We build and run the security program your audit requires.
Identity, devices, cloud, logging, policies, and evidence, configured in your own accounts and tested on every system in scope. For SOC 2, CMMC, and the frameworks your customers ask for next, without hiring a security engineer, an IT administrator, and a compliance manager to get there.
CISSP · CISA · Independent of audit firms · Published prices
Evidence from every system in scope.
Auditors test a sample. We check every system, so the report your customer reads describes how your company actually runs.
- 01An auditor’s sample · 5 of 41 · all pass
- 02Every system · checked 41 of 41
- 033 not enrolled in device management · finding
- 0441 / 41 · fixed before fieldwork
Each control is tested on every account, laptop, and cloud resource it applies to.
If a control works on nine servers and not the tenth, the tenth is a finding, and we fix it before the auditor arrives.
What changed, when, and who approved it.
We work in systems you own, and you keep an owner-level account we don’t control.
The engineering behind the audit.
SOC 2 and NIST 800-171 organize their requirements differently, but most of the technical controls in both land in the same six areas. Every Build engagement also covers the parts that aren’t technical: policies, risk assessment, security awareness training, vendor reviews, and the evidence the audit requires.
How people and systems get access, what they can do with it, and how it’s removed. That covers employee and contractor accounts, privileged and service accounts, single sign-on across your SaaS tools, and access to production.
In practice
Every device that touches company data: laptops, desktops, and mobile devices, whether company-owned or personal under a BYOD policy. Enrollment, encryption, patching, and malware protection across macOS, Windows, and Linux.
In practice
Your production environment in AWS, Azure, or Google Cloud, and the networks around it. Account structure, encryption and key management, network boundaries, configuration baselines, and backup and recovery, defined in code where your team works that way.
In practice
Finding and fixing weaknesses before someone else does. Scanning across hosts, containers, applications, and dependencies, remediation ranked by risk, patch tracking, and coordinating penetration tests and their findings.
In practice
Knowing what happened and acting on it. Which logs to keep and for how long, alerting that reaches a person, and an incident response process your team has practiced, including the reporting your contracts require.
In practice
How code and configuration reach production. Code review, protected branches, security checks in the pipeline, separation of duties, and a record that ties each change to its approval, for application code and infrastructure alike.
In practice
Requirement IDs from the AICPA Trust Services Criteria (2017, revised 2022) and NIST SP 800-171 Rev 2.
The team you’d otherwise hire.
Getting through an audit takes security engineering, IT administration, and compliance management. Most companies your size have none of those roles yet.
Configures cloud, identity, and logging controls, and fixes what the audit finds.
Enrolls and manages devices, accounts, and access.
Writes policy, runs risk and vendor reviews, and manages the audit.
About $372,000 in salary before benefits, which make up about 30% of total compensation (BLS, June 2026). Security roles often take 3–6 months to fill (ISACA, 2025).
Whatever your customers ask for, the work is the same.
Every framework comes down to the same work: read the requirement, build it into your systems, document it, and prove it. What changes is scope, the assessor, and a handful of technical rules. Those differences are what we plan around.
Works with Vanta, Drata, Secureframe, or no platform at all. The platform tracks the controls. We build and run them.
Assessment, Build, and Run.
We review your policies, interview the people who run your systems, and test each control against system data.
- Gap report, ranked by audit impact
- Inventory of systems, data, and vendors in scope
- Fixed-price plan and a target audit date
We configure the missing controls in your accounts, write policies that match how your systems run, and collect the evidence your auditor will request.
- Controls configured and documented
- Policy set your team can follow
- Evidence organized to the auditor’s request list
We handle the recurring work your auditor or assessor checks: SOC 2 Type 2 evidence, preparation for your CMMC annual affirmation, and keeping your SPRS score current.
- Access reviews and device checks
- Evidence collected each month
- Auditor requests and walkthroughs
Someone who speaks both languages.
Compliance requirements are written for auditors. Your systems are run by engineers. Much of the friction in an audit happens in the translation between the two, and in the handoff between the consultant who interprets a requirement and the engineer who has to build it.
Each engagement is led by Austin Van Camp (CISA, CISSP), who has more than ten years of experience building and running the systems these requirements describe. He interprets the requirements, configures the controls, and walks your auditor through them. Because one person carries the work from start to finish, we take on a limited number of engagements at a time.
Growing companies whose customers or contracts require an audit.
An enterprise customer wants a SOC 2 report before they sign, and there is no security hire yet. CSA STAR builds on the same audit.
SOC 2 →A DFARS 7012 clause is in your contract, or CMMC is in the next solicitation. We build to FAR 52.204-21 or NIST 800-171 in the cloud or Microsoft 365 tenant you already use, with on-site work available along Colorado’s Front Range.
CMMC →When a health system asks for HITRUST or a federal agency asks for FedRAMP, we map the controls you already run to the new requirements and scope the gaps.
HITRUST →Before you book a call.
Do we need a compliance platform like Vanta or Drata?
No. If you have one, we work inside it and do the engineering it flags. If you don’t, we organize the evidence for your auditor directly.
Who pays the auditor?
You do, directly. The audit or assessment firm’s fee is separate from ours. We can help you choose a firm, and we take no referral fees from any of them. We prepare you for the audit; we never perform it.
Should we get a SOC 2 Type 1 or Type 2 report?
A Type 1 checks that controls are designed and in place on a single date. A Type 2 tests that they operated over a period, usually three to twelve months. Many companies get a Type 1 to unblock a deal, then start the Type 2 period right away.
How long does a first SOC 2 take?
A first Type 1 typically takes three to six months from the start of work. A Type 2 adds the observation period. After the Assessment, we give you a specific date.
Book a 30-minute scoping call.
Tell us why you need an audit and what you run. We’ll tell you what it will cover, how long it should take, and roughly what it will cost.