Security compliance, and the IT to back it up.
BirchNY gets companies ready for the security reviews their customers demand, then runs the IT and security that keep them passing. We work with financial firms, fintechs, and technology companies remotely across the US, and in person in New York City. Every engagement is led by a senior practitioner with 15 years in IT and security.
When companies call us
- A customer asked for your SOC 2 report or ISO 27001 certificate, and the deal is waiting on it.
- A security questionnaire with a few hundred questions landed in someone's inbox.
- An examiner, investor, or insurer asked how you protect client data.
- IT has been handled by whoever had time, and it shows.
SOC 2 or ISO 27001
US customers usually ask for SOC 2. Customers in Europe and many large enterprises ask for ISO 27001. Most controls overlap, so if you need both, we build once and the second costs much less than the first.
What we do
Prices are published. Compare plans and prices
- SOC 2 readiness and implementationFrom gap assessment to a clean audit, for Type 1 and Type 2.Type 1 from $9,500
- ISO 27001 readiness and implementationFrom gap assessment to certification: the management system, risk assessment, and audit preparation.From $12,000
- Managed ITHelp desk, Microsoft 365 or Google Workspace, laptops, accounts, and backups.$125 per user per monthEssentials plan
- Managed IT + SecurityManaged IT with endpoint protection, monitoring, policies, and questionnaire help.$175 per user per monthSecure plan
- Security advisory (vCISO)A part-time head of security for companies with their own IT or engineering staff.From $2,500 per month
- Security assessmentA fixed-fee review of your setup, with a written list of fixes ranked by risk.From $2,500
Who we work with
Financial advisors
Managed IT, cybersecurity, and Regulation S-P support for registered investment advisers and advisory firms.
Fintech
SOC 2, ISO 27001, bank vendor security reviews, and part-time security leadership for fintech companies.
Security and tech companies
SOC 2 and ISO 27001 programs for security and software companies, run so engineers stay on the product.
Recent work
A financial advisory firm serving pharmacists
We set up and ran their IT, then built a security program on top of it.
An AI data readiness and migration platform for financial services
We ran their IT and secured it. Their customers are financial institutions, so their security had to hold up to outside review.
A cybersecurity company
We took them through SOC 2. A security company has to prove its own security before customers will buy.
How we work
A 30-minute call
You tell us what's driving it. We tell you whether we're a fit and roughly what it costs.
An assessment or a scope
You get a written list of what's wrong, ranked by risk, and a fixed price for fixing it.
The work
We run IT and security month to month, or deliver a defined project, such as SOC 2 or ISO 27001, with a start and an end. IT and compliance are one job here: controls hold up in an audit when the people who wrote the policy also run the laptops and the accounts.
Talk to us
Tell us what's driving it: a customer deadline, a questionnaire, an exam, or IT that has outgrown whoever handles it now. A first call takes 30 minutes, and you'll leave knowing whether we're a fit and roughly what it costs.
Book a 30-minute callor send a message, or email contact@birchny.com.