Services / Run
We keep the controls running between audits.
A SOC 2 Type 2 audit tests whether your controls operated over a period of months, and CMMC requires an annual affirmation that they still do. On a monthly retainer, we handle the recurring work: access reviews, device checks, and evidence collection. During fieldwork, we answer the auditor’s requests. From $2,500 a month.
Retainer scopemonthly
IdentityAccess-change and quarterly reviews
DevicesEnrollment and compliance checks
CloudConfiguration drift and findings
AuditsRequests and walkthroughs
evidence filed against the auditor’s request list
Scope
What we run.
Access reviews
Quarterly · on change
Device management
Enrollment · compliance
Cloud drift
Config · findings
Vendor reviews
Annual · on onboarding
Incident readiness
Tabletops · runbooks
Audit support
Auditor requests · walkthroughs
Schedule
The recurring schedule.
Weekly
Configuration drift checks, alert and finding review, and device compliance status.
Monthly
Review of user access changes, evidence filed against the auditor’s request list, and a plain-language status note.
Quarterly
Access review signed off by your leadership, risk register update, vendor review, and backup restore test.
Audit season
We answer auditor requests, join walkthroughs, and remediate findings.
What you get
What you receive.
Current evidence
Collected on schedule across every system in scope, so evidence is ready when fieldwork starts.
Monthly status
What changed, what is overdue, and what needs a decision from you, in plain language.
Audit support
We answer auditor requests and join walkthroughs for each audit and renewal.