Know exactly where you stand
A gap assessment against the audit your customers are asking for, with gaps ranked by effort and risk. No guessing.
Compliance & Audit Readiness
Get through the security review, and close the deal
A big customer wants proof you take security seriously, like an audit report or a certification, and suddenly a deal depends on something nobody on the team has done before. I’ve taken an IT department through two major security certifications at the same time, and wrote the policies both audits required. I’ll tell you what matters for a team your size, build controls that fit how you really work, and get you to audit day with confidence.
Sound familiar?
If you’ve thought this lately
- “Our biggest deal is stuck in security review.”
- “A prospect asked for our audit report, and we don’t have one.”
- “We bought a compliance tool, and it’s showing 200 failing tests.”
- “We’re not even sure which audit we need.”
- “We have policies. Nobody actually follows them.”
Deliverables
What you get
A timeline you can give customers
What’s in scope and a realistic plan, so you can tell a prospect when to expect your report.
Controls that fit how you work
Right-sized policies and the technical controls behind them: access reviews, MFA, device management, logging, backups, and vendor risk.
Walk into the audit ready
Evidence collection, auditor walkthroughs, and a straight answer when the auditor asks the hard questions.
In scope
- Readiness for SOC 2, ISO 27001, and similar security audits
- Risk assessments and security policies, right-sized for a small team
- Compliance tool setup — Vanta, Drata, Secureframe
- Security questionnaires and customer trust requests
- Choosing and working with an auditor
- Controls that keep running after the audit
Not included
- Performing the audit or issuing the report — that’s the independent auditor’s job
- Legal advice or contract review
- Penetration testing (I’ll help you scope it and pick a firm)
Common tools
VantaDrataSecureframeGoogle WorkspaceMicrosoft 365AWSAzureIntune
FAQ
Common questions
Can you get us certified?
I get you ready. The audit itself is done by an independent firm. My job is to make sure you pass, and that everything keeps working after the auditor leaves.
Which audit do we need?
Usually whichever your customers ask for. In the US that’s most often SOC 2; in Europe and with global enterprises, ISO 27001 is common. They overlap a lot, so doing one makes the next much easier.
How long does it take?
Most small teams need a few months to get ready. Some audits also check how your controls run over a period of time, often three to twelve months. The gap assessment gives you a realistic timeline.
Do we need a compliance tool?
Not always, but for most small teams a tool like Vanta or Drata saves real time collecting evidence. I’ll help you decide, and set it up properly if you go that route.
Does this work alongside Fractional IT?
Yes, and it often should. Many controls — access reviews, device management, backups — are exactly what fractional IT management keeps running month to month.
Tell me what’s broken. I’ll map the way up.
A free 30-minute call. Tell me what’s keeping you up at night, and you’ll leave with a clear next step, whether or not we work together.