Services

The Evidence Pack

Two weeks, fixed scope. The questionnaire or insurance application on your desk, answered honestly with a written record behind every answer. The usual way in.

PCI DSS 4.x readiness

Scope definition and cardholder data flow mapping, gap assessment against the current requirements, remediation plan, and support completing the right self-assessment questionnaire.

HIPAA Security Rule readiness

Safeguards mapped to what you actually run, policy and procedure set, workforce training, risk analysis, and breach procedure. Where a customer asks for HITRUST, we refer you to a HITRUST-authorized firm. Before founding SecHB, Steve Krouglof managed a HIPAA/HITRUST readiness program for a NYSE-listed communications company (About).

SOC 2 readiness

Control design against the trust services criteria you are actually claiming, the evidence architecture to sustain them, a gap assessment before you spend audit money, and liaison with your auditor during fieldwork.

ISO/IEC 27001 readiness

ISMS scoping, risk methodology, Statement of Applicability, the documentation set, and an internal review before the certification body arrives.

Pre-examination review

The examination before the examination. Somebody external is coming — an auditor, an assessor, a customer’s security team, a supervisor — and the question is whether you would pass today. This is that assessment, run against the same standard they will use and in the same order they will use it: scope first, then whether each control exists, then whether it operates, then whether you can evidence that it operates without three days of scrambling.

What comes back is a finding list in the shape their report will take, sorted by what would actually be raised, with the cheap fixes separated from the ones that need a decision and a budget. The point is that nothing in their report is the first time you heard about it.

Operational resilience, continuity and recovery

What happens when it stops. Business impact analysis that names the processes you cannot lose and for how long, recovery objectives that someone has actually agreed rather than inherited, dependency mapping through your suppliers, and a continuity and disaster recovery plan written to be executed by whoever is on shift — not to sit in a binder. Then the part most plans skip: testing that the restore works and that the backups are reachable when the thing that broke is the thing holding the backups.

Incident response readiness and tabletop exercises

Before an incident, not during one. An incident response plan with named roles and real decision points, the notification questions answered in advance — which regulator, which clock, which threshold — and a facilitated tabletop that puts your people through a scenario built from your own architecture rather than a generic template. The output is a written record of what worked, what stalled, and who needs authority they do not currently have.

Third-party and vendor risk

The other side of the questionnaire. Assessing the suppliers you depend on: what data they hold, what access they have, what their SOC 2 or ISO certificate actually covers against what you assumed it covered, and where a subprocessor moves your data somewhere your own commitments do not allow. Includes the tiering and reassessment cadence, so the program still works in a year without a consultant running it.

Technology risk assessment, controls and policy

Risk assessment and threat modelling against the systems as built, a control set designed to the risks rather than copied from a framework, and the policy and standards written to match what the controls actually do. Where a control exists on paper and not in the estate, that is what the assessment says. Also the reverse, which is more common: a control that is genuinely enforced and that nobody has written down, so it earns no credit in an audit or a questionnaire.

AI and LLM governance

You put a model in the product, or your staff started pasting client material into one, and now a customer’s security questionnaire has a section about it that stalls the return. The work: what the system actually sends to which provider and under what terms, where the prompts and outputs are retained, whether personal information is leaving a jurisdiction it should not, human oversight where a decision affects someone, and the controls that answer the OWASP Top 10 for LLM Applications (2025) — prompt injection, improper output handling, excessive agency, sensitive information disclosure. Mapped against the EU AI Act where it reaches you, ISO/IEC 42001 and the NIST AI Risk Management Framework where a customer asks for a named standard. The scope is the system around the model — what it sends, what it retains, who reviews the output — which is the part a questionnaire actually asks about.

Limit: this is governance and security assessment of systems that use models. It is not model evaluation, red-teaming for alignment, or a statement about how well a model performs — those are a different discipline.

Privacy program

PIPEDA and BC PIPA, plus GDPR or Quebec Law 25 where they reach you. Data inventory and flows, retention and disposal, consent and notice, breach assessment procedure and register, vendor and cross-border transfer questions, and privacy impact assessments.