Compliance

Frameworks translated into engineering work

Certification is an outcome of controls that actually run. We map requirements to the technical work that satisfies them, then help you evidence it.

Request a gap assessment

Frameworks we work against

Readiness percentages below are illustrative sample values showing how we report progress. They are not a claim about your environment or any client's.

ISO/IEC 27001:2022

Information security management system

Scope definition, Annex A control mapping, internal audit prep and evidence organisation.

Sample readiness82%

SOC 2 Type I / II

Trust services criteria for service organisations

Readiness assessment, control design review, observation-period monitoring support.

Sample readiness76%

PCI DSS 4.0

Cardholder data environment

Scope reduction, segmentation testing, requirement 11 penetration testing.

Sample readiness68%

HIPAA Security Rule

Protected health information safeguards

Administrative, physical and technical safeguard gap analysis and risk assessment.

Sample readiness74%

GDPR / NDPR

Personal data protection

Data-flow mapping, DPIA support, breach notification playbooks.

Sample readiness71%

NIST CSF 2.0

Govern, Identify, Protect, Detect, Respond, Recover

Current/target profile scoring and a tiered improvement roadmap.

Sample readiness79%

CIS Controls v8

Prioritised safeguards by implementation group

IG1–IG3 safeguard assessment and technical hardening baselines.

Sample readiness85%

MITRE ATT&CK

Adversary tactics and techniques

Detection coverage mapping and purple-team validation of high-value techniques.

Sample readiness63%

MITRE ATT&CK coverage matrix

Sample visualisation only. In a real engagement each cell reflects validated detection coverage for a technique in your environment.

Reconnaissance

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command & Control

Exfiltration

Impact

Readiness comparison

Typical audit type, preparation time and evidence per framework
Framework	Assessment type	Typical preparation	Core evidence
ISO 27001	External certification	4–7 months	Statement of Applicability, internal audit, management review
SOC 2 Type II	CPA firm attestation	3–6 months + 3–12 month window	Control narratives, population samples, monitoring logs
PCI DSS 4.0	QSA assessment or SAQ	3–6 months	Segmentation test, ASV scans, annual penetration test
HIPAA	Self-assessment / OCR review	2–4 months	Risk analysis, safeguard documentation, BAAs
NIST CSF 2.0	Self or third-party profile review	2–3 months	Current/target profiles, roadmap, governance records