--- title: "Governance, risk and compliance" description: "Readiness for ISO 27001, SOC 2, NIS2, DORA, PCI DSS, HIPAA, Cyber Essentials and CMMC, with policies, risk management and evidence run as an operating program." url: https://www.expandware.com/services/managed-security/governance-risk-and-compliance/ section: "Services" topics: ["Managed Security", "ISO/IEC 27001:2022", "SOC 2", "NIST CSF 2.0", "NIS2"] publisher: "Expandware Private Limited" --- # Governance, risk and compliance Readiness for ISO 27001, SOC 2, NIS2, DORA, PCI DSS, HIPAA, Cyber Essentials and CMMC, with policies, risk management and evidence run as an operating program. Security engineered in, compliance built to pass. Security bolted on before an audit fails the audit. We design controls that work in operation and build the compliance program around them, aligned to the frameworks your customers and regulators actually ask about, so evidence is a by-product of how the work runs rather than a scramble before the auditor arrives. Where it usually starts: - A customer security questionnaire arrived, and you cannot answer half of it confidently. - A certification or attestation is due, and the evidence does not exist yet. - A new regulation such as NIS2 or DORA applies, and nobody owns it. - Risks are tracked in someone's head rather than in a register. What is included: - Gap assessment: Your current controls measured against the framework you are asked about. - Policies and procedures: A policy set written for how you actually work, approved and published. - Risk management: A risk register with owners, treatment plans and reviews. - Control implementation: Technical and organizational controls built, not just documented. - Evidence collection: Evidence gathered continuously from the systems that produce it. - Audit support: Preparation for, and support during, the certification or attestation audit. Where it sits: Governance sits at the top of the security architecture: controls and evidence drawn from the systems below, and risk reporting that turns them into decisions for leadership and answers for auditors. Decisions to settle early: - Which framework first. The one your customers or regulators ask about. Others are mapped onto the same controls later. - Build in-house or outsource. Some organizations want to own the program; others want it run for them. Either way, controls must work in operation. - Which tools hold the evidence. Compliance platforms automate evidence collection; a well-organized library can be enough for smaller programs. We recommend by scale. How the work runs: Assess, Current controls against the framework. Build, Policies and controls that work in operation. Evidence, Collected as the work runs. Audit, Supported through to the auditor's report. How it is bought: - A fixed-fee assessment: We measure your current practice against the framework you are asked about and review existing policies and evidence. You receive the gap assessment and a fixed price for the program. - A fixed-price build: Policies, the risk register, control implementation, evidence collection and audit preparation for the framework in scope, at a fixed price. - Running it afterwards: Between audits, the program can continue monthly or quarterly with risk reviews, internal audits and evidence checks. Worked example, a certification a customer now requires. Say a software company's largest prospect requires an information security certification before it will sign. The company has sound engineering habits, but no policies, no risk register and no evidence an auditor would accept. - Assess: We measure current practice against the standard and find that many controls already operate, but nothing records that they do. - Build: Policies are written for how the company actually works, a risk register is set up with owners, and the missing controls are implemented. - Evidence: Evidence is collected from the systems that produce it, such as access reviews, change records and backup reports, so it builds up as the work happens. - Audit: The company goes through the certification audit with our support, and the auditor's questions are answered from the evidence library. At the end, the company goes into its audit with a working management system and evidence for each control, and the next audit becomes a review of evidence it is already collecting. (An illustration, not a client account.) What you have at the end: - Gap assessment against the chosen framework: Each requirement of the framework, how far your current practice meets it, and the work to close the gap. - Policy set and procedures: Policies written for how your organization works, approved by its leadership and published to staff. - Risk register and treatment plan: Your information risks with owners, ratings and the treatment chosen for each, reviewed on a schedule. - Statement of applicability or control matrix: Which controls apply, why, and how each is implemented, in the form your auditor expects. - Evidence library ready for audit: The records that show each control operating, collected from the systems that produce them. Standards and platforms worked with: ISO/IEC 27001:2022, SOC 2, NIST CSF 2.0, NIS2, DORA, PCI DSS v4.0.1, HIPAA, Cyber Essentials, CMMC 2.0, GDPR. Where it goes wrong, and what we design out: - Policies written for the auditor. Documents nobody follows fail the first sample test. Policies describe how you actually work. - Evidence gathered the week before. A scramble before the audit produces gaps and stress. Evidence comes from systems as the work happens. - One program per framework. Running separate programs for each standard multiplies the work. Overlapping controls are mapped once and reused. What it changes: - Questionnaires answered. Customer security questionnaires are answered from documented controls, quickly and consistently. - Audits without a scramble. Evidence collected as the work runs means the audit tests what exists. - Risk decisions on record. Accepted risks are documented with an owner and a review date, which is what regulators expect to see. How you will know it is working: - Customer security questionnaires are answered from records. - Every risk in the register has an owner and a review date. - Evidence for each control is current at any point in the year. - Audits find fewer issues each cycle. Who you work with: - Compliance lead. Runs the gap assessment, owns the program plan and prepares for audit. - Security engineer. Implements the technical controls and the evidence collection from systems. - Risk analyst. Builds and maintains the risk register with your owners. What we need from you: - A sponsor from leadership who can approve policies. - Owners for the risks and controls in scope. - Access to the systems that produce evidence. - The questionnaire or requirement that started the work. Common questions: Q: Do you provide certification? A: We provide engineering, assessment and readiness support aligned to the framework. Formal certification or attestation remains the role of an accredited independent assessor where one is required. Q: Where should we start if we have never had a security assessment? A: With the systems that would hurt most if they failed, not with a framework checklist. A first assessment maps what you run, who can reach it and what an attacker would target, which is usually enough to reorder a security budget. Q: Can you help us respond to a client security questionnaire? A: Yes, and it is a common starting point. The questionnaire is also a useful diagnostic: the questions you cannot answer confidently tend to be the same gaps a real assessment would find. Q: Can one program cover several frameworks? A: Yes. ISO 27001, SOC 2, NIS2 and most sector rules overlap heavily, so we build one control set and map it to each framework rather than running parallel programs that duplicate the evidence. Q: What is the difference between ISO/IEC 27001 and SOC 2? A: ISO/IEC 27001 is an international standard for an information security management system, certified by an accredited body, and common in Europe and the Middle East. SOC 2 is an auditor's attestation report on controls against criteria set by the AICPA, and common with North American customers. Many controls overlap, so one program can prepare for both. Q: Do NIS2 and DORA apply to us? A: NIS2 applies to medium and large organizations in a wide list of sectors operating in the EU, and to some smaller ones in critical roles. DORA applies to financial entities in the EU and brings their critical technology providers under an oversight framework. We assess your position against the legal criteria, and your counsel confirms it. Q: How much documentation does a compliance program need? A: Enough to show that controls are designed, implemented and operating, and no more. Policies are short enough to be read, procedures describe what people actually do, and most evidence comes from systems rather than from documents written for the audit. Q: What happens after certification? A: Certification is kept through surveillance audits and a recertification cycle, so controls have to keep operating and evidence has to keep building up. We can support the program between audits with risk reviews, internal audits and evidence checks, so the next audit holds no surprises. Often paired with: Vulnerability management and penetration testing, AI governance and security, Identity and Zero Trust. --- Canonical page: https://www.expandware.com/services/managed-security/governance-risk-and-compliance/ Site index for machines: https://www.expandware.com/llms.txt Full site text: https://www.expandware.com/llms-full.txt Expandware Private Limited. Inquiries: solutions@expandware.com, +92 (333) 32 11011.