Skip to main content

    Framework gap assessments and internal audits

    Need a gap assessment or internal audit?

    A customer asks for ISO 27001 or SOC 2, a certification audit is booked, or your standard requires an internal audit. We find the gaps, help you close them and audit the controls when you need that.

    Talk to usStart the free self-check
    a navy binder and a gray binder side by side on a stone table.

    Start from your situation

    Choose the review that fits your deadline and the decision you need to make.

    A customer or contract requires it

    A customer, contract or tender asks for ISO 27001, SOC 2, CMMC or similar and you need to show where you stand.

    Usual fitGap assessment against the named framework, then help closing the gaps.

    A certification audit is booked

    An ISO certification audit, SOC 2 examination, FedRAMP, GovRAMP or CMMC assessment is coming and you want no surprises.

    Usual fitGap assessment first, then an internal audit of the controls the external assessor will test.

    Your standard requires an internal audit

    ISO/IEC 27001 or 42001 clause 9.2, a board, a regulator or a customer contract calls for an independent internal audit.

    Usual fitInternal audit with a risk-based plan, selected samples and a findings report for your board or certification body.

    You do not know what is missing

    Security or AI governance has grown without a framework and you want an honest picture before choosing one or setting a budget.

    Usual fitGap assessment against NIST CSF 2.0, ISO/IEC 42001 or the NIST AI RMF, with a suggested order of work.

    Two kinds of review

    Gap assessment or internal audit

    A gap assessment identifies the requirements or controls you are missing. An internal audit examines and tests the evidence behind the controls you already have.

    Gap assessment versus internal audit

    Gap assessmentWhat is missing?

    Choose it when
    You are preparing for a certification audit, a customer review or a new requirement and want to know what is missing.
    What we review
    Policies, inventories, your description of current practice and the implementation records you already have.
    What you get
    A gap register: each missing requirement, what evidence it needs and a recommended order of work.

    Internal auditDo the controls work in practice?

    Choose it when
    You need an independent, evidence-based conclusion on whether selected controls work in practice.
    What we review
    The records that show each control operated during the period, plus tests and samples we select.
    What you get
    An internal audit report: procedures performed, findings and conclusions tied to evidence.

    Frameworks and requirements

    Pick the framework your customers, contracts or regulators name. Open a framework for what we review and the records we ask for.

    ISO/IEC 27001:2022

    Who it helpsOrganizations preparing for ISO 27001 certification, or that must show customers an information security management system.

    Try the ISO 27001 self-check
    What we review
    Requirements reviewed
    Information security management requirements in clauses 4–10 and the Annex A control themes relevant to your scope: organizational, people, physical and technological.
    Records
    Management-system scope, risk assessment, Statement of Applicability, policies, access records, review minutes and sampled control records.
    Result
    Findings against clauses and controls reviewed, with missing records and corrective actions identified.
    ISO information security standard

    ISO/IEC 42001:2023

    Who it helpsOrganizations that use or build AI and need a recognized management system for it, or face ISO 42001 certification.

    Try the ISO 42001 self-check
    What we review
    Requirements reviewed
    AI management-system requirements in clauses 4–10 and the Annex A AI controls relevant to your scope, including responsibility, risk assessment and lifecycle oversight.
    Records
    AI inventory, management-system scope, risk and impact assessments, governance decisions, supplier records and lifecycle review evidence.
    Result
    Findings on the AI management system; not certification or a substitute for other frameworks.
    ISO AI management-system standard

    NIST CSF 2.0

    Who it helpsTeams that want to identify cybersecurity gaps and prioritize security improvements.

    What we review
    Requirements reviewed
    Cybersecurity outcomes across Govern, Identify, Protect, Detect, Respond and Recover, using your current and target profiles.
    Records
    Risk register, governance records, asset inventory, access configuration, monitoring records, incident procedures and recovery-test records.
    Result
    A current-state assessment and prioritized outcome gaps; not a NIST certification or a universal compliance score.
    NIST Cybersecurity Framework

    NIST AI RMF 1.0 + Generative AI Profile

    Who it helpsAI owners who need a structured view of AI risk without pursuing certification.

    What we review
    Requirements reviewed
    AI risk-management practices using NIST AI RMF 1.0 and, for generative AI, the Generative AI Profile (NIST AI 600-1). Scope connects risks to the AI use cases being reviewed.
    Records
    Use-case inventory, risk decisions, evaluation results, human-oversight records, third-party reviews and incident handling.
    Result
    An assessment of AI risk practices for the use cases reviewed, with findings and recommendations supported by records.
    NIST AI risk-management resources

    SOC 2 Trust Services Criteria readiness

    Who it helpsService providers whose customers ask for a SOC 2 report.

    What we review
    Requirements reviewed
    Readiness against the Trust Services Criteria for the system boundary and categories your SOC engagement covers.
    Records
    System description, control ownership, policies, access reviews, change approvals, vendor reviews and relevant period records.
    Result
    A readiness report identifying gaps in control preparation and supporting evidence against the Trust Services Criteria.
    AICPA SOC resources

    CMMC

    Who it helpsUS defense suppliers whose contracts include CMMC requirements, whether they handle federal contract information (FCI) or controlled unclassified information (CUI).

    What we review
    Requirements reviewed
    Readiness for the contract-specified level and assessment type. Applicability follows the actual contract and current program requirements, including the FCI or CUI handled.
    Records
    Contract requirements, information-flow and boundary records, system security plan, access settings and control evidence; for Level 2, the relevant NIST SP 800-171 Rev. 2 requirements.
    Result
    A scoped readiness review and gap register; not a CMMC certification, authorized third-party assessment or government assessment.
    DoD CIO — About CMMC

    HIPAA Security Rule

    Who it helpsCovered entities and business associates handling electronic protected health information.

    What we review
    Requirements reviewed
    If you are a covered entity or business associate, safeguards for electronic protected health information relevant to your environment.
    Records
    Risk analysis, ePHI inventory and flows, policies, access records, business associate agreements and incident procedures, using appropriately restricted evidence.
    Result
    Findings on the safeguards reviewed; not a HIPAA certificate, legal advice or a blanket compliance determination.
    HHS Security Rule guidance

    HITRUST CSF

    Who it helpsHealthcare and other organizations whose customers require HITRUST.

    We do not perform HITRUST readiness or advisory work. For HITRUST, use a HITRUST External Assessor or Readiness Licensee.

    NIST SP 800-53 gap assessment

    Who it helpsCloud providers selling to US state or federal government.

    What we review
    Requirements reviewed
    A preparatory review of selected NIST SP 800-53 controls for cloud providers considering FedRAMP or GovRAMP. Program authorization follows its own process.
    Records
    System boundary, security plan, control descriptions, inventories, risk records and program-specific evidence requirements.
    Result
    A NIST SP 800-53 gap register to support preparation. Official FedRAMP readiness assessments are performed by a recognized 3PAO. We do not provide an official readiness assessment or authorization.
    FedRAMP program requirementsGovRAMP program requirements
    shelves of uniform cloth-bound reference volumes.

    What you receive

    From a gap assessment: a list of the requirements you do not yet meet, in priority order, with what each one needs. From an internal audit: a report of the findings for your certification body or board to review. If you want help closing the gaps, we can write the policies and set up the controls with you. Policy and control support →

    Limits

    We prepare you for certification and examinations; we do not issue ISO or CMMC certificates, SOC 2 reports or FedRAMP and GovRAMP authorizations. How we work →

    Need a gap assessment or internal audit?

    Tell us the standard, customer requirement or audit deadline you need to meet. We will explain the review options.

    Talk to usEmail us