Know exactly where
your security stands.
In 48 hours.

No — and it’s important to be clear about this. This is a rapid gap assessment, not a formal certification audit. It does not issue a SOC 2 report, a HIPAA attestation, or any official compliance certificate. It is a structured, expert-led review of your current controls against the framework requirements. The purpose is to tell you where you are and what you need to fix — so that when you do go to a formal auditor, you’re not walking in blind.

A full gap assessment typically involves multiple weeks of evidence collection, stakeholder interviews, technical testing, and a comprehensive report that could run 60–100+ pages. This rapid audit covers the most critical control areas in a structured, evidence-based review designed to deliver actionable results in 48 hours. It gives you the 80% picture — your highest-priority gaps — without the timeline or cost of a full engagement.

Yes — each framework is a separate assessment priced at $500. If you need coverage across two or more frameworks, we can run them sequentially or discuss a bundled price on your intake call. The most common combination is SOC 2 + HIPAA for health tech companies, or SOC 2 + ISO 27001 for companies with both US and international enterprise customers. SOC 2 and ISO 27001 share significant control overlap, which can reduce the total effort required for the second assessment.

That’s exactly what the assessment is designed to surface. We review what you have and document what’s missing. You’ll walk away knowing your gaps clearly — even if the answer is “you have a lot of foundational work to do.” In fact, companies with limited documentation often get the most value from this assessment because it creates a clear, prioritized starting point rather than a vague list of everything that’s wrong.

Yes. The report is formatted as an executive-ready document precisely for this purpose. Many clients use it to demonstrate proactive security posture to enterprise procurement teams, to show investors a clear compliance roadmap, or to respond to a vendor security questionnaire in a structured way. That said, the report should always be presented alongside its scope limitations — it is an internal gap assessment, not a third-party audit opinion.

The answer is almost always: whatever your customers are asking for. If enterprise prospects are sending you security questionnaires referencing SOC 2 — start there. If you handle health data and your customers are hospitals or health plans — HIPAA is your priority. If your customers are international enterprises or you’re pursuing EU contracts — ISO 27001. We’ll sort this out definitively during the 20-minute intake call.

You take the report, work through the remediation roadmap with your team, and come back when you’re ready to go deeper. There is no pressure and no automatic upsell. That said, if the assessment reveals that you need ongoing advisory support — a SOC 2 Readiness Program, a vCISO Retainer, or a HIPAA compliance program — I’ll outline what that looks like during the debrief call. The next step is always your call.