Audit Preparation

Audit-grade preparation for any standard, whether or not an auditor is coming

Already have an IT provider? Here's how we work together.

An example

Consider an insurance agency that must certify its NYDFS Part 500 compliance by April 15. The officers believe the agency complies. Then someone asks a simple question: “If the examiner asked to see last quarter’s access reviews, what would we hand over?”

Nobody is sure. The control may be in place, but the proof is not, and an examiner judges the proof.

The Problem

The same thing happens before a HIPAA review of a medical practice, a PCI DSS (payment card) assessment of a retailer, or a cyber insurance renewal.

The gap is rarely effort. It is not knowing which proof the auditor will ask for, where that proof is, and who owns it.

Saying “yes, we do that” is not the same as showing it.

One method for any standard

The method is the same whether or not an auditor is coming: the same audit-grade rigor, the same five levels, and the same re-test every round. The levels are measured against your organization’s own goals, not a one-size checklist.

Preparing for a formal audit or examination

An auditor or examiner will judge your proof on a set date. We rehearse it first.

Examples: HIPAA, NYDFS Part 500, PCI DSS, CMMC.

Raising maturity where there is no audit

Some frameworks have no formal audit. For those, the “audit” is our own evidence-based review against the framework, scoped to what matters for your organization.

Examples: governance frameworks such as COBIT 2019, enterprise-architecture practice such as TOGAF, the NIST Cybersecurity Framework, and privacy and AI-risk frameworks.

Security Medic is independent. We assess against these frameworks as a reference. We do not certify, and we are not affiliated with the bodies that publish them.

Climb from the foundation to the hardest standards

Consider a software company that sells to hospitals. Today its customers ask about HIPAA safeguards. Next year a large customer asks for a SOC 2 Type II report. Later, a government contract asks for GovRAMP (formerly StateRAMP) or FedRAMP authorization.

These standards share most of their controls. So we plan your path as a climb: the foundation first, then the standard you need now, then each harder one. Every step reuses the controls and proof from the step before, so nothing is done twice, and each new standard starts higher on the five levels.

  1. 1

    Foundation

    The essentials almost every standard shares: knowing your systems, controlling access, multi-factor sign-in, tested backups, logging and an incident plan. Measured against the NIST Cybersecurity Framework or the CIS Controls first tier.

  2. 2

    Your sector’s rules

    The standard you are held to first, such as the HIPAA Security Rule, NYDFS Part 500 or PCI DSS.

  3. 3

    Attestation-ready

    SOC 2: first Type I (are the controls designed well?), then Type II (did they work over months?). Software and service companies selling to healthcare and finance are often asked for one.

  4. 4

    Certification-ready

    ISO/IEC 27001, an information security management system run as a cycle of review and improvement.

  5. 5

    Government-grade

    NIST SP 800-171 and CMMC Level 2, then GovRAMP (formerly StateRAMP) or FedRAMP at Moderate, and at the top, High.

The order is set for your organization: what your customers, regulators and contracts ask for first, and what you can achieve first.

On-premises, in the cloud, or both

Most organizations run some systems in their own offices or data center and others in one or more clouds: Amazon Web Services, Microsoft Azure, Google Cloud, IBM Cloud, Oracle Cloud, or the newer AI-focused GPU clouds (often called “neoclouds”).

Every cloud provider protects its own layer and publishes its own audit reports. Your part is everything you build and configure on top. For each standard, we map which controls the provider already covers, which are shared, and which are yours, and then collect your proof for your part, on-premises and in every cloud you use.

SOC 2 reports are issued by independent CPA firms, ISO/IEC 27001 certificates by accredited certification bodies, and FedRAMP and GovRAMP assessments by accredited third-party assessors. We prepare you for them; we do not issue them.

How audit preparation works

Audit preparation holds your organization to the same rigor as the real audit. It works like training for it.

We run it in rounds. Every round rates each requirement area on a five-level scale, finds the missing proof, and re-tests the last round’s work. The scale is rolling and works like the CMMI (Capability Maturity Model Integration) levels, so maturity climbs from round to round.

The five levels

  1. 1Ad hoc

    Little is known or in place. Answers are guesses.

  2. 2Partly in place

    Some controls exist, mostly on the organization’s word.

  3. 3Documented

    Policies and procedures are written and the controls are in place.

  4. 4Evidenced

    Current proof is on file for the controls.

  5. 5Audit-ready

    The controls were walked through or tested in a mock audit, and the proof is current.

Proof expires. A backup test from two years ago does not show that backups work today, so expired proof stops counting until it is renewed.

What each round delivers

A level for every requirement area

From 1 (Ad hoc) to 5 (Audit-ready), with the reason for each rating. A “yes” without proof does not count as more than Level 2.

An evidence register

For every requirement: the proof that exists, the proof that is missing, and the person who owns producing it.

A mock-audit walk-through

We ask the questions an auditor or examiner would ask. The people who will face the real audit answer and show the proof.

A plan to reach the next level

Every action has an owner and a date.

A re-test

The next round starts by checking the work, so progress is measured, not assumed.

Which standards

Any standard or framework your organization must meet or wants to use, including:

  • The HIPAA Security Rule (HIPAA Security Assessment)
  • NYDFS Part 500 (NYDFS Compliance)
  • PCI DSS v4.0 (PCI DSS Fast-Track)
  • Cyber insurance underwriting questions (Insurance Readiness)
  • SOC 2 Type I and Type II readiness, and ISO/IEC 27001 readiness
  • NIST SP 800-171, CMMC Level 2, GovRAMP (formerly StateRAMP) and FedRAMP readiness, at Moderate and High
  • COBIT 2019 and TOGAF, assessed as reference frameworks, with no formal audit
  • The NIST Cybersecurity Framework 2.0, the New York drinking-water and wastewater cybersecurity rules, CMMC Level 1 and NY Education Law § 2-d

Where no formal audit exists, the same levels measure progress toward the framework’s intent and your own targets.

Where it fits

  1. Free 30-minute call (optional) to talk through the obligation and its date.
  2. Free assessment online, followed by a gap report and a free results review.
  3. Standard-scoped assessment: every requirement area of the named standard rated, with the evidence picture and a prioritized plan.
  4. Audit preparation rounds, one-off or over a 3-, 6- or 12-month commitment, timed to finish before the audit, certification or renewal date.

What we do and do not do

We do

We rate conformance, review evidence, rehearse the audit, write the plan, and specify the controls your IT team or provider must put in place. Then we check the result.

We do not

We do not certify, attest or sign on your behalf, and we do not guarantee an audit outcome. Your own officers sign your certifications.

Each engagement is scoped in a written proposal.

Start with a free 30-minute call

Bring the standard and the date. We will talk through where your organization likely stands and what the first round would cover.

Book a free 30-minute call