Compliance Advisory & Assessments

We assess your controls against the framework your auditor will use, close the gaps, and prepare you for the independent audit.

Get Started

Who this is for

You may be preparing for a first audit, renewing a framework you already hold, or answering a customer security questionnaire that exposed gaps. Compliance work is most useful when it starts before the auditor arrives.

  • A SaaS company whose enterprise customers now require a SOC 2 report before they will sign.
  • A healthcare or health-technology organization that must show it meets the HIPAA Security Rule.
  • A company that accepts or processes card payments and must meet PCI DSS v4.0.1.
  • A newly public or pre-IPO company that needs sound SOX IT general controls.
  • A technical team that has been told to pursue ISO/IEC 27001 or HITRUST and does not know where to begin.

What's included

Scope is set in the first week and written down. A typical engagement draws on the following.

  • Framework scoping

    We confirm which framework, report type or certification fits your customers, contracts and regulators.

  • Gap assessment

    We test your current controls against every requirement and record each gap with its severity.

  • Policy and procedure development

    We draft or revise the policies, standards and procedures the framework expects, written to match how you operate.

  • Risk assessment

    We run a documented risk assessment and build the risk register that most frameworks require.

  • Control design and remediation planning

    We specify what each control should look like and sequence the fixes by risk and effort.

  • Evidence preparation

    We define what evidence the auditor will request, who owns it and how to collect it.

  • Mock audit

    We walk through the audit as an assessor would, so weaknesses surface before the real one.

  • Auditor coordination

    We help you select an independent assessor and support you through fieldwork.

How an engagement works

Timelines depend on scope and on how quickly your team can remediate. Readiness engagements typically run 8 to 16 weeks.

  1. Scope and kickoff

    We agree the framework, system boundary, in-scope teams and success criteria, and request your existing documentation.

    About 1 week

  2. Gap assessment

    We interview control owners, review system configurations and documents, and test each requirement. Every finding is rated, mapped to the framework requirement it affects, and written with a recommended fix.

    Typically 2 to 4 weeks

  3. Remediation planning

    We produce a prioritized plan with owners, effort estimates and dependencies, and agree it with your leadership.

    About 1 to 2 weeks

  4. Remediation support

    Your team implements the fixes. We draft policies, review changes and answer questions as they come up.

    Typically 4 to 10 weeks

  5. Mock audit and handoff

    We test the remediated controls, confirm the evidence is complete, and brief you and your assessor before fieldwork begins.

    Typically 2 to 3 weeks

For SOC 2 Type II, the observation period runs separately, typically 3 to 12 months, and begins once controls are in place.

What you receive

Every deliverable is written for reuse. Your team keeps the documents, and your assessor can read them directly.

  • A gap assessment report with each finding rated by severity and mapped to framework requirements.
  • A prioritized remediation roadmap with owners and effort estimates.
  • A policy and procedure set drafted for your environment.
  • A risk assessment and risk register.
  • A control-to-evidence matrix showing what the auditor will ask for and where it lives.
  • A mock audit report with a readiness verdict and any remaining actions.
  • An auditor briefing pack that summarizes scope, system description inputs and control ownership, ready to hand to your chosen assessor.

Frameworks and standards

We map your controls once and reuse that work across frameworks wherever requirements overlap. The terminology below is how each framework is actually assessed.

  • SOC 2

    An attestation report issued by an independent CPA firm against the AICPA Trust Services Criteria. Type I covers control design at a point in time. Type II covers operating effectiveness over a period.

  • ISO/IEC 27001

    A certification of your information security management system, issued by an accredited certification body.

  • HITRUST CSF

    A certification available as e1, i1 or r2 assessments, scaled to risk and assurance level.

  • HIPAA

    There is no official HIPAA certification. We assess you against the Security, Privacy and Breach Notification Rules.

  • PCI DSS v4.0.1

    Assessed by a Qualified Security Assessor, who produces a Report on Compliance and Attestation of Compliance, or completed as a Self-Assessment Questionnaire.

  • FISMA and NIST

    Federal systems are assessed against NIST SP 800-53 Rev 5 under the NIST Risk Management Framework (SP 800-37). NIST CSF 2.0 organizes programs into six functions, including Govern.

  • SOX

    IT controls are tested as IT general controls covering access, change management and operations.

Why Velero

Compliance programs fail when they become paperwork disconnected from how the business runs. Our method keeps the controls tied to your actual systems and people.

  • Independent by design

    We prepare you for the audit and work alongside your assessor. We do not issue reports or certifications, so our readiness findings are not tied to an audit outcome.

  • Senior-led delivery

    Experienced practitioners scope the work, run the assessment and review the output. You are not handed to a junior team after the sales conversation.

  • Plain-English reporting, with remediation support

    Findings are written so an engineer can act on them and an executive can follow them, and we stay involved while the fixes are made. The report ends with decisions and next steps, not a list of observations.

FAQCommon questions

Does Velero issue the SOC 2 report or ISO certificate?

No. A SOC 2 report is an attestation issued by an independent CPA firm, and ISO/IEC 27001 certificates come from accredited certification bodies. We prepare you for those assessments and work alongside the assessor.

How long does SOC 2 readiness take?

Readiness work typically runs 8 to 16 weeks, depending on how many controls are already in place. A Type I report reflects design at a point in time. A Type II report adds an observation period, typically 3 to 12 months, before the auditor can report on operating effectiveness.

Should we start with SOC 2 or ISO/IEC 27001?

It depends on who is asking. US customers most often request SOC 2, while international buyers often expect ISO/IEC 27001. Many controls overlap, so we scope the work to satisfy one and extend to the other without starting over.

Is there a HIPAA certification?

No. HHS does not certify organizations. You are assessed against the HIPAA Security, Privacy and Breach Notification Rules, and we document your compliance against each requirement.

Can you help after the gap assessment?

Yes. Remediation support is part of how we work. We draft policies, review control implementations and prepare your evidence, while your team keeps ownership of the changes. If you want ongoing leadership, the Virtual CISO service can carry the program beyond the audit.

Related servicesExplore related services

Let's talkReady to secure your business?

Tell us what you're working toward and we'll get back to you within one business day.

Schedule a call