Do we need SOC 2 or ISO 27001?
It depends on who is asking. US customers most often ask for SOC 2, while international and enterprise buyers often ask for ISO 27001. The assessment maps your gaps to both, so you can choose with evidence.
Is the assessment an audit?
No. It shows where you stand and what to fix. SOC 2 reports must come from an independent CPA firm, and ISO 27001 certificates from an accredited certification body. We introduce audit partners when you're ready.
What access do you need to our systems?
Read-only access to cloud configuration and documentation, agreed in writing before we start. We do not change your systems during an assessment.
How long does it take?
Two to three weeks from kickoff to readout, depending on the size of your environment and how quickly we get access and interviews scheduled.
How much does it cost?
A fixed fee, quoted after a short call once we know your size and scope. The fee is credited toward follow-on work if you continue within 30 days.
Do you do penetration testing?
Not as part of the assessment. When you need it, we help scope it and coordinate an independent testing firm, so the results feed straight into your roadmap.
What's the difference between the assessment and the fractional CISO retainer?
The assessment is a fixed-scope, one-time engagement. The retainer is ongoing monthly support — for companies that want continued security leadership after the initial gaps are closed.
Get Started
Book a 30-minute call
We'll talk through what's prompting the review, what you already have in place, and whether an assessment makes sense. No pitch deck, no obligation.
Prefer email? info@vistavinesolutions.com