Compliance-as-a-Service
Why compliance goes stale
Most offices treat compliance as a once-a-year event: three weekends assembling a binder, then the binder goes in a drawer. A new hire starts without the training and an admin leaves without the offboarding checklist getting run. By spring the policies describe an office that no longer exists.
Compliance-as-a-Service moves that work onto a calendar. Controls get checked on a schedule and evidence gets collected as it happens (a screenshot of the MFA policy the day it changes, a training record the day someone finishes). At any point you can say where you stand, and back it up.
What the program covers
- Scoping the framework: HIPAA, SOC 2, PCI DSS, or ISO 27001
- A gap assessment, fixes ranked by risk
- Policies written around how your office works
- Controls through the Flow security stack: MFA, encryption, logging, backup, access reviews
- Security awareness training and phishing tests, records kept
- Continuous evidence collection and a maintained control matrix
- Vendor and cyber-insurance questionnaires
- Audit prep and remediation tracking, plus a seat in the room for technical questions
- A quarterly status report for leadership
How the program runs
01 Scope
Which framework applies and which systems hold the data. We draw the boundary tight so you don't audit more than necessary.
02 Assess
Current controls against the framework, handed back as a ranked list. Some you'll already have.
03 Implement
Controls go in through the Flow security stack and every policy gets an owner. Training starts the same month.
04 Operate and prove
Evidence accumulates between audits. Quarterly you get a status report, and when the audit arrives we're in the room.
Boundaries
Ours to run
- Running the program and keeping its documentation and evidence
- Technical controls, through the Flow security stack
- Staff training and the questionnaire and audit work
Yours, or someone else's
- The auditor's fee and the certificate itself
- Legal opinions on regulations (we'll work with your counsel)
- Controls for systems outside the agreed scope
Questions from the readiness review
How long until we're audit-ready?
Depends on where you’re starting and which framework. The gap assessment gives you a timeline within a few weeks. Most of the risk reduction happens in the first quarter, once MFA and backups are fixed.
Do we need Flow to use Compliance-as-a-Service?
It comes with Flow Professional and Enterprise, because most of the controls (MFA, logging, backup, endpoint protection) are things the Flow stack already does. If someone else manages your IT, Vision can run the program above them.
Can you work with our existing auditor?
We’d prefer it, since they know your business. We put the evidence in the format they expect and join the technical sessions.
Start with the readiness review.
It’s part of the free IT Health Check. You get a gap summary even if you go no further.