Overview
US compliance is a patchwork. SOC 2 unlocks enterprise deals, HIPAA governs health data, PCI DSS covers card data, the FTC Safeguards Rule and NYDFS Part 500 set testing duties for many financial firms, and CMMC applies to defense contractors. We help you map one set of controls and tests across them. We are not a CPA firm, QSA or C3PAO, so your audit stays independent.
Customers, partners and regulators increasingly require proof that you take security seriously. Frameworks like SOC 2 and ISO 27001 unlock enterprise deals; PCI DSS is mandatory for card data; and US rules such as the FTC Safeguards Rule, NYDFS Part 500, HIPAA and CMMC set detailed cybersecurity expectations.
We start with a gap assessment against your target framework, then help you close gaps with right-sized policies, technical controls and evidence — without bureaucracy that slows your team down. Our penetration testing, SOC, vulnerability and patch management services provide much of the technical evidence auditors expect.
We work alongside your chosen certification body or audit firm, so the audit itself stays independent.
Compliance support for US organizations
- SOC 2 readiness and penetration testing evidence for your CPA firm
- HIPAA risk analysis and technical evaluation support for covered entities and business associates
- FTC Safeguards Rule and NYDFS Part 500 testing and vulnerability assessment schedules
- CMMC and NIST SP 800-171 gap assessments for defense contractors (we are not a C3PAO or RPO)
What's included
Our approach
- ScopingDefine the systems, data and teams in scope for your framework.
- Gap assessmentControl-by-control review with a prioritized remediation roadmap.
- Remediation supportPolicies, procedures and technical controls implemented with your team.
- Testing & evidenceAudit-ready penetration tests, scans and monitoring evidence.
- Audit supportPre-audit review and support during auditor questions.
What you receive
- Gap assessment report and roadmap
- Policy and procedure set
- Risk register and treatment plan
- Audit-ready penetration test reports
- Evidence checklist mapped to controls
Standards & frameworks
- SOC 2
- ISO/IEC 27001:2022
- PCI DSS v4.0
- HIPAA
- GDPR
- State privacy laws (CCPA/CPRA)
- CMMC 2.0 / NIST SP 800-171
- NYDFS 23 NYCRR Part 500
- FTC Safeguards Rule (GLBA)
- FTC Safeguards Rule (16 CFR 314)
Frequently asked questions
Do you issue SOC 2 reports or ISO 27001 certificates?
No. SOC 2 reports are issued by licensed CPA firms and ISO 27001 certificates by accredited certification bodies. We prepare you and provide testing evidence, which keeps the audit independent.
How long does it take to become audit-ready?
It depends on your starting point. Many growing companies reach SOC 2 Type I or ISO 27001 readiness in a few months with focused effort.
Is a penetration test required for compliance?
PCI DSS explicitly requires it; SOC 2 and ISO 27001 auditors widely expect it as evidence for vulnerability management and control evaluation.
Can you get us SOC 2 or CMMC certified?
We prepare you with gap assessments, control fixes, policies, testing and evidence. The SOC 2 report itself is issued by an independent CPA firm, and CMMC Level 2 certification assessments are performed by an authorized C3PAO. We are not a CPA firm, a C3PAO or an RPO. See our CMMC guide.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.