About
Compliance should operate like a business function.
22 Compliance Group was built around a simple observation: growing companies often need serious compliance capability long before they need a full compliance department.
Tools can organize the work.
Consultants can advise on the work.
Auditors can evaluate the work.
The work may begin with SOC 2, HITRUST, a customer questionnaire, a risk program, or simply the realization that nobody owns compliance. The operating problem is the same: important work needs a clear home and accountable ownership.
But somebody still needs to own the work.
That's the role 22 is built to fill.
Principles
How we approach the work.
Practical over performative
Compliance should reflect how the business actually operates.
Continuous over episodic
A maintained program beats an annual fire drill.
Ownership over advice
Recommendations matter. Follow-through matters more.
Right-sized over enterprise theater
A growing company needs a program appropriate to its actual risk and obligations.
Human judgment plus useful technology
Automate what makes sense. Keep humans responsible for judgment.
What we will not claim.
This is a compliance company. If our own website overstated things, that would tell you something about how we would run your program.
So: we do not perform SOC 2 audits or issue reports. We do not certify anyone, and SOC 2 is not a certification. We do not guarantee audit outcomes. We do not claim partnerships or integrations we have not built. We do not provide legal advice.
Buying a service does not make a company compliant. Operating a program does.
Restraint in what we claim is the same discipline we bring to your program.
Give compliance a home.
If it's already becoming somebody's second job, we should talk.