How it works

Put compliance on an operating cadence.

Four phases. The first three are familiar. The fourth is the one most programs never reach.

01 / UNDERSTAND

See what exists.

Before anything gets built, we need an accurate picture. Most companies have more in place than they think, and it is scattered.

Business goals and growth plans
Customer and contractual requirements
Framework requirements in scope
Systems and infrastructure
Current policies and documentation
Existing compliance platforms
Gaps against the requirements
Stakeholders and decision-makers

02 / BUILD

Create the foundation.

The foundation is built around how your business actually operates. Policies that describe a company you are not will fail the first time someone reads them closely.

Compliance roadmap and priorities
Responsibilities and named owners
Policies written to real practice
Controls implemented and documented
A practical risk register
Recurring processes and cadence
Documentation structure
Evidence expectations

03 / OPERATE

Run the program.

This is the phase that separates a program from a project. The work is recurring, unglamorous, and the reason the next audit is uneventful.

Recurring reviews on schedule
Remediation tracked to closure
Customer security requests handled
Evidence captured as work happens
Vendor reviews run on cadence
Framework requirements maintained
Executive reporting
Escalation when items stall

04 / IMPROVE

Mature as you grow.

Requirements change as the company changes. A program that fit at twenty people will not fit at eighty, and it should not have to be rebuilt to keep up.

Close remaining gaps
Absorb new customer requirements
Prepare for upcoming audits
Expand scope as the business expands
Reassess risk as the product changes
Plan for an eventual internal hire

Onboarding

The start is discovery, not a template.

How long onboarding takes depends on what already exists. A company with documented infrastructure and some policies moves faster than one starting from nothing, and we will tell you which one you are.

Onboarding is quoted separately from the recurring engagement because it varies so much between companies. What it always covers: agreeing scope, establishing the roadmap and cadence, and doing enough foundation work that the recurring program has something to run.

See engagement options

Common questions

How does onboarding work?

Onboarding starts with discovery: how the company operates, what is driving the compliance requirement, what already exists, and who the stakeholders are. From there we agree the scope, set the roadmap and cadence, and begin the foundation work. Its length depends on your environment, and we will not pretend a program goes live in a day.

How much time does our team spend?

Expect a recurring working session and periodic focused requests for information only your team has. We batch those requests deliberately so people are interrupted on a schedule rather than continuously.

What do we get on a regular basis?

A maintained program, a current view of status and open items, and concise reporting for leadership. The specific cadence is set during onboarding based on your obligations and pace.

What happens when a new requirement appears?

It enters the program the same way everything else does: assessed, scoped, prioritized against what is already open, and given an owner and a date. New requirements should be absorbed, not treated as emergencies.

Start with what exists.

The first conversation is about your situation, not our process. Tell us what is landing on your team.

Talk to 22 Explore 22 Compliance