Compliance for security and tech companies
If you sell security or software, customers assume your own house is in order, and they will check. A SOC 2 report or ISO 27001 certificate is often required before an enterprise deal can close. We run the compliance work so your engineers stay on the product.
Controls that fit how engineers work
Change management through pull requests, access through your identity provider, evidence pulled from the tools you already use.
One program, more than one framework
Build for SOC 2 first and ISO 27001 reuses most of the work, or the other way around.
Evidence collected as you go
Audit season should be a review, not a month of screenshots.
Where to start
- SOC 2 readiness and implementation
From gap assessment to a clean audit, for Type 1 and Type 2.
Type 1 from $9,500
- ISO 27001 readiness and implementation
From gap assessment to certification: the management system, risk assessment, and audit preparation.
From $12,000
- Security advisory (vCISO)
A part-time head of security for companies with their own IT or engineering staff.
From $2,500 per month
Recent work
A cybersecurity company
We took them through SOC 2. A security company has to prove its own security before customers will buy.
Talk to us
Tell us what's driving it: a customer deadline, a questionnaire, an exam, or IT that has outgrown whoever handles it now. A first call takes 30 minutes, and you'll leave knowing whether we're a fit and roughly what it costs.
Book a 30-minute callor send a message, or email contact@birchny.com.