Find and fix the gaps before an auditor or examiner does. Independent assessments by CISA-certified auditors, scoped to the framework you are measured against.
Most audit findings are not surprises to the people who run the systems; they are gaps nobody had time to document or close. An examiner or certification auditor finds them on their schedule, not yours, and the result can be findings, corrective action plans, delayed certification, or a difficult conversation with your board. A rehearsal by an independent auditor moves those discoveries to a time when you can still act on them.
We perform the independent assessment before the real one: we test your controls against the framework, document the gaps, and give you a prioritized plan to close them. Where the final audit is ours to perform, such as an ISO 27001 internal audit or a NIST SP 800-53 control assessment, we can do that too.
We plan backward from the date on your calendar, so there is time to fix what we find before an auditor or examiner sees it. Most engagements follow these four stages.
Shorter runway? We compress the plan around the findings an examiner is most likely to raise.
Start with the framework on your calendar. The compliance audit is the rehearsal; the risk assessment is the document auditors ask for first.
Independent assessments against NIST SP 800-53, the HIPAA Security Rule, NY DFS Part 500, CJIS, and the GLBA Safeguards Rule, plus an ISO 27001 internal audit that satisfies clause 9.2. You see the gaps before your examiner does.
Compliance auditAlmost every framework requires a current risk assessment, and it is one of the first documents auditors request. We identify and prioritize the controls you need to cost-effectively protect your systems and data.
Risk assessmentHIPAA is three engagements: the Security Rule, the Privacy and Breach Notification Rules, and the Security Risk Analysis. We cover each one and leave you with the documentation the Office for Civil Rights asks for first.
HIPAA compliance auditA vCISO leads your compliance program between audits, keeps policies and evidence current, and serves as liaison with external auditors, examiners, and regulatory bodies, on a fractional basis.
vCISO advisoryA HIPAA risk analysis, an ISO 27001 certification audit, and a NY DFS examination measure very different things. We do not sell a fixed package. We start with the framework you are measured against and the date you face it, test what you actually run, and deliver findings in the language your auditor uses.
We assess against the exact rule, standard, or control catalog you will be measured against, not a generic checklist.
Tell us your audit or examination date and we plan the work so there is time to fix what we find before it arrives.
We help you assemble what an auditor or examiner usually requests first, from the risk assessment to access reviews and change records.
Audits and examinations reward preparation. The organizations that do well know their gaps in advance, have closed the important ones, and can show evidence for the rest. Our role is to act as the independent auditor before the real one: test your controls against the framework, document what is missing, and give you a prioritized plan and the time to act on it. Our compliance audit covers NIST SP 800-53, HIPAA, ISO 27001, NY DFS, CJIS, and the GLBA Safeguards Rule.
About twelve weeks before your audit or examination, we assess your controls against the exact framework and give you a prioritized gap list. The weeks that follow go to closing gaps and updating policies, then to collecting the evidence auditors ask for first. If your date is closer, we compress the plan and focus on the findings an examiner is most likely to raise. Each finding is risk-rated with clear steps to fix it, and where the final audit is ours to perform, such as an ISO 27001 internal audit or a NIST SP 800-53 control assessment, we can carry it through. Our support continues for three months after delivery.
Most organizations begin with one engagement and build from there. Find the situation closest to yours:
Not sure? A free consultation will help you decide.
Altius IT has performed independent audits for over 30 years. Our CISA-certified auditors are authorized to issue formal audit opinions, so our readiness work follows the same standards your auditor applies. We tailor every engagement to your framework, your environment, and your deadline.
A readiness assessment finds the gaps before the official audit or examination, while there is still time to close them. For some frameworks, such as an ISO 27001 internal audit or a NIST SP 800-53 control assessment, we can also perform the audit itself. For others, such as a regulatory examination or a SOC 2 report, the final review belongs to the regulator or a CPA firm, and we prepare you for it.
As early as you can. Starting months rather than weeks ahead leaves time to fix what the assessment finds and to collect evidence that the fixes work. If your date is close, tell us and we will focus on the areas your auditor is most likely to test.
Yes. Our vCISO service includes liaison with external auditors, examiners, and regulatory bodies, and our reports are written so the people reviewing your program can follow the evidence.
Every engagement is customized. Explore other common needs, or see what we recommend for your industry.
