Governance, Risk & Compliance (GRC) Services
Risk Assessment Services
We help develop and improve the policies, risk register, and evidence trail that auditors and customers expect. Our Risk assessment services help to identify, analyze, and prioritize risks that could impact an organization’s operations, technology, security, compliance, or strategic objectives. At their core, these services help leaders with the controls or actions needed to reduce the risk to acceptable levels.
Certification and audit readiness
- Gap analysis, policy writing, evidence collection and auditor liaison for SOC 2, ISO 27001, HIPAA, PCI DSS and NIST CSF, CIS RAM
Third-Party/Vendor Risk Assessments
- Questionnaires, tiering and review workflows that match how many vendors you actually have.
- Frameworks & Standards - NIST CFS, NIST SP 800‑(53, 161). ISO/IEC (27001, 27036 series, 28000)
Business Continuity & Resilience Assessments
- NIST SP 800 53, NIST SP 800 161, NIST CSF, ISO/IEC (27001, 27036 series)
California privacy and regulatory compliance
- CCPA/CPRA obligations, breach notification duties, vendor contract terms and data inventories that stand up to scrutiny.
Program and incident readiness
We partner to develop the Information Security Program Incident Readiness (Incident Response Readiness) based on acceptable frameworks to detect, respond, contain, recover, and learn from security incidents.
- Incident Response Plans (IRP) and Program development
- Incident Response Plans (IRP) and tabletop exercises
- Customer security questionnaires
- Cyber insurance application support