Service · Compliance Programs
Audit-ready every day. Not every audit.
Compliance documentation, evidence collection, and attestation built into the platform. We maintain the program continuously, so your audit becomes a review, not a fire drill.
Frameworks We Support
Vertical compliance packages are included in the Fortress tier. Each framework is maintained continuously, with evidence collected automatically from your monitoring telemetry.
ABA Model Rule 1.6
Confidentiality of information for legal practice
FTC Safeguards Rule
WISP for financial services and CPA practices
NAIC Model Law 668
Insurance Data Security for licensed insurance entities
HIPAA Security Rule
Administrative, physical, and technical safeguards for ePHI
NIST 800-171
Available via Aegis professional services
CMMC Level 2
Available via Aegis professional services for DIB contractors
What's in a Compliance Package
Each compliance package includes documentation, evidence collection, gap analysis, and audit support. The work happens continuously. Your audit becomes a review of an existing program, not a project.
Documentation
Policy Templates and Customization
Framework-specific policy templates customized to your firm. Updated as regulations evolve. Versioned for audit trail.
Evidence
Continuous Evidence Collection
Monitoring telemetry doubles as audit evidence. Logs, control attestations, and incident records accumulate continuously.
Assessment
Annual Gap Analysis
Annual review of your program against the framework. Documented gaps with prioritized remediation roadmap.
Reporting
Monthly Attestation Reports
Plain-language compliance posture summary every month. Ready to share with leadership, counsel, board, or auditor.
Support
Audit Response Support
When auditors arrive, we provide evidence packages, walk them through controls, and respond to inquiries on your behalf.
Updates
Regulatory Change Tracking
When frameworks change (HIPAA Security Rule updates, FTC amendments, NAIC adoptions), we update your program proactively.
How Compliance Programs Work
Compliance becomes part of operations rather than an annual project.
Step 1
Baseline
Initial assessment against your applicable framework. Documented gaps with prioritized remediation.
Step 2
Implement
Policy templates customized. Controls deployed. Monitoring telemetry mapped to framework requirements.
Step 3
Maintain
Continuous evidence collection. Regulatory change tracking. Quarterly internal review.
Step 4
Attest
Monthly attestation report. Annual gap analysis. Audit response when external review occurs.
Why Compliance Built Into MDR
Compliance and detection use the same evidence. We collect it once and use it twice.
Same Telemetry, Two Uses
Your monitoring data already proves you're meeting most technical control requirements. We build the audit trail from data we're already collecting.
Continuous, Not Annual
Annual compliance projects miss most of the year. Continuous compliance means a regulator inquiry is a review, not a scramble.
Vertical Specialization
We don't try to support every framework. We specialize in the four that matter to regulated SMBs and bring depth to each.
Audit Support Included
When external auditors come, we work with them directly. You don't pay separately for audit response, and you don't navigate it alone.
Common Questions
Is a compliance package the same as a SOC 2 report?
No. Our compliance packages support the frameworks listed (ABA, WISP, NAIC, HIPAA). SOC 2 attestation requires an independent CPA firm and is outside the scope of our compliance packages, though our evidence and program documentation make a SOC 2 audit substantially easier.
What if I need a framework you don't list?
NIST 800-171, CMMC, ISO 27001, and other frameworks are available through Aegis professional services. We scope custom compliance work based on your specific requirements.
Will the compliance package satisfy my regulator or auditor?
In most cases, yes. Regulators increasingly require documented compliance programs and continuous evidence of active controls. The monthly attestation report is built to be handed directly to an auditor.
Are compliance packages included in Guardian?
No. Compliance packages are a Fortress tier feature. Guardian provides monitoring and detection but does not include compliance program documentation.
Make compliance a byproduct of operations.
Schedule a consultation to map your applicable framework, scope what's needed, and review what compliance built into MDR actually looks like.