Compliance and Framework Support

Part of Security Risk, Compliance and Advisory

Compliance is easier when you know exactly what applies to you. We help you map your controls to the framework, find gaps and organize the evidence.

Frameworks we support

Our team has expertise with HIPAA, FISMA and ISO frameworks and can help you understand what each expects of your organization. For payment card requirements, see PCI DSS Readiness.

How we help

Control mapping. Connect the controls you already have to the requirements, so work is not repeated for each framework.
Gap review. Identify where controls or evidence are missing.
Evidence preparation. Help you collect and organize documentation, logs and configuration records.
Policy and procedure review. Check that written policies match what is actually done.
Remediation roadmap. A practical order of work, with technical help where you need it, such as logging through CMDR.

How it works

Define scope. Which systems, data and business units fall under the framework.
Review. Assess controls and evidence against the requirements.
Report. Give you a gap list and roadmap.
Support. Help you close gaps and prepare for your assessor or customer review.

What we do and do not do

Core-Infosec provides readiness and technical support. We do not issue audit opinions or attestations, and we do not replace your assessor, auditor or counsel. We help you arrive prepared.

Experience

Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.

Get in touch

Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day. Ask us about incident response retainers as well.