Straight answers about audits, assessments and working with us.

A Type 1 report evaluates the design of controls at a specific point in time. A Type 2 report evaluates both design and operating effectiveness over a defined review period. The period and scope are agreed between you and your CPA firm.

No. SOC 2 examinations are performed, and reports issued, by independent, qualified CPA firms. We provide readiness and advisory services and can support your team during the examination.

No. Certification is performed by an independent certification body. ISO publishes the standard but does not certify organizations. We help you build and operate your ISMS and prepare for the certification audit.

No. There is no official government HIPAA certification. HIPAA readiness involves ongoing assessment and management of privacy and security obligations. We provide advisory support; legal advice, where required, should come from qualified counsel.

A virtual CISO provides fractional security leadership under an agreed engagement: setting strategy and a roadmap, maintaining a risk register, reviewing governance, advising leadership and teams, and reporting progress. It does not include 24/7 monitoring, incident response or legal services unless agreed separately.

Yes. Coordinating with internal IT and engineering teams is part of most engagements, and we can help your organization prepare for and respond to external auditors. Auditors and certification bodies retain responsibility for their own decisions.

Yes, where agreed. Ongoing support can include remediation guidance, retesting, control monitoring, evidence preparation for Type 2 periods, surveillance audit preparation or a vCISO engagement.

The targets, approach, testing window, reporting and any retest are defined in the written scope and rules of engagement before testing begins. Reports typically include an executive summary, technical findings with risk ratings, evidence where appropriate and remediation guidance. Testing is time-bound and cannot identify every vulnerability.

Many activities can be delivered remotely. Whether on-site work is possible depends on location, scope and the agreed engagement. [Owner to confirm regions served]

Where included in the agreed service, the platform can hold the outputs of our work — such as registers, policies and actions — so you can keep managing them. Availability, features, hosting, pricing, data ownership and support are discussed as part of the engagement.

Training needs for employees, managers, IT teams, developers and new starters can be discussed as part of an engagement. Specific platform capabilities are being confirmed. [Owner to confirm]

Send an inquiry through the contact page or book a call. We will arrange a short conversation to understand your goals and, if it is a fit, propose a written scope.