing a detailed gap analysis and remediation plan to achieve and maintain compliance while reducing the risk of breaches and penalties.
HITRUST e1 / i1 Readiness
Healthcare customers and payers increasingly require HITRUST. We scope the assessment, perform the readiness assessment against the e1 (44 requirements) or i1 (182 requirements) set, remediate gaps, build the evidence library in MyCSF terms and prepare you for the external assessor. We are the readiness partner, not the assessor.
ISO 27001 Certification Readiness Assessment
Comprehensive evaluation of your organization's readiness for ISO 27001 certification, examining your information security management system (ISMS) against the standard's requirements. Our assessment provides a detailed gap analysis and implementation roadmap to help you achieve certification efficiently and effectively.
ISO/IEC 42001 & EU AI Act Readiness
Organizations building or deploying AI are being asked for ISO/IEC 42001 certification and EU AI Act conformity. This engagement inventories your AI systems, classifies them under the AI Act risk tiers, assesses the AI management system against ISO 42001 Annex A, and produces the policies, impact assessments and roadmap needed to reach certification readiness.
NIST CSF 2.0 Maturity Assessment
A named, fixed-scope assessment against all six NIST Cybersecurity Framework 2.0 functions — Govern, Identify, Protect, Detect, Respond, Recover. Evidence-based interviews and document review produce a current-state maturity score per category, a target profile matched to your risk appetite, and a funded roadmap. The scorecard is built to be shown to a board, an acquirer or a cyber insurer.
PCI DSS Compliance Assessment
Comprehensive evaluation of your organization's compliance with Payment Card Industry Data Security Standard (PCI DSS) requirements. Our assessment examines cardholder data environments, security controls, and processes to identify compliance gaps and provide a detailed remediation roadmap to achieve and maintain PCI DSS compliance while protecting sensitive payment information.
SMB Compliance Readiness
Targeted assessment for SMBs preparing for compliance certification.
SOC 2 Readiness Assessment
Comprehensive evaluation of your organization's readiness for SOC 2 compliance, examining your controls against the relevant Trust Services Criteria. Our assessment provides a detailed gap analysis and implementation roadmap to help you prepare for a successful SOC 2 audit.
State & Local Government Compliance Assessment
Specialized compliance assessment for state and local government agencies addressing the unique regulatory requirements that apply to public sector entities. Our evaluation examines state-specific cybersecurity regulations, data protection laws, sunshine laws, records retention requirements, and security standards to help government entities achieve compliance and protect sensitive information.
Trifecta Security Assessment: Business Continuity, Disaster Recovery, and Incident Response
Comprehensive assessment covering three critical areas of organizational resilience - business continuity planning, disaster recovery strategies, and incident response capabilities.
Aviation & Aerospace Security Assessment
Specialized security assessment for aviation and aerospace organizations, addressing the critical security challenges of aircraft systems, airport infrastructure, flight operations, and aerospace manufacturing. Our assessment helps aviation organizations protect safety-critical systems, intellectual property, and operational technology while meeting strict regulatory requirements and ensuring passenger safety.
Defense Industry Security Program
Comprehensive security assessment and compliance program for defense contractors and military industrial complex, focusing on CMMC, NIST 800-171, and classified information handling.
Digital Transformation Security Program
Comprehensive security assessment and framework designed specifically for organizations undergoing digital transformation initiatives. Our specialized program addresses the unique security challenges of rapid technological change, legacy system integration, new business models, and accelerated development cycles - ensuring security becomes an enabler rather than a barrier to digital innovation.
Election Systems Security Assessment
Specialized security assessment for election systems and voting infrastructure, including hardware testing, software evaluation, and process validation.
Healthcare Device Manufacturing Security Program
Comprehensive security assessment for medical device manufacturers, covering FDA compliance, manufacturing processes, and device security throughout the development lifecycle.
Pharmaceutical Industry Security Assessment
Comprehensive security assessment designed specifically for pharmaceutical organizations, addressing the unique security challenges of drug development, clinical trials, manufacturing, and distribution. Our specialized assessment examines intellectual property protection, research data security, regulatory compliance, and supply chain integrity to secure your most valuable assets and ensure compliance with industry regulations.
Startup Security Readiness Assessment
Specialized security assessment designed for startups at every growth stage, from angel funding through Series A and beyond. Our tailored approach addresses the unique security challenges of rapidly evolving startups, balancing innovation speed with essential security controls. We help founders and startup teams build security foundations that enable growth, satisfy investor expectations, and prepare for enterprise customer requirements without slowing down product development.
Compliance Assessment
Evaluate and achieve compliance with major security frameworks
Cyber Insurance Readiness Assessment
Prepare your organization for cyber insurance applications and renewals by evaluating compliance with insurer requirements, identifying control gaps, and implementing documentation to support favorable coverage terms and rates.
Remote Work Security Assessment
Comprehensive evaluation of your organization's remote work security posture in today's hybrid workplace environment. Our assessment examines remote access infrastructure, endpoint security, home network risks, secure communications, data protection measures, and policy effectiveness for distributed workforces, providing a roadmap to secure your modern workplace.
Vendor & Third-Party Security Risk Assessment
Comprehensive evaluation of your organization's third-party risk management program and vendor security assessment practices. Our assessment examines your vendor security evaluation processes, contractual security requirements, ongoing monitoring capabilities, and supply chain security controls to identify vulnerabilities in your extended enterprise and provide a roadmap for enhanced third-party risk management.
Rather build it yourself?
The Compliance Operating System
Map controls once and satisfy every framework, driven from your own registry rather than a platform’s integrations — including the ISO 42001 and EU AI Act layer most guides still omit.
Research
Latest from the blog
compliance · Oct 18, 2026
CIRCIA's Final Rule Nears Publication, but OT Operators Still Can't Prove Data Integrity
CISA's final CIRCIA rule is now with the White House for review, but the reporting mandate still assumes operators can trust their own telemetry — a gap OT environments haven't closed.
ciso-strategy · Oct 17, 2026
Proofpoint's $6.3B Varonis Deal: What the Data-Security M&A Wave Means for Your Contracts
Proofpoint will pay $6.3 billion for Varonis, creating a 16,000-customer data and AI security giant. Here's what current customers of both vendors need to ask before the 2027 close.
supply-chain-security · Oct 17, 2026
AI Audit Finds 25-Year-Old Curl Bug on 20 Billion Devices: CVE-2026-8932
An AI-powered audit of Curl uncovered a 25-year-old authentication bypass affecting billions of devices, surfacing 35 CVEs that human review missed for decades.
Start an engagement