What we deliver
We review the organization's compliance posture against the frameworks and regulations that apply to its industry, such as ISO 27001 (information security management), SOC 2 reports, Brazil's LGPD data protection law and other frameworks where relevant. The deliverable is a clear view of the current state, the gaps found and a prioritized action plan with owners and deadlines, supporting governance and evidence for third parties.
The problem it solves
Organizations that need to demonstrate compliance to clients, partners or regulators, but have no visibility into their gaps or do not know how to prioritize remediation.
Compliance owners, CISOs and IT leaders who need to demonstrate compliance to internal and external stakeholders.
When the organization needs to prepare for certifications, answer client questionnaires, meet regulatory requirements or understand its current compliance status clearly.
Scope of work
Deliverables
How the work happens, in practice
Which framework applies
ISO/IEC 27001:2022 certifies an information security management system and brings 93 controls in its Annex A, grouped into four themes (organizational, people, physical and technological); SOC 2 is an attestation report that evaluates controls against the trust services criteria (security, availability, processing integrity, confidentiality and privacy), with security being the criterion common to all; the LGPD (Law 13.709/2018) deals with the protection of personal data. Industry-specific standards may add to these. Each one answers different questions: certification of the management system, trust between provider and customer, and legal obligation.
How the review is done
Each applicable requirement is mapped to an existing control, a piece of evidence and an owner. Gaps appear in three forms: a control that does not exist, a control that exists but is not practiced, and a control that is practiced without evidence. Each case calls for a different action: designing the control, training and monitoring execution, or starting to record the proof. Examples of evidence are access review minutes, training records, vulnerability scan reports, backup restore tests and the record of personal data processing operations, as provided for in the LGPD.
From gap to action plan
The result is a prioritized list of gaps, each with an owner and a suggested deadline, which serves two audiences: the team that implements and the leadership that needs to follow the risk. When there is more than one framework, a single control mapping avoids duplicated work, since the same control, such as access management or incident response, usually satisfies ISO 27001, SOC 2 and the LGPD. The goal is continuous governance, with periodic reviews and metrics, not a concentrated effort just before the audit.
What sets us apart
- A technical view integrated with operations
- Focus on real implementation, not just paperwork
- Backed by our security and infrastructure teams to close technical gaps
Methodology
Mapping of applicable requirements
Evidence collection and interviews
Gap analysis
Action plan and prioritization
Follow-up on implementation
Highlights
Frequently asked questions
Ready to move forward?
Tell us about your context and challenges. We reply with a clear proposal.