One-week engagements. Written deliverable. The compliance and security audits regulated-industry buyers actually need — HIPAA, FINRA, SOC 2, cybersecurity posture, multi-location — scoped tightly so you know exactly what you’re buying before you commit.
Each is a one-week engagement with a written deliverable at the end. No retainer commitment. Most clients use the audit as the first step of a longer relationship; some use it as a one-time engagement for a specific need.
The annual SRA your practice is required to have on file. Documented in the format OCR auditors expect to see. Covers administrative, physical, and technical safeguards. Practice management system, EHR, imaging, email, mobile devices, and backup all in scope.
The audit you should run before the examiner does. Email archive immutability verified, custodian integrations validated, privileged access reviewed, cybersecurity controls aligned to SEC Reg S-P and (if applicable) NYDFS 23 NYCRR 500. Findings remediated before the exam, not during it.
External attack-surface review, internal network segmentation review, endpoint protection coverage, MFA enforcement check, identity off-boarding, backup-restore test, incident response readiness. Written report with priorities and rough remediation cost.
For organizations with 2+ offices that are operating as 2+ separate IT environments. We map every site, every system, every user, every vendor, and produce a unification plan with phased timeline and estimated cost. The first step of a multi-location IT engagement.
Gap analysis against SOC 2 Type II control requirements. Where your existing posture meets the bar, where it doesn’t, what would need to change before engaging an external auditor. Saves you the cost of a failed first audit.
Every audit produces a written deliverable handed to you by the end of the engagement. The format varies by audit type but always includes:
If you choose to engage us for remediation after the audit, the audit fee can be credited against the first invoice of the engagement. If you don’t, the report is yours to keep — usable by your existing IT vendor or any other firm.
20-minute scoping call. We’ll tell you which audit fits your situation and what the deliverable will look like.
Email to book a scoping call