Security policies, controls, and evidence your team can maintain

• Policies say one thing and teams do another, which turns into a finding in every review.
• Evidence is gathered in a rush before each audit and lives in personal folders.
• Each framework has its own spreadsheet, so the same control is tested and documented several times.
• No one is sure who owns each control or how often it should run.

• Approved policy set in editable formats, with version history and review dates
• Control library with owners, frequencies, and framework mappings
• Evidence plan and recurring collection calendar
• Evidence repository structure with naming conventions
• Control-owner training materials

1. 01

   Baseline

   We review your current policies, controls, and evidence, and identify which frameworks and customer requirements apply.

2. 02

   Design

   We draft policies and controls with the people who'll own them, so they reflect how work actually gets done.

3. 03

   Map

   We map each control to your frameworks and define the evidence it should produce.

4. 04

   Put it into practice

   We set up the evidence calendar and repository and train control owners.

5. 05

   Test the routine

   We run a practice evidence-collection cycle and close gaps before any real review.

• NIST CSF 2.0 and the CIS Critical Security Controls v8.1 as a baseline control set
• AICPA Trust Services Criteria, for organizations preparing for SOC 2
• ISO/IEC 27001 requirements and Annex A controls, for organizations pursuing certification
• HIPAA Security Rule safeguards, PCI DSS requirements, and CMMC requirements where they apply

• SOC 2 uses the AICPA Trust Services Criteria: the common criteria CC1 through CC9, plus additional criteria for availability, processing integrity, confidentiality, or privacy when those categories are in scope, with points of focus as guidance.
• ISO/IEC 27001:2022 sets management system requirements in clauses 4 to 10, and its Annex A lists 93 reference controls in four themes: organizational, people, physical, and technological.
• The HIPAA Security Rule sets administrative, physical, and technical safeguard standards, with implementation specifications marked required or addressable.
• NIST CSF 2.0 describes outcomes, organized into six Functions and then into Categories and Subcategories.

Sources: AICPA & CIMA: 2017 Trust Services Criteria (With Revised Points of Focus – 2022); ISO/IEC 27001:2022 (publisher-authorized preview); IAF MD 26: transition requirements for ISO/IEC 27001:2022; ISO/IEC 27002:2022 table of contents, as adopted by SIST (publisher-authorized preview); eCFR: 45 CFR Part 164, Subpart C (HIPAA Security Rule); NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)

Read the full guide: SOC 2 Trust Services Criteria explained, CC1 to CC9

• A sponsor who can approve policies and assign control owners
• Named control owners with time to review drafts and attend training
• Access to existing policies, procedures, and any prior audit or customer-review findings
• A decision on where evidence will be stored

• Compliance · 10 min readHIPAA Security Rule checklist: every standard, explainedA HIPAA Security Rule checklist built from 45 CFR 164.308 to 164.316: every standard and implementation specification, marked required or addressable.
• Compliance · 12 min readSOC 2 readiness checklist: how to prepare for your reportA practical SOC 2 readiness checklist: set your system boundary, pick Trust Services Criteria, close control gaps, collect evidence and choose a CPA firm.
• Compliance · 10 min readSOC 2 Type 1 vs Type 2: which report do you need?SOC 2 Type 1 vs Type 2: what each report covers, how the Type 2 review period works, and how to decide which one your customers actually need first.
• Compliance · 10 min readISO 27001 vs SOC 2: differences and which to pursueISO 27001 vs SOC 2: certificate vs attestation report, who issues each, how scope and upkeep differ, and how to decide which to pursue first or do both.
• Compliance · 10 min readSOC 2 Trust Services Criteria explained, CC1 to CC9The SOC 2 Trust Services Criteria explained: the five categories, the CC1 to CC9 common criteria, points of focus, and how to choose what goes in scope.
• Readiness · 11 min readThe ISO/IEC 27001 certification process, step by stepThe ISO/IEC 27001 certification process, step by step: ISMS scope, risk assessment, Statement of Applicability, stage 1 and 2 audits, and surveillance.