Compliance Readiness
Compliance assessments from 22 Security.
I assess where you stand against SOC 2, HIPAA, HITRUST, ISO 27001, PCI DSS, or NIST. The external assessment looks at you from the outside. The internal assessment looks from the inside and includes the external one.
Two assessments
From the outside and from the inside.
I check what anyone on the internet can verify about you and map it to the framework. It takes one week.
Enterprise security reviewers and cyber insurers often check what you expose to the internet before they ask you anything. Seeing it first means you fix it before it comes up in a deal or a renewal.
I start with your controls and work up to the frameworks and customer requirements they serve. Then I work back down to the procedures, systems, and evidence behind each one.
Enterprise customers ask for a SOC 2 report or a completed security questionnaire before they sign. Finding the gaps first means you fix them on your schedule, not in the middle of a deal.
Where to start
Start with the question you are being asked.
The report
What the report is.
Every finding cites the controls it is supporting evidence for, under each framework where there is an honest match. Whether a control is met is the auditor’s call. 22 Security does not issue SOC 2 reports or HITRUST certifications. An assessment is the work you do before the audit.
- SOC 2References cite the 2017 Trust Services Criteria for SOC 2.
- HIPAAReferences cite the HIPAA Security Rule at 45 CFR Part 164.
- HITRUSTReferences cite the HITRUST CSF assessment domains.
- ISO 27001References cite ISO/IEC 27001:2022 Annex A.
- PCI DSSReferences cite PCI DSS v4.0.1.
- NIST CSFReferences cite NIST CSF 2.0.
- NIST 800-53References cite NIST SP 800-53 Rev. 5.
Track record
I have run assessments from both sides.
Mergers and Acquisition
Acquired by our customer
I led our HITRUST r2 assessment from the inside: the gap assessment, remediating the controls that had to pass in each domain, and assembling the evidence for the assessors. That certification won customer trust and gave Optum, already one of our customers, the confidence in our systems to acquire us.
Not sure which one?
Tell me what you are being asked for and who is asking. A 30-minute call gets us to the right assessment. Sometimes the answer is that you do not need one yet.