Compliance built on controls, not paperwork.

Most compliance programs start with documentation. Ours starts with measurable security controls. We map your actual security posture to the frameworks that matter (HIPAA, PCI-DSS, CMMC, NIST, and SOC 2) so you can prove compliance with evidence, not promises.

The questions keep getting harder. You shouldn't have to face them alone.

Every year, your insurer wants more evidence. Your clients want more assurances. Regulators want more documentation. And for most small businesses, compliance feels like a mountain you're supposed to climb without a map or a guide.

The typical approach (hire a consultant to write policies and fill out checklists) creates a paper program that doesn't reflect reality. Policies say one thing. Systems do another. And when someone digs deeper, the gap is obvious.

We believe compliance should be built on truth. We measure your actual security controls first. Then we map what you've actually implemented to the frameworks your business needs. The result is evidence built on what's real, not a binder full of aspirations.

Controls first. Compliance follows.

When your compliance program is built on what you've actually done, not what you wish you had, the documentation, evidence, and reporting take care of themselves.

1

Assess

Measure your security controls against proven benchmarks. Identify gaps, score your posture, and establish a measurable starting point.

2

Map

Map your assessed controls to the specific compliance frameworks your business requires. Identify where you're already compliant and where gaps remain.

3

Evidence

Produce compliance-ready evidence packages, gap analysis reports, and remediation roadmaps that auditors, insurers, and regulators actually accept.

Everything you need to get compliant and stay that way

From the first assessment through ongoing management, we provide the technical controls, documentation, and advisory support your compliance program needs, so you're never scrambling before an audit again.

Compliance mapping across major regulatory frameworks

The security controls we measure form the technical foundation all these frameworks are built on. One assessment. Multiple mappings. Real evidence.

HIPAA
Healthcare Security & Privacy
PCI-DSS
Payment Card Industry
CMMC
Defense Supply Chain
NIST
Cybersecurity Framework & 800-171
SOC 2
Service Organization Controls
GLBA
Financial Services Privacy
CJIS
Criminal Justice Information
Cyber Insurance
Carrier Requirements

Connect what you've actually done to what the framework requires

Compliance frameworks like HIPAA, PCI-DSS, and CMMC define what security controls your organization must have in place. The challenge is figuring out which of the hundreds of requirements you already satisfy, which ones you partially meet, and which ones need work. That's where most businesses get stuck.

We take the results of your security baseline assessment and map every assessed control to the specific requirements of your target framework. The result is clarity: here's where you're compliant, here's where you're partially compliant, and here's exactly what you need to do to close the gaps.

For each gap, we provide specific remediation guidance with effort estimates and priority rankings. For controls you already meet, we produce the evidence documentation that auditors need. The mapping is based on your actual technical controls, not self-reported questionnaire answers. That distinction matters more than you might think.

What You Get

  • Control-by-control mapping to your target compliance framework
  • Gap analysis identifying unmet and partially met requirements
  • Prioritized remediation roadmap for closing compliance gaps
  • Evidence documentation for controls you already satisfy
  • Framework-specific compliance score and readiness assessment
  • Executive summary for leadership and board reporting
  • Auditor-ready compliance package

How Mapping Works

Our mapping process connects your measured security posture to specific compliance requirements:

Your Baseline Measured security controls from your assessment
Framework Specific requirements from HIPAA, PCI, CMMC, etc.
Mapping Control-to-requirement alignment with gap identification
Evidence Documentation proving each control is implemented

Common Mapping Scenarios

  • Healthcare organization preparing for HIPAA audit
  • Manufacturer pursuing CMMC certification
  • Financial firm addressing GLBA or PCI-DSS requirements
  • SaaS company preparing for SOC 2 Type II
  • Any business aligning to NIST CSF
  • Multi-framework mapping for complex requirements

A risk assessment that's grounded in evidence, not guesswork

Every compliance framework requires a risk assessment. For many small businesses, this is the most daunting requirement, because it feels abstract, subjective, and like something only enterprise companies should have to worry about. It doesn't have to feel that way.

We combine the objective data from your security baseline assessment with a structured risk analysis methodology. We don't ask you to rate your risks on a scale of 1–5 and call it a day. We measure your actual controls, identify specific gaps, and map those gaps to real-world threat scenarios relevant to your industry.

The result is a risk assessment that's grounded in evidence: measured controls, identified vulnerabilities, threat likelihood based on industry data, and business impact analysis specific to your organization. Auditors and insurers recognize the difference between a risk assessment based on measurements and one based on guesses.

Risk Assessment Deliverables

  • Asset inventory and data classification
  • Threat identification relevant to your industry
  • Vulnerability assessment based on measured controls
  • Likelihood and impact analysis
  • Risk scoring and prioritization matrix
  • Control effectiveness evaluation
  • Risk treatment plan with remediation recommendations
  • Executive risk summary for leadership

When You Need a Risk Assessment

  • HIPAA requires annual risk analysis (45 CFR 164.308)
  • PCI-DSS requires formal risk assessment (Req. 12.2)
  • CMMC requires risk assessment practices
  • NIST CSF Identify function includes risk assessment
  • SOC 2 Trust Services Criteria requires risk assessment
  • Cyber insurance applications ask about risk assessments

Our Approach vs. Typical

Typical Interview-based, subjective ratings, checkbox exercise
Baseline Measurement-based, objective control data, evidence-backed

Our risk assessments start with your actual security posture data from the baseline assessment, making findings specific, actionable, and defensible.

Policies that match reality, not the other way around

Every compliance framework requires written security policies. But here's the problem with downloading templates from the internet: they describe controls you haven't implemented, reference procedures your team doesn't follow, and create audit findings when reality doesn't match the paperwork. Generic policies don't protect you. They set you up to fail.

Baseline develops security policies tailored to your actual environment, your implemented controls, and your operational procedures. Because we start with a measured baseline of your security controls, we know exactly what your organization has in place. Policies are written to document what you've actually implemented, not aspirational goals.

For controls you plan to implement as part of remediation, we write policies that align with the target state and include implementation timelines. The result is a policy set that auditors can verify against your actual environment, because the policies were written to match it.

Policies We Develop

Core Policies

  • Information Security Policy
  • Acceptable Use Policy
  • Access Control Policy
  • Password and Authentication Policy
  • Data Classification and Handling Policy
  • Incident Response Policy

Additional Policies

  • Remote Work and BYOD Policy
  • Vendor Management Policy
  • Change Management Policy
  • Backup and Recovery Policy
  • Physical Security Policy
  • Employee Security Awareness Policy

Policy Development Process

  • Review your security baseline assessment results
  • Interview key stakeholders on operational procedures
  • Draft policies aligned to implemented controls
  • Map policies to target compliance framework requirements
  • Internal review and revision cycle
  • Final delivery with approval workflow guidance
  • Annual review schedule and update process

What Makes Our Policies Different

  • Written to match your actual environment
  • Based on measured controls, not templates
  • Mapped to specific compliance requirements
  • Verifiable by auditors against your systems
  • Practical and enforceable by your team

A senior security partner in your corner, without the full-time salary

A CISO provides strategic direction for your security program: setting priorities, allocating resources, reporting to leadership, managing compliance, and ensuring your posture keeps pace with evolving threats. Most small businesses can't justify a $200K+ salary for that role. But the need doesn't go away just because the budget isn't there.

Baseline's virtual CISO (vCISO) service gives your organization access to experienced security leadership on a fractional basis. Your vCISO becomes the strategic bridge between your technical security controls and your business objectives, translating security posture data into business risk language that leadership and boards understand.

Because our vCISO advisory is built on your measured security baseline, every recommendation is grounded in data. We're not making theoretical suggestions. We're prioritizing actions based on your actual posture score, your specific compliance requirements, and your business risk profile.

vCISO Services

  • Security program strategy and roadmap development
  • Board and executive security reporting
  • Compliance program oversight and guidance
  • Vendor and third-party risk evaluation
  • Security budget planning and tool evaluation
  • Incident response program oversight
  • Insurance application and renewal support
  • Regulatory change monitoring and impact analysis
  • Monthly or quarterly strategic advisory sessions

Who Needs a vCISO

  • Organizations in regulated industries (healthcare, financial, manufacturing)
  • Businesses pursuing compliance certifications
  • Companies with board-level security reporting requirements
  • Organizations managing vendor security risk
  • Businesses where leadership needs a trusted security advisor

vCISO vs. Full-Time CISO

Full-Time CISO $200K–$350K+ annually
Baseline vCISO Fraction of the cost, same strategic output

Engagement Options

Monthly Ongoing advisory with regular check-ins
Quarterly Strategic sessions aligned to business cycles
Project-Based Targeted engagements for specific initiatives

Compliance isn't a one-time event. Neither are we.

Achieving compliance is one thing. Maintaining it is another. New systems get deployed, staff changes, regulatory requirements evolve, and the controls that passed an audit last year may not pass the next one. A compliance program needs to stay current, not just reach a milestone.

Baseline's ongoing compliance work is project-based and advisory-driven. We return annually to reassess your posture, refresh your compliance mapping against any framework changes, update your evidence package, and advise on any gaps that have opened since the last engagement. No subscription required. Just scheduled, recurring work that keeps your compliance evidence from going stale.

Ongoing Compliance Includes

  • Annual security reassessment with updated posture score
  • Refreshed compliance mapping against applicable frameworks
  • Updated evidence packages for auditors and insurers
  • Policy review and update cycle management
  • Regulatory change monitoring relevant to your frameworks
  • Compliance reporting for leadership and board
  • Audit preparation support and auditor coordination

Why Annual Matters

Most compliance frameworks require evidence of ongoing controls, not just a one-time snapshot. Annual reassessment gives you:

  • A current posture score auditors can reference
  • Updated evidence that reflects your actual environment today
  • Documentation of year-over-year improvement
  • Insurance renewal evidence that doesn't go stale
  • A clear record that compliance is actively managed

Compliance Engagement Calendar

Annually Full reassessment + compliance mapping refresh
On request Insurance evidence package generation
As needed Policy review and regulatory change updates
Per engagement Audit preparation and auditor coordination

When your carrier asks "do you have this?" you'll have the answer

Cyber insurance applications used to be simple questionnaires. Now they're detailed technical assessments. Carriers ask specific questions about MFA, EDR, backup procedures, privileged access controls, patch management, and more. Vague answers get higher premiums, or outright denials.

Baseline's insurance evidence packages are designed to answer these questions definitively. Because our assessment measures your actual security controls, we can provide specific, verifiable evidence for every question on the application. After remediation, we provide before-and-after documentation showing exactly what controls were implemented and the measurable improvement in posture.

For renewal cycles, annual reassessments provide updated evidence showing that your controls remain in place. Carriers increasingly want to see ongoing compliance management, not just a point-in-time snapshot. Our annual reassessment and compliance mapping engagements give you exactly that, with a current evidence package ready for each renewal.

Insurance Evidence Package

  • Current security posture score with per-control breakdown
  • Before/after comparison showing remediation improvement
  • Control-specific evidence for common carrier questions
  • MFA, EDR, backup, patch management verification
  • Incident response plan documentation
  • Security awareness training completion records
  • Quarterly posture trend showing maintained compliance

Common Carrier Questions We Answer

  • Do you use multi-factor authentication (MFA)?
  • Do you have endpoint detection and response (EDR)?
  • What is your patch management process?
  • Do you have a tested backup and recovery plan?
  • How do you manage privileged access?
  • Do you conduct regular vulnerability scanning?
  • Do you have a documented incident response plan?
  • Do you provide security awareness training?
  • Have you had a security assessment in the past 12 months?

Insurance Impact

  • Stronger application with verifiable evidence
  • Potentially lower premiums with documented controls
  • Faster underwriting with clear, organized documentation
  • Smoother renewals with quarterly evidence updates
  • Claims defense with proof of controls in place

Your industry has specific requirements. We speak the language.

Same honest, measured approach, tailored to the framework your auditors and regulators actually care about.

🏥 Healthcare: HIPAA

HIPAA requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic protected health information (ePHI).

  • Security Risk Analysis (required annually under 45 CFR 164.308)
  • Technical safeguard assessment and implementation
  • Access control and audit logging verification
  • Encryption and transmission security evaluation
  • Business Associate Agreement (BAA) review
  • Incident response and breach notification readiness

🏦 Financial Services: PCI-DSS / GLBA

Financial services organizations face PCI-DSS requirements for payment card data, GLBA for customer financial information, and increasing pressure from banking regulators and FDIC examiners.

  • PCI-DSS control mapping and gap analysis
  • GLBA safeguard requirements assessment
  • Network segmentation and access control verification
  • Encryption and key management evaluation
  • Vulnerability scanning (ASV and internal)
  • Regulatory examination preparation

🏭 Manufacturing: CMMC / NIST

Defense contractors and manufacturers in the supply chain must meet CMMC certification requirements based on NIST SP 800-171 to handle Controlled Unclassified Information (CUI).

  • CMMC Level 1 and Level 2 readiness assessment
  • NIST SP 800-171 control mapping
  • System Security Plan (SSP) development
  • Plan of Action & Milestones (POA&M) documentation
  • CUI scoping and boundary definition
  • Pre-assessment preparation for C3PAO certification

💼 Professional Services: SOC 2 / General

Law firms, accounting firms, consultancies, and SaaS companies face client-driven compliance requirements, SOC 2 expectations, and increasing cyber insurance demands.

  • SOC 2 Type I and Type II readiness assessment
  • Trust Services Criteria gap analysis
  • Vendor security questionnaire support
  • Client-facing security documentation
  • Cyber insurance evidence preparation
  • Security program development and maturation

Questions we hear all the time

Do you perform the actual compliance audit or certification?

No, and that's an important distinction. We prepare you for the audit or certification. For frameworks like SOC 2 or CMMC, a third-party assessor performs the official audit. Our job is to make sure your controls are implemented, documented, and evidence-ready before they walk in the door. We significantly increase your chances of passing the first time.

Can you help if we've already failed an audit?

That's exactly when many organizations call us. We'll start with a baseline assessment to see where your controls actually stand, map the gaps to the specific audit findings, build a remediation plan, and prepare you to pass the re-examination. Because we start with measurements, we can prove the improvement with before-and-after evidence.

We need to comply with multiple frameworks. Do we have to do separate assessments?

No. The security controls we assess overlap significantly across frameworks. A single baseline assessment can be mapped to multiple compliance frameworks simultaneously. For example, the same access control assessment maps to HIPAA, PCI-DSS, CMMC, and SOC 2 requirements. We identify the union of all requirements and address them in one effort.

How long does it take to achieve compliance?

It depends on your starting posture and target framework. A security baseline assessment takes 10–15 business days. Compliance mapping adds 1–2 weeks. Remediation to close gaps typically takes 3–4 weeks. Policy development runs parallel. Most organizations can go from initial assessment to compliance-ready in 2–3 months, depending on the scope of gaps identified.

Our cyber insurance application is due soon. Can you help quickly?

Yes, and we hear this one a lot. If you're on a tight timeline, we can prioritize the assessment and produce an insurance evidence package within 2–3 weeks. The package documents your current security controls with real posture data, exactly what carriers are looking for. If you have an urgent deadline, reach out now and we'll get moving.

Do we need ongoing compliance services, or is a one-time engagement enough?

Most compliance frameworks require ongoing evidence of controls, annual risk assessments, and regular policy reviews. A one-time engagement gets you compliant at that moment, but maintaining compliance requires annual reassessment and active management. We offer annual reassessment and compliance mapping engagements that keep your evidence current and your program defensible year over year.

You don't have to figure compliance out alone.

Whether you're staring down an audit, scrambling before an insurance renewal, or building a compliance program for the first time, we'll show you exactly where you stand and what it takes to get where you need to be.

Let's Talk