Compliance
SOC 2, ISO 27001, HIPAA, PCI.
From gap assessment to audit-ready in months — with evidence collection wired into your SOC.
Overview
We support governance, risk and compliance programmes, including ISO 27001 ISMS implementation, PCI DSS, SWIFT CSP and local NBE / INSA requirements. We assess gaps, develop policies and controls, and prepare evidence for your independent auditor.
What's included
- Gap assessment against the framework of your choice
- Policy authoring and tailoring
- Control implementation roadmap
- Evidence automation via Drata / Vanta
- Auditor coordination and sample defense
- Annual recertification support
Deliverables
- Gap assessment report
- Approved policy library
- Control mapping (CSF, CIS, ISO)
- Audit evidence repository
- Audit-readiness pack for independent assessment
Frequently asked
How long does SOC 2 Type II take?+
Type I in 6–8 weeks. Type II requires a 3–12 month observation window after Type I.
Can you bring an auditor?+
Yes — we have CPA partners we work with regularly. You can also bring your own; we'll prep your evidence to their format.
Do you handle multiple frameworks at once?+
Yes. Most customers run SOC 2 + ISO 27001 in parallel; controls overlap ~70%.