Compliance as a Service, with someone actually responsible for the work.

What the term usually covers

The phrase is used broadly. Depending on who is saying it, Compliance as a Service can mean a software subscription with a support channel, a periodic advisory arrangement, a managed service, or some combination. Most offerings include some mix of:

• Access to a compliance platform or structured workspace
• Policy templates and customization
• Framework readiness support such as SOC 2
• Risk and vendor documentation
• Scheduled advisory time
• Support during customer security reviews

Where the models diverge

The useful question is not what is included in the package. It is what happens on a Tuesday when a remediation item has been open for five weeks and the engineering lead has not replied.

In a software-led model, the platform flags it and the internal team is responsible for chasing it. In an advisory model, it might come up on the next call. In a managed model, someone outside your company is accountable for driving it to closure and escalating when it stalls.

All three are legitimate. They are just not the same purchase, and they should not cost the same thing.

How 22 approaches it

22's model goes beyond access to software or periodic advisory calls. We operate as an outsourced compliance office with defined recurring responsibilities.

That work is delivered through 22 Compliance: program management, policy lifecycle, risk register, customer security reviews, vendor risk, recurring reviews, executive reporting, and framework readiness. Tooling supports it. People own it.

If you want the longer explanation of the operating model itself, the outsourced compliance office guide covers how it compares to consultants, software, and hiring.

Who it fits

Companies where compliance has become recurring and consequential, but where a dedicated internal department would be premature. Usually that means a lean team, increasingly sophisticated customers, and at least one deal where the compliance answer matters.

It fits less well when the workload is genuinely full-time, when a regulation requires a named internal officer, or when what you actually need is legal counsel or an audit.