SOC 2, ISO 27001, HIPAA, CMMC, PCI DSS, NIST CSF, and the FTC Safeguards Rule. Different requirements, the same disciplined approach, and fixed fees agreed before work starts.
Each page explains who it applies to, how the work runs, and what it costs. Facing more than one? Most of the control work overlaps, and the program is built once.
For B2B SaaS and service companies whose enterprise customers want an independent report on their controls.
How I build it →For companies selling internationally or to buyers who require an accredited certificate for the ISMS.
How I build it →For healthcare providers, health plans, and the software and service vendors that handle their patient data.
How I build it →For defense contractors and subcontractors that handle federal contract information or controlled unclassified information.
How I build it →For merchants and service providers that store, process, or transmit payment card data, or can affect its security.
How I build it →For companies that need a defensible security program and a common language for boards, insurers, and customers.
How I build it →For mortgage lenders and brokers, fintechs, auto dealers that arrange financing, tax preparers, and other non-bank financial institutions.
How I build it →Requirements differ. The way a defensible program gets built doesn’t.
What you are actually required to do, by whom, and by when. It is often narrower than you have been told, and it sets the scope for everything else.
Where you stand against the requirements, with gaps ranked by risk and by what an auditor or customer will test first.
Risk assessment, policies, and controls written for how your company operates, and nothing you will never use.
Records that show the controls run, organized the way assessors and customers ask for them.
Preparation for the auditor, assessor, examiner, or customer review, and support while it happens.
Start with a fixed-fee assessment against one framework. If you go on to implementation within 30 days, the full assessment fee is credited.
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentFrom $30,000 fixed
ISO 27001 or SOC 2 built and audit-ready.
From $2,000 / month
Someone accountable for running the program after it is built.
Independence: I don’t perform audits, issue certificates, or sign attestations. CPA firms, accredited certification bodies, QSAs, and C3PAOs do that work, and I prepare you for it.
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com