Assess

Readiness and gap assessments

Know exactly how far you are from a SOC 2 report, ISO 27001 certificate or CPCSC level, which gaps an auditor would care about, and a realistic date.

Book a strategy call
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. CISSP, CCSP, more than twenty years in enterprise security. Leads every engagement.

Connect on LinkedIn

Frameworks we assess against

One method, applied to the framework you are being measured on. Per-framework detail pages are being added.

icon-6

SOC 2 Type I and Type II

Trust Services Criteria in scope, system boundary, observation period options, and what a first report should include.

icon-5

ISO 27001

Clauses 4 to 10 and the Annex A controls, statement of applicability, and internal audit readiness.

icon-7

ISO 42001

AI management system scope, AI risk and impact assessment, and how it extends an existing ISO 27001 management system.

icon-2

CPCSC and CMMC

Defence contract requirements at the level your contract names, and the evidence a certification body expects.

icon-9

HIPAA and HITRUST

Safeguards against the rule and the HITRUST control set at the e1, i1 or r2 level.

icon-4

Multi-framework

Where a second framework is on the roadmap, the gap analysis maps the overlap so the second one is mostly mapping.

Assess, Build, Operate, applied to one framework

Scope is set before the engagement starts. A documented methodology, led by a senior architect with more than ten years of enterprise security experience and a CISSP.

01

Assess

Which framework, which systems, which people. The boundary as the framework defines it rather than the one the platform suggested.

02

Build

Policies, controls and evidence reviewed as an auditor would sample them. Platform status compared against what is really in place.

03

Operate

Gaps rated by audit consequence, a sequenced plan with owners and effort, and a recommendation on auditor, timing and observation period.

What you hold at the end

A plan you can hand to your team, to Truvo, or to any third party, and a realistic date.

Book a strategy call

  • Scope and system boundary statement

  • Gap analysis against the framework

  • Evidence review against what an auditor samples

  • Gaps rated by audit consequence

  • Sequenced plan with owners and effort

  • Auditor, timing and observation period recommendation

What the assessment settles

The four questions behind every readiness conversation.

How far you are

Measured against the framework's own requirements, not a platform percentage.

Which gaps an auditor would care about

Rated by consequence, so the plan fixes what would fail the audit before what would tidy the dashboard.

How long it takes

Sequenced by dependency, with effort against each item, so the date you give the customer is one you can hold.

What the second framework costs

Where SOC 2 and ISO 27001 overlap, and where ISO 42001 or CPCSC adds new work.

When a readiness assessment is the right call, and when it is not

If you already know the gaps and need them closed, skip the assessment and talk to us about managed compliance.

Right call when

  • A customer, contract or board has named a framework and a date

  • Your GRC platform shows a score and no one relies on it

  • You hold one framework and want to know the distance to a second

  • You need an independent read before choosing an auditor or an observation period

Wrong call when

  • You need the audit itself; Truvo prepares and manages, an independent auditor issues the report

  • You need an assessment of the security program, not tied to one framework; that is the security capability assessment

  • You want a checklist without anyone reviewing the evidence

Frequently asked questions

In practice they are the same engagement. A gap assessment measures the distance between what you have and what the framework requires. A readiness assessment adds the judgement about whether you can pass an audit on a given date, and what has to be true first. Truvo delivers both in one report.

The platform tests what it can connect to and reports on the controls it knows about. It does not know whether a policy is followed, whether an evidence screenshot shows the right thing, or whether the boundary you drew is the one an auditor will accept. In our experience the platform score and the audit outcome can differ substantially in either direction, and the assessment tells you which.

SOC 2 Type I and Type II, ISO 27001, ISO 42001, ISO 27701, CMMC, CPCSC, HIPAA, HITRUST, PIPEDA, Quebec Law 25 and GDPR. Where you are pursuing two, the assessment maps the overlap so the second is mostly mapping rather than new work.

No. Truvo prepares your environment, manages the auditor relationship through fieldwork and remediates findings. The audit report is issued by an independent auditor, because the independence boundary matters.

It follows the size of the estate and how much documentation exists, and the timeline is set before the engagement starts. The report includes a recommendation on audit timing and, for SOC 2 Type II, on the observation period.

The plan is written so it can be handed to your internal team, to Truvo, or to a third party. Companies that want the gaps closed and the program operated typically continue into managed compliance or a fractional security team engagement.

Talk to the architect who would do the work

A 30-minute call. We look at your environment and say plainly whether we can help and what it would take.

Book a strategy call

From the blog: readiness and audits

Stock photo by Ron Lach via Pexels, illustrating business contract handshake documents (temporary placeholder pending custom hero design).

Complementary User Entity Controls (CUECs) in SOC 2: What They Are and How to Evidence Them

Complementary user entity controls (CUECs) are the controls a vendor's SOC 2 report assumes its customers operate. A typical cloud arrangement: the ...

Learn More
Stock photo by Brett Sayles via Pexels, illustrating network switch firewall cables (temporary placeholder pending custom hero design).

SOC 2 Evidence Collection Without APIs: Hypervisors, Firewalls, and Servers You Patch by Hand

SOC 2 evidence collection on-prem works without APIs: auditors accept evidence collected by hand, by script, or by screenshot, provided it is ...

Learn More
Stock photo by Mahmoud Zakariya via Pexels, illustrating hybrid cloud network (temporary placeholder pending custom hero design).

SOC 2 for Hybrid and On-Prem Infrastructure: Scoping and the System Description

A service that runs partly in a public cloud and partly on company-owned hardware is one system for SOC 2 whenever customer data or commands cross ...

Learn More