Four-week Compliance Readiness Initiative
Control-by-control readiness review against your target framework: the SOC 2 Trust Services Criteria, HIPAA Security Rule, CMMC Level 2, PCI DSS v4.0.1, ISO 27001 Annex A, NERC CIP, or another you name. Each control is mapped to your current architecture, with an evidence map and a remediation order tied to your audit date. We find the gaps. The body that certifies or attests for your framework does that part.
Who this is for
A gap analysis against the framework you answer to.
Chief Compliance Officer (CCO)
You need a pre-audit posture document before you engage an external auditor.
CISO
You need to know which controls fail before an auditor finds them.
General Counsel (GC)
You need compliance posture documented for board reporting or regulatory disclosure.
CFO
You need audit-readiness scoped before committing to the cost of certification.
Scope
What this initiative delivers, and what it does not.
Scope is fixed at signing. Items marked TOP are available through the Technology Operating Partner (TOP) Program. Items marked with a firm type need a separate engagement with that kind of firm.
In scope
- Framework selection confirmation (SOC 2 Trust Services Criteria, HIPAA Security Rule, CMMC Level 2, PCI DSS v4.0.1, ISO 27001 Annex A, NERC CIP, or your specified framework)
- Control-by-control gap analysis against current architecture
- Policy and procedure documentation review
- Evidence collection map (which artifact proves which control)
- Remediation priority list mapped to audit timeline
- Pre-audit posture report formatted for auditor handoff
Out of scope
- Audit, attestation, or certificationIssuing body
- Policy and procedure draftingTOP
- Staff training for audit interviewsTOP
- Implementing the remediationTOP
- Continuous monitoring or ongoing audit prepTOP
Inputs
What we need from you
Provided at kickoff. Missing inputs delay the initiative; they do not change scope.
- Confirmation of target framework
- Existing policies, procedures, and prior audit reports if any
- Read-only access to systems whose controls are in scope
- Two to four interviews (compliance lead, security lead, IT operations, audit liaison if assigned)
Timeline
Week by week
Status updates run throughout the work. The direction check with the CCO comes in week 3, before the final report.
Week 1
Framework lock and intake
Framework confirmed, scope of controls finalized. Existing documentation reviewed against framework requirements.
Week 2
Control-by-control mapping
Each control assessed against current state. Interviews conducted to fill documentation gaps.
Week 3
Evidence map and prioritization
Specific artifacts identified to prove each in-place control. Gaps ranked by audit timeline and remediation effort. Direction check with the CCO.
Week 4
Final report and handoff
Final gap report and evidence map delivered with walkthrough.
Output
What you walk away with
- Written gap analysis report mapped control-by-control to your target framework
- Evidence collection map (artifact list per control)
- Remediation priority list ranked by audit timeline
- Pre-audit posture summary formatted for auditor handoff
- Walkthrough call
Limits
What this initiative is not
This is a pre-audit gap analysis, not an audit, attestation, or certification. The output is built to hand to the assessor for your framework: a licensed CPA firm for SOC 2, a CMMC Third-Party Assessment Organization (C3PAO) for CMMC, a Qualified Security Assessor (QSA) for PCI DSS, and an accredited certification body for ISO 27001. HIPAA has no certification, so your risk analysis and any regulator review are the test. For NERC CIP, confirm the audit body with your regional entity. We do not perform the audit.
If you are a portfolio company
How the work fits a PE-backed company.
In a PE-backed company, the audit date and the board calendar usually set the pace of this work.
- Audit date. The remediation list is ordered by your audit date, so the controls that must pass first come first.
- Board cycle. The report is timed to land before the next quarterly board meeting.
- Add-on companies. Controls inherited through an acquired company are listed separately, so the deal team can decide whether to bring them into the same audit.
Related
Initiatives that pair with this one
FAQ
Questions buyers ask first
SOC 2 or ISO 27001 first?
If the buyer base is US SaaS customers, SOC 2 Type II answers the procurement question fastest. If the buyer base is European or enterprise, ISO 27001 is the framework that appears in the contract. The control sets for the two frameworks overlap substantially, and the share depends on scope. If both are in scope at signing, each control is mapped to both frameworks and the evidence map lists each artifact once against each, so the second audit starts from work already done.
What drives the cost of SOC 2 readiness?
Scope, company size, complexity, and regulatory exposure drive it. Companies that start without a control inventory carry the readiness work, the remediation, the tooling, and the audit. Companies that already run continuous compliance carry mostly the audit, which a licensed CPA firm performs. Preside fixes the price at scoping. The initiative maps the controls and evidence that continuous compliance depends on. The map is current on the day it is delivered. Keeping it current is the Program's job or yours.
What is continuous compliance vs a point-in-time audit?
A point-in-time audit tests controls during a specific window, usually three to twelve months for SOC 2 Type II. Continuous compliance tools test many controls on a schedule. The annual audit still happens. Audit prep time drops because the evidence is current, and how much it drops depends on the framework and the tooling. Under the Technology Operating Partner Program, Preside tracks control status and evidence through the year and reports it to the CFO and board. Your team keeps running the controls.
What changed in PCI DSS v4.0.1 that we have to comply with now?
The 51 requirements that were future-dated in PCI DSS v4.0 became mandatory on March 31, 2025, and they carry into v4.0.1. Multi-factor authentication for all access into the cardholder data environment, not just remote. Twelve-character minimum passwords where supported. Documented cryptographic cipher inventory, reviewed at least annually. Targeted risk analyses on a defined cadence. The Compliance Readiness Initiative checks your current state against those requirements and sequences remediation against the next audit date.
For your role
Pages for your role
After the initiative
If you want the work to continue
This initiative is a one-time, fixed-price piece of work that ends with the gap report. If you want control status and evidence tracked through the year, the Technology Operating Partner Program does that on a quarterly cycle and reports it to the CFO and board. You choose the Program level after you have the report.
Ready to scope this
A pre-audit gap report and evidence map. Four weeks.
Tell us the situation in a few sentences. We reply within one business day to confirm fit or point you to a better one.
Not sure this is the right initiative for your situation? Take the four-question path-finder for a personalized recommendation.