Audits and renewals, without the fire drill.

We map your controls to the specific Trust Services Criteria and framework requirements that actually apply to you, and keep the supporting evidence collected on an ongoing cadence, so when your auditor, your carrier, or your board asks, the answer is already documented, not assembled overnight.

Evidence ledger · live -
08:41Access review completed: Finance systems✓ logged
09:15Control tested: change management✓ logged
11:02Evidence captured: incident log✓ logged
13:37Vendor risk review updated✓ logged
15:20Backup restore test verified✓ logged
AUDIT READY
Evidence is captured on a set cadence as it happens, access reviews, control tests, incident records, not reconstructed the week before an audit.
What's included

Compliance as an ongoing state, not an annual scramble.

01

Controls mapped to your frameworks

We build a control mapping: each requirement in a framework matched to the specific technical or procedural control that satisfies it, with no generic checklist that doesn't fit. A credit union answering to OSFI has a different control set to demonstrate than a US professional services firm answering to state breach-notification law, and the mapping starts from which of those actually govern you, not a one-size list.

02

Evidence kept audit ready year round

Evidence collection runs on a set cadence rather than a once-a-year scramble, so you're not reconstructing a year of proof in the two weeks before an audit. That means access reviews, change logs, incident records, and control testing are captured on a defined schedule as they happen, so the artifact a SOC 2 auditor samples against already exists instead of getting rebuilt from memory.

03

Support during the actual audit

When the questionnaire or auditor request lands, you have support answering it, not just a folder of documents to interpret alone. That includes helping frame answers to a client's security questionnaire or an insurance underwriter's diligence request, so what goes back to them is accurate and consistent with what's actually documented.

How it works

Compliance is a program, not a document you file once a year.

Engagements typically start with a gap assessment: reviewing your current controls against the frameworks that actually apply and producing a control-to-requirement mapping for each: for a Canadian credit union that usually means PIPEDA and OSFI guidance; for a US healthcare-adjacent or financial client it more often means HIPAA, PCI DSS, and the relevant state breach-notification statute; and SOC 2 Type II shows up for organizations whose own clients require proof of it in a vendor questionnaire. From there we build a remediation roadmap for whatever gaps exist, and set up the ongoing evidence collection, on a defined sampling cadence rather than a single point-in-time snapshot, so the next audit isn't a scramble.

A common misconception is that "compliant" means "secure," or the reverse. They overlap but aren't the same thing. A framework tells you what has to be documented and demonstrated; good security practice is what actually keeps you out of the incident in the first place. We treat the framework as the floor, not the ceiling, and build toward both at once rather than treating compliance as a paperwork exercise layered on top of security work already done elsewhere.

What an examiner or auditor actually asks for is broader than most teams expect going in. It's rarely a single "yes/no" checklist; it's evidence collected over time. Access control reviews need to show not just that a policy exists but that access is actually revoked promptly when someone leaves or changes roles. Change management needs a trail showing production changes were reviewed before they shipped, not reconstructed from memory afterward. Incident handling needs records showing detection-to-resolution timelines, not just a written incident response plan sitting unused in a drawer. And vendor management needs your own third-party risk reviews documented, since your compliance posture increasingly depends on the vendors you've brought into your environment. We build the ongoing collection of exactly this evidence into how we work with you day to day, so none of it has to be assembled retroactively once an audit date is set.

Common questions we get before signing on
  • "Which frameworks actually apply to us?" It depends on your industry, where your customers are, and what your own clients require in their vendor questionnaires. This is usually the first thing we sort out together.
  • "Does Cyberwall hold ISO 27001 or other certifications?" Cyberwall holds SOC 2 Type II. Other frameworks named here are ones we help clients meet, not certifications Cyberwall itself holds, and we're precise about that distinction on every questionnaire we help answer.
  • "How long until we're audit ready?" It varies with how much control documentation already exists; a gap assessment in the first few weeks gives you a realistic timeline rather than a guess.
Frameworks we help you meet

The alphabet soup your auditor cares about, mapped to controls, not slideware.

SOC 2 Type II · held PIPEDA OSFI HIPAA PCI DSS State breach laws NIST ISO 27001

SOC 2 Type II is a certification Cyberwall holds. The remaining frameworks are standards we help clients meet, across Canada and the US, mapped to your region and industry. Which of these actually govern you usually comes down to three questions: what industry you're in, where your customers live, and what your own clients ask for in their vendor security questionnaires. Credit unions answer to OSFI in a way a professional services firm doesn't, and a firm handling payment card data has PCI DSS obligations a firm that doesn't will never face.

From the blog

Cyberwall Successfully Passes SOC 2 Type II Audit →

What Credit Unions Should Ask a Managed Security Provider →

Works with

Pairs naturally with these.

Not sure which frameworks actually apply to you?

Book a preparedness call to see exactly where your gaps are.