22 Compliance

The team you send compliance to.

22 Compliance is an outsourced compliance office for companies that need ongoing compliance ownership without building an internal department.

We don't produce a stack of documents and hand you a folder. 22 Compliance establishes the program, then operates it. The difference shows up six months later, when the policies are still current and the customer request that arrives on a Friday doesn't turn into a fire drill.

Talk to 22 See engagement options

What we own

Eight areas of recurring work.

Program Management

Priorities, roadmap, owners, deadlines, recurring requirements, and follow-through.

Policies

Create, customize, maintain, review, and organize the policies your program actually uses.

Risk

Maintain a practical risk register, document treatment decisions, and keep risk work connected to the broader program.

Customer Security

Prepare and manage security questionnaires, due diligence requests, and recurring customer trust questions.

Vendor Risk

Create a repeatable process for evaluating material vendors and documenting third-party risk decisions.

Compliance Operations

Run recurring reviews, maintain documentation, coordinate work, and prevent the program from drifting between audits.

Executive Reporting

Turn operational detail into a concise view of status, priorities, risks, blockers, and upcoming work.

Formal Assurance Programs

Support the operational work surrounding programs such as SOC 2 and HITRUST, including policies, controls, remediation, evidence preparation, internal coordination, and ongoing program operation.

22 Compliance provides recurring operational ownership based on an agreed scope.

When a company requires significant initial implementation, framework buildout, or remediation, 22 may scope that work separately before or alongside the ongoing 22 Compliance relationship. Operating a program and building one from a limited starting point are different jobs, and pricing them separately keeps both honest. See engagement options.

For HITRUST initiatives, official assessment activities remain with appropriately authorized HITRUST organizations. See HITRUST program support.

What changes for your team.

Before

Work lives across spreadsheets and inboxes
Ownership changes depending on the request
Policies get written once and forgotten
Customer questionnaires start from scratch
Audit requests become emergencies
Engineers become evidence collectors
Leadership cannot easily see program status

After

One accountable compliance function
Defined operating cadence
Maintained policies and risks
Reusable company knowledge
Clear requests and owners
Better audit readiness
Concise leadership reporting

Your platform or ours

We don't need to replace what already works.

Groundset is a compliance platform available to 22 clients who need a structured place for the program to live. Assessments, controls, policies, compliance documentation, readiness work, and trust materials all get a home instead of a shared drive.

Already using a compliance platform? Keep it.

22 works inside the compliance environment your company has already adopted. We are not going to bill you for a migration you did not ask for, and we do not claim technical integrations we have not built.

Use Groundset. Keep the system you already have. Either way, 22 owns the work.

What 22 Compliance is not.

Compliance work depends on people whose roles cannot be outsourced. Being clear about that is part of running the program well.

Your auditor or assessor

SOC 2 examinations are performed by an independent licensed CPA firm. HITRUST assessment activities are performed by appropriately authorized HITRUST organizations. 22 prepares you for those parties and coordinates with them, and does not perform or issue the examination itself.

Legal counsel

Contract terms, regulatory determinations, and legal risk decisions belong with qualified attorneys. We organize the compliance work around those decisions.

Your system owners

Some evidence and technical detail can only come from the people who run your infrastructure. We make those requests specific, batched, and infrequent instead of constant.

Security engineering and testing

Penetration testing and hands-on security engineering are specialist services. When your program needs them, we help scope the work and fold the results back into the program.

Common questions

What is included in 22 Compliance?

22 Compliance covers compliance program management, policy lifecycle work, a maintained risk register, customer security questionnaire support, vendor risk coordination, recurring reviews and a compliance calendar, executive reporting, and framework readiness such as SOC 2 when your business needs it. The exact mix is scoped to your company.

How is this different from hiring a compliance consultant?

A consultant is usually engaged for a defined project and leaves recommendations behind. 22 Compliance is an ongoing operating relationship. We carry recurring responsibilities, run the cadence, and stay accountable for keeping the program moving between audits.

Do we still need a full-time compliance employee?

Many growing companies do not, at least not yet. 22 Compliance is built for the stage where compliance is a recurring business requirement but the volume does not justify a full department. When your program outgrows the model, we help you plan the transition rather than pretend it should not happen.

Who owns our controls?

Your company does. Controls describe how your business actually operates, so ownership stays with the people who run those systems. 22 owns the program around them: definition, documentation, tracking, follow-up, and reporting.

Do we have to use Groundset?

No. Groundset is available when you need a structured home for the program. If you already run Vanta, Drata, Secureframe, another platform, or your own process, we work in the environment you have adopted.

Does 22 Compliance cover formal assurance programs?

22 Compliance Plus is designed for companies with formal assurance requirements or a more complex compliance operating environment. That can include SOC 2, HITRUST, multiple frameworks, a higher customer diligence volume, larger remediation programs, or greater coordination needs. Those are examples rather than the whole definition.

Does the starting price cover building our program from scratch?

No. 22 Compliance prices the ongoing operating function. If a substantial initial program buildout, formal framework preparation, or major remediation is required, that work is scoped separately. We will tell you which situation you are in before you sign anything.

Is 22 a vCISO?

Not exactly. A vCISO typically provides part-time security leadership and advisory. 22 Compliance is an operating function focused on compliance execution and ownership. The roles can complement each other, and some companies need both.

Give the work an owner.

Tell us what is landing on your team right now. We will tell you honestly whether 22 Compliance is the right shape for it.

Talk to 22 Explore SOC 2 readiness