Vorpsel / Services / Assurance
Compliance readiness
We prepare your company for a security certification or a regulation: we measure the gap against the standard, plan the work, help write the policies and gather the evidence, and stay with you until the audit.
At a glance
- Standards ISO/IEC 27001, SOC 2, PCI DSS, LGPD
- Format gap assessment, then support until the audit
- Not the auditor we prepare you; the certification body or assessor audits
- Real security controls that work, not only documents
A certificate your customers can trust
A certification is often requested by a large customer or required by a regulator, with a date attached. The risk is to reach that date with a pile of documents that nobody follows, and fail the next audit or, worse, an incident.
We prepare you so that the controls work in practice. Each requirement of the standard becomes a task with an owner, and each task produces the evidence the auditor will ask for.
Which standard fits
A quick view of the four standards we prepare companies for.
| Standard | Usually required by | What you have at the end |
|---|---|---|
| ISO/IEC 27001 | International customers, tenders and regulated sectors | A certificate issued by an accredited certification body |
| SOC 2 | Customers in the United States, especially for software services | A Type I or Type II report issued by an audit firm |
| PCI DSS | Card brands and acquirers, for anyone handling card data | A self-assessment or a report on compliance from a qualified assessor |
| LGPD | Brazilian law, for anyone processing personal data in Brazil | Processes and records that show compliance to the authority and data subjects |
Standards we prepare you for
ISO/IEC 27001
The international standard for an information security management system. We help define the scope, run the risk assessment, write the Statement of Applicability and prepare for the stage 1 and stage 2 audits.
SOC 2
The report most requested by customers in the United States. We help choose the trust criteria, design the controls and prepare the evidence for a Type I and then a Type II report.
PCI DSS
Required for anyone who stores, processes or transmits card data. We help reduce the scope, apply version 4.0 requirements, including the controls for scripts on payment pages, and prepare the self-assessment or the assessor visit.
LGPD
The Brazilian data protection law. We map personal data and its uses, review legal bases and contracts, and set up the processes for data subject requests and incident notification.
How it works
How long it takes depends on the standard and on where you start. The gap assessment gives you a realistic date before you commit to one with a customer.
Gap assessment
We compare what you have today with each requirement of the standard and list what is missing.
Remediation plan
Every gap becomes a task with an owner, an effort estimate and a date, in the order that makes sense.
Implementation support
We write policies and procedures with you, review the controls as they are built and organize the evidence.
Audit readiness
We run an internal audit, fix what it finds and support your team during the external audit.
What you receive
Gap report
Each requirement, your current state and what is needed to meet it, with a realistic timeline.
Policies and procedures
Documents written for how your company actually works, approved by your leadership.
Evidence library
The evidence for each control, organized the way the auditor will ask for it, and a routine to keep it current.
Where Vorpsel products are in use, their reports can serve as evidence for some controls, such as vulnerability management, logging and cloud configuration. Using them is not required.
What auditors usually ask for
An asset inventory
Which systems, devices and data are in scope, and who owns each one.
Access reviews
Proof that access is granted, reviewed and removed in time.
Vulnerability management
Evidence that flaws are found and fixed within agreed deadlines.
Logging and monitoring
Records of security events and proof that someone reviews them.
Incident response
A tested plan and the record of how past incidents were handled.
Supplier management
How you check the security of the vendors that handle your data.
Questions
Do you issue the certificate?
No. The certificate or report is issued by an independent certification body, audit firm or qualified assessor. Keeping preparation and audit separate is what makes the result credible. We can help you choose and work with them.
Which standard should we start with?
The one your customers or regulator ask for. If nobody has asked yet, the gap assessment against ISO 27001 is a good base, because most other standards share a large part of its controls.
Can we prepare for more than one standard at once?
Yes. We map the requirements of each standard to a single set of controls, so the same work and the same evidence serve all of them.
Do we need to buy new tools?
Not necessarily. Many controls are processes and evidence. When a tool is needed, we explain which control it covers and you choose the product.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.