Services
A full security and compliance bench, built one engagement at a time
Most clients start with the Gap Assessment. These are the services it can lead into, brought in only as you need them — never sold as an all-or-nothing package.
The Menu
Six services, used only as you need them
Security & Compliance Gap Assessment
A control-by-control view of where you stand against SOC 2 and ISO 27001, with a prioritized roadmap to close the gaps. Fixed fee, 2 to 3 weeks.
- Control-by-control gap matrix against both frameworks
- Findings report with severity ratings
- Prioritized 90-day roadmap with effort estimates
- 60-minute readout with your team
Cloud Security Architecture Review
A hands-on review of your AWS, Azure, or GCP environment — identity and access, network boundaries, storage, and logging — against real-world misconfigurations, not just a checklist.
- Architecture review across IAM, network, storage, and logging
- Concrete hardening recommendations, prioritized by risk
- Optional hands-on implementation support
SOC 2 & ISO 27001 Readiness Program
For teams that are further along: policy development, control implementation, and evidence collection to get genuinely audit-ready, with a trusted auditor introduced when you are.
- Policy and procedure development
- Control implementation support
- Evidence collection and audit-trail setup
- Introduction to an independent audit partner
Third-Party & Vendor Risk Management
A vendor inventory, risk tiering, and a repeatable process — so the next time a customer asks about your subprocessors, you have a real answer ready.
- Full vendor and subprocessor inventory
- Risk tiering and review cadence
- A repeatable process for answering customer vendor questionnaires
Fractional CISO Retainer
Ongoing security leadership on a capped monthly retainer — for companies that need senior judgment regularly, but not a full-time hire.
- Monthly security and risk reviews
- Direct support on customer security questionnaires
- Ongoing guidance for your internal team
- Capped hours, so cost stays predictable
Incident Response Planning
A documented response plan and a tabletop exercise, so if a real incident happens, your team isn't improvising for the first time under pressure.
- Documented incident response plan with defined roles
- Tabletop exercise with your team
- Post-exercise gap review
Get Started
Book a 30-minute call
We'll talk through what's prompting the review, what you already have in place, and whether an assessment makes sense. No pitch deck, no obligation.
Prefer email? info@vistavinesolutions.com