Managed program
Evidence collected all year, so audit prep is a review.
We run the readiness work and keep your evidence current. An independent auditor does the audit and decides the result. This page shows who does what, and when.
Readiness by area
Example- Access reviewsEvidence current
- PoliciesAwaiting approval
- Vendor reviews2 overdue
- Change managementGap, owner assigned
Who does what, and when
Four moments, three parties.
Readiness covers SOC 2, ISO 27001, HIPAA, CMMC and more. The work is the same shape for each; the per-framework detail is on the frameworks page.
Between audits
Your expert team
- VectraIQ checks your configuration on a schedule through read-only integrations and flags drift.
- Evidence is collected as you go and linked to the control it supports.
- Your cyber expert reviews gaps and policies and keeps the audit program tracked.
You
- Own the controls assigned to you.
- Approve policies and sign off the reviews only you can sign.
Independent auditor
Nothing yet. You have not engaged one, or the audit period is still running.
Before the audit starts
Your expert team
- Your expert team checks that every control in scope has an owner, a current policy where one is needed and evidence from the period.
- They tell you what to expect from the auditor’s process.
You
- Choose and engage the auditor. That agreement is between you and them.
- Close the gaps your cyber expert lists.
Independent auditor
Agrees scope and timing with you.
During the audit
Your expert team
- Your cyber expert helps you find the evidence each request asks for and tells you if something is missing before you send it.
You
- Answer the auditor’s requests and make your people available.
Independent auditor
Examines your controls and evidence and decides the outcome.
After the audit
Your expert team
- If the audit surfaces gaps, your expert team helps you close them and keeps the fix and its evidence in your program.
You
- Decide how and when to respond to what the auditor found.
Independent auditor
Issues the report or certification, or does not.
Worked example
One auditor request, start to finish.
- 1Auditor
Asks for proof that user access reviews were performed each quarter of the audit period.
- 2VectraIQ
The control “user access reviews” already holds three records, one per quarter, linked as they were completed.
- 3Your cyber expert
Reads them and spots that the second quarter’s review has no approver’s sign-off. That would have been the auditor’s first question.
- 4You
Get the approver to sign the review, then your cyber expert marks the evidence complete. If the review had never happened, it would instead become a finding with an owner and a plan.
Illustrative. The records, the control name and the missing sign-off are made up to show the order of events.
Where our work stops
Four edges of our work.
You should not find these later, so they are here.
- ×
We do not perform the audit or issue the result
An independent auditor or certification body does, for SOC 2, ISO 27001 and the other frameworks. We do not influence it.
- ×
We do not guarantee an outcome
We say so in plain words: we assist you in operating your compliance program, and you remain responsible for it.
- ×
We are not a party to your auditor agreement
If you engage an auditor, certification body or other third party, that agreement is between you and them. We make no representation about their work.
- ×
A standalone readiness project is a separate engagement
Day-to-day program management is the managed program. Consulting aimed at a specific framework, audit or certification, and training for your staff, is Vectra Advisory, set out in its own order.
The wording is in your agreement and the Vectra Advisory terms.
What we need from you
Owners, approvals and an auditor.
- Name an owner for every control in scope. A control without a person does not get done.
- Approve policies. They start from templates, tailored by your cyber expert; the approval is yours.
- Choose, engage and schedule the independent auditor.
- Respond to the auditor and make your people available when asked.
The platform side is on audit and compliance, frameworks and controls and reporting and dashboards. Gaps found along the way follow the route on the remediation page.
Questions, answered.
What does “ready” actually mean?
Every control in scope has an owner, a current policy where one is needed, and evidence from the audit period. It is a state we can show you control by control. It is not a promise about the auditor’s result.
What happens if the auditor finds a gap?
The auditor decides how the gap affects the outcome. Your expert team helps you close it and keeps the fix and its evidence in your program, so the next audit starts with it already done.
Does evidence collection mean you log in to our systems?
Connections are read-only, and evidence from your tools comes through them. Anything else is a document you or your team uploads. Wider access exists only where you choose to grant it.
Next in the program
Keep going through the program.
Know what your audit will ask for.
Tell us which audit is coming and a lead expert will show what ready looks like, control by control.