Frameworks are useful when they tell you what to do next and dangerous when they become the deliverable. We use them to structure findings, so a gap can be explained in the language your customer, insurer, or regulator already expects. This page lists the frameworks we work with, what we do for each, and what we deliberately do not do.
How We Use Frameworks
Every finding from an assessment is mapped to at least one framework requirement when a framework applies. That mapping does three things: it makes the finding comparable across years, it lets you answer a customer questionnaire without rewriting your position, and it shows which single remediation closes several requirements at once. Most of the value is in that overlap, because the same five or six controls appear in nearly every framework.
The method behind the mapping is documented on how we assess, respond, and engineer.
Framework Table
| Framework | Who it applies to | What we do | What we do not do |
|---|---|---|---|
| NIST CSF 2.0 | Any organization; voluntary in most sectors | Current-state and target profiles, gap list, prioritized roadmap | No certification exists; we do not imply one |
| NIST SP 800-53 | Federal systems, contractors, and organizations adopting it voluntarily | Control mapping to a chosen baseline, implementation statements, evidence review | No FedRAMP or agency authorization work |
| NIST SP 800-171 | Defense contractors and subcontractors handling controlled unclassified information | Gap analysis, system security plan support, control mapping, remediation planning | No CMMC certification, assessment, or POA&M preparation claims |
| HIPAA Security Rule | Covered entities and business associates handling protected health information | Risk analysis support, safeguard review, policy development, business associate agreement review | No legal opinion on obligations, and no breach-notification decision |
| PCI DSS 4.0 | Merchants and service providers handling cardholder data | Readiness assessment, scope reduction and segmentation review, evidence preparation | No Report on Compliance; on-site assessments may require a QSA |
| ISO/IEC 27001 | Any organization, increasingly by customer requirement | Gap analysis against Annex A, risk register and statement of applicability support, policy set | No certification audit and no certification support contract; audits are performed by accredited registrars |
| GDPR | Anyone processing personal data of people in the EU or UK | Technical and organizational measure review, processor agreement checks, retention review | No legal advice and no representation before a supervisory authority |
| Virginia CDPA | Businesses meeting the Virginia thresholds for consumer data processing | Data inventory support, security control review, consumer request procedure review | No legal advice on applicability thresholds |
Certification vs. Readiness
Readiness means the controls exist and the evidence is available. Certification means an independent accredited body has examined that evidence and issued a certificate. We do the first. We do not do the second, and neither does any consultancy that also audits, because the separation exists on purpose.
The practical consequence: if someone offers to “get you certified” in a fixed number of weeks, ask who performs the audit and whether they are accredited for it. Two more things are worth asking: which specific standard version the work maps to, and what happens to the evidence after the engagement ends.
What We Don’t Do
- We are not a certification body, and we do not claim SOC 2 or CMMC certification support.
- We do not perform ISO 27001 certification audits; those are performed by accredited registrars.
- We do not perform PCI DSS on-site assessments where a Qualified Security Assessor is required.
- We do not provide legal advice or interpret a regulation for your specific facts; that belongs with your counsel.
- We do not sell a policy library as a finished program. Policies that staff cannot follow are a liability.
Questions to Ask Any Provider
- Are you independent? Does the same firm audit what it implemented?
- Who performs the work? The person on the sales call, or a junior team you meet after signing?
- What evidence will we receive? Ask for a sample report and read the finding format.
- Will you re-test? If remediation is not verified, the finding is still open.
- What are your limits? A provider that claims to do everything is telling you something.
The framework comparison in the compliance guide explains who each one applies to and what evidence looks like. Service pages: compliance and gap analysis, assessment, policy development.
Request a gap analysis or call 703-486-0200.