Security · Trust
SOC 2 Type I & II
Independent attestation for security, availability, processing integrity, confidentiality, and privacy controls — designed for organizations selling trust to enterprise customers.
Learn more
Services
Assurance & compliance services.
Independent CPA attestation and compliance support across SOC, privacy, healthcare, federal, ISO and DORA frameworks, delivered by licensed CPAs on fixed-fee engagements.
- SOC 1
- SOC 2
- HIPAA
- GDPR
- GAPP
- Federal
- ISO 27001
- ISO 27701
- ISO 42001
- ISO 9001
- DORA
Financial controls
SOC 1 Type I & II
Independent attestation for internal controls over financial reporting (ICFR) — designed for organizations handling transactions, payroll, or financial data that impacts client books.
Learn more
Healthcare · Privacy
HIPAA
Independent attestation and compliance validation for administrative, physical, and technical safeguards — designed for organizations handling Protected Health Information (PHI) in the healthcare ecosystem.
Learn more
Data protection · EU
GDPR
Independent compliance validation for data protection by design and default, emphasizing data subject rights and lawful processing — designed for organizations handling EU citizens' personal data.
Learn more
Privacy governance
GAPP
Generally Accepted Privacy Principles support for organizations building disciplined privacy governance and assurance programs.
Learn more
Federal · Government
Federal Compliance
Readiness and attestation support aligned to federal contracting and compliance requirements including FedRAMP, NIST SP 800-53, NIST SP 800-171 / CMMC, CJIS Security Policy, ITAR / EAR.
Learn more
Management systems · Certification
ISO Compliance
ISO 27001ISO 27701ISO 42001ISO 9001
Certification readiness and independent assessment support for the ISO management-system standards enterprise customers ask for most: information security, privacy, AI governance and quality.
Learn more
EU · Financial resilience
DORA Compliance
Readiness and independent assessment against the EU Digital Operational Resilience Act, covering ICT risk management, incident reporting, resilience testing and third-party risk.
Learn more
01 / SOC 2
SOC 2 across the five Trust Services Criteria.
An independent CPA report on how your controls meet the AICPA Trust Services Criteria. You choose which criteria are in scope, and Security is always included.
Security
Protection of systems and data against unauthorized access and other threats. Always part of a SOC 2 report.
Availability
Systems are available for operation and use as committed to customers.
Processing integrity
System processing is complete, valid, accurate, timely and authorized.
Confidentiality
Information designated as confidential is protected as committed or agreed.
Privacy
Personal information is collected, used, retained and disclosed in line with your commitments.
02 / SOC 1
SOC 1 reports for controls that affect financial reporting.
For service organizations whose processing can affect their customers’ financial statements. Your customers and their auditors use the report for internal control over financial reporting (ICFR).
Design at a point in time
Whether controls are suitably designed to meet the stated control objectives as of a specified date.
Operation over a period
Whether those controls also operated effectively across a review period, with tests and results described.
SSAE 18 · AT-C 320
Reports follow AICPA attestation standards for reports on controls at a service organization relevant to user entities’ ICFR.
Payroll, fintech & outsourced finance
Organizations that process transactions, payroll or financial data that flows into their clients’ books.
03 / HIPAA
HIPAA safeguards for Protected Health Information.
Independent attestation and compliance validation for organizations that create, receive, maintain or transmit Protected Health Information (PHI).
Administrative
Risk analysis, workforce policies and training, access management and incident response procedures.
Physical
Facility access controls, workstation use and security, and device and media handling.
Technical
Access control, audit logging, integrity controls and transmission security for systems that hold PHI.
Covered entities & business associates
Healthcare providers, health plans, digital health companies and the vendors that serve them.
04 / GDPR
GDPR validation for personal data in the EU.
Independent compliance validation for organizations that handle the personal data of people in the European Union.
Lawful processing
A documented lawful basis, purpose limitation and data minimization for each processing activity.
Data subject rights
Working processes to handle access, correction, erasure, portability and objection requests on time.
Data protection by design and default
Privacy built into products and systems, supported by impact assessments where required.
Records & processors
Records of processing, processor agreements and breach response that you can evidence on request.
05 / GAPP
Ten privacy principles, one governance framework.
Generally Accepted Privacy Principles give your privacy programme a structured, auditable foundation. We assess how each of the ten principles is addressed.
Management
Defined accountability, policies and procedures for privacy.
Notice
Clear communication of your privacy practices.
Choice & consent
Choices offered and consent obtained where needed.
Collection
Personal information collected only for stated purposes.
Use, retention & disposal
Limits on use, defined retention and secure disposal.
Access
Individuals can review and update their information.
Disclosure to third parties
Sharing governed by notice, consent and agreements.
Security for privacy
Safeguards against unauthorized access and loss.
Quality
Information kept accurate, complete and relevant.
Monitoring & enforcement
Ongoing compliance checks and a way to resolve complaints.
06 / Federal compliance
Federal compliance for contractors and suppliers.
Readiness and attestation support aligned to the frameworks federal customers and prime contractors ask for.
Cloud authorization
A standardized security assessment approach for cloud services used by US federal agencies.
Security & privacy controls
The control catalog used for federal information systems and organizations.
Controlled information
Protection of Controlled Unclassified Information, with CMMC for Department of Defense contractors.
Security Policy
Safeguards for criminal justice information handled by agencies and their service providers.
Export controls
Controls over defense and dual-use items and technical data subject to US export rules.
07 / ISO certifications
ISO compliance across four certifications.
One assurance partner for the ISO management-system standards customers, regulators and procurement teams ask for.
Information Security Management System (ISMS)
The international benchmark for managing information security risk. We review scope, risk treatment, your Statement of Applicability and control evidence to prepare you for certification.
Privacy Information Management System (PIMS)
Extends an ISMS with privacy-specific controls for organizations that process personally identifiable information, supporting GDPR-aligned privacy governance.
Artificial Intelligence Management System (AIMS)
The first international management-system standard for AI. It covers AI governance, risk and impact assessment, and the responsible development and use of AI systems.
Quality Management System (QMS)
The widely adopted standard for consistent quality and continual improvement, covering process control, customer focus, documented information and internal audit.
08 / DORA readiness
Digital operational resilience for the EU financial sector.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to financial entities and the ICT providers that serve them. Our readiness work follows its five pillars.
ICT risk management
A documented framework to identify, protect against and recover from ICT risk.
Incident management & reporting
Classification and timely reporting of major ICT-related incidents.
Resilience testing
A programme of digital operational resilience testing, including advanced testing where required.
Third-party risk
Oversight of ICT third-party providers, contractual provisions and exit strategies.
Information sharing
Arrangements for exchanging cyber threat information and intelligence.
09 / Engagement process
A practical path from scope to assurance.
STEP 0101
Scope the engagement
Define the framework, organizational scope, systems, locations, reporting period, and stakeholder requirements.
STEP 0202
Review the control environment
Evidence review and control testing are organized around the requirements of the selected framework.
STEP 0303
Identify and address gaps
Where remediation is required, the team maps findings to practical next steps and readiness priorities.
STEP 0404
Independent CPA attestation
Complete the independent engagement and formal attestation process for the agreed scope.
STEP 0505
Final report & stakeholder confidence
Receive the final engagement deliverables and a defensible assurance package for customers, partners, finance teams, and procurement.
04 / Start a conversation
Let’s make trust tangible.
Tell us which framework you need, your timeline and your requirements. Our team will respond with formal pricing and engagement guidance.