The article
The contract is ready, and then the client's security team sends one more request: your SOC 2 report, your PCI DSS attestation or proof of how you protect patient data. You have none of these yet, and sales wants to know how long it takes. This is where cybersecurity compliance consulting starts: mapping the rules to your systems, closing the gaps and preparing the evidence an auditor will ask for.
I have been building software for 18 years. Since 2017 my team of 70+ specialists has delivered 150+ projects. Two sit close to this topic: compliance software for pharmacy benefit managers, and a clinical photo platform built for HIPAA work, where we worked on the backend, the web front end and the mobile API. Compliance consulting is one of our cybersecurity services, built around proof as much as protection. Below: who signs what, how the work goes, what it costs and which part no consultant can do for you.
Cybersecurity compliance consulting: the short version
| What | How it works |
|---|---|
| For whom | Companies that must prove their security to an auditor, a regulator or a client |
| The rules | SOC 2, HIPAA, PCI DSS, ISO 27001 and the state and federal rules of your industry |
| What you get | The rules mapped to your systems, the gaps ranked, the controls in place, the evidence ready |
| What we do not do | Issue the certificate or the report: an independent auditor or assessor does that |
| Price | The first call and the rough estimate are free; the work is estimated before it starts |
| Timeline | Named in the estimate: it depends on the rules and on what you already have |
The part no consultant can sign
A consultant prepares you; someone independent decides. Know who that is for each framework before you hire anyone. I checked this table against the official sources in October 2026; it is a map, not legal advice.
| Framework | Who decides | What we prepare |
|---|---|---|
| SOC 2 | An independent CPA firm examines your controls and signs the report | The controls, the policies, the description of your system, the evidence |
| ISO 27001 | A certification body, ideally an accredited one; ISO itself certifies no one | The scope, the risk assessment, the controls and their records |
| PCI DSS | Your acquiring bank or the card brands tell you how to validate: a self-assessment questionnaire or an assessment by a Qualified Security Assessor | A smaller card-data scope, the controls, the evidence for either path |
| HIPAA | No official certificate exists: HHS does not recognize private "certifications", and the Security Rule asks for periodic evaluations, done in-house or by an outside firm | The safeguards and the records for those evaluations |
Sales pages blur this line. In October 2026 I read the five pages Google shows first for this search: none publishes a price, not even a starting one, and two promise the result itself - one invites you to become compliant today, another says 100% of its compliance audits pass. Five pages are a small sample.
The AICPA, which sets the standards for SOC reports, published its own warning this year: promises of fast and easy SOC reports threaten their credibility. Good cyber security compliance consulting services tell you on the first call who signs and what it takes.
Who needs it, and who does not
You need cybersecurity compliance services and consulting when a rule or a client asks for proof, not only for protection:
- Business customers send security questionnaires or ask for a SOC 2 report before they sign.
- You take card payments, and your bank asks how you meet PCI DSS. Here consulting on PCI cybersecurity compliance starts with scope: every system that touches a card number is in it, so the cheapest control is often a payment provider that keeps the numbers off your servers.
- Your software handles patient data for healthcare providers; ask your compliance advisor whether HIPAA applies to you.
- Your buyers ask for an ISO 27001 certificate.
It is not the right start when you need to know which laws apply to you: that is your counsel's question, and we turn their answer into controls. A small company without the basics - two-factor sign-in, backups that restore, updated devices - should begin with cybersecurity for small business. And when the question is wider than security, privacy, healthcare and financial rules are covered by our regulatory compliance services.
From gaps to evidence
The work goes in four steps:
- Map. Which rules apply and what each asks of your systems. If you need an NDA, we sign it before you share details; then we ask for read access to your cloud, your code repository and your identity provider.
- Gaps. What is missing, ranked by risk and by what an auditor checks first. A mock audit at this point shows the gaps the way the real auditor would.
- Close. Controls put in place in the cloud, the code and the team. When a gap sits in the application - a missing audit log, a secret in the code - our developers fix it there, as in remediation.
- Evidence. Policies, logs and records ready for the auditor, kept where they will be looked for.
Your side: one person who owns compliance and can decide, a few hours of interviews with the people who run your systems, and approval of every policy. The controls keep running after we finish, because an audit checks what your team does, not what we did.
One control, many frameworks
Most frameworks ask for the same core in different words: who can reach what, how people sign in, encrypted data, logs that someone reads, backups that restore, changes reviewed before release, vendors checked and a plan for incidents. We map each control once, reuse its evidence for every framework you face and list what each one asks beyond the core. A company preparing for SOC 2 this year and ISO 27001 next year should not collect the same proof twice.
Evidence an auditor accepts: a self-check
The proof is where audits are won or lost. This is the self-check I would run before inviting any auditor:
| Control | Evidence that does not convince | Evidence that does |
|---|---|---|
| Access reviews | A policy that says "we review access every quarter" | Dated records of each review: who checked, which accounts were removed |
| Two-factor sign-in | "Everyone uses it" | An export from the identity provider showing it enforced for every user |
| Backups | A backup job that reports success | A dated restore test: what was restored and how long it took |
| Code changes | "We review our code" | A recorded approval on every change before it reaches production |
| People who leave | An HR checklist | A record per person, with every account closed on the last day |
| Logs | "Logging is on" | Who reads which alerts, and what they did about the last ones |
| Incidents | A plan written two years ago | The plan, plus the notes of the last drill |
If your evidence sits in the middle column, the gap list is your first project. Collecting the right column by hand every quarter costs time too; compliance automation connects your tools to checks that gather it on their own.
Our work
Our cases show the same pattern: the rule shapes the software, and the evidence lives in the product.
- RxPhoto, photos for clinics. We worked on the backend, the web front end and the API behind the mobile app. The platform was built for HIPAA work: photos go straight into the patient's record on a secure cloud portal, and an audit log lets administrators follow every user action. The hard part was one record for photos, videos, forms and notes instead of separate systems; the product stores 80m+ photos, per rxphoto.com. More in the RxPhoto case.
- PBM Source, compliance software for pharmacy benefit managers. Each new law, regulation or guidance lands on a dashboard as a task with a summary, a jurisdiction and a date, marked by line of business so a team sees only what concerns it. Requirements are assigned with their documents in one place, which is how I want a client's evidence to live: next to the rule it answers. More in the PBM Source case.
- AI Call Center, UAE. Built for the country's data localization rules: all AI processing stays inside the UAE, on local servers with locally hosted models. The rule came before the design, the order that regulatory compliance and cybersecurity consulting should follow too. More in the AI Call Center case.
What the price depends on
There is no fixed price for this work, and I would distrust one quoted before anyone has seen your systems. The estimate depends on:
- how many frameworks you face, and which;
- how many systems are in scope: clouds, applications, offices, vendors;
- how much already exists: policies, two-factor sign-in, logs, backups;
- whether gaps sit in your code and need our developers;
- how soon the audit is, and whether the auditor looks at one date or at a period of operation.
The first call and the rough estimate are free, and the full estimate comes before any contract.
What stays yours
Whoever you hire, three things should be true at the end: the policies are written in your company's name, the evidence sits in your own accounts and tools, and every access the consultant had is listed and closed. On our projects every access and service is documented, so the end of the work leaves a clear list of what to revoke.
Next to this service
Compliance is one part of cybersecurity consulting. An assessment measures where you stand against a framework when no audit is scheduled; a managed security lead keeps controls, policies and client questionnaires moving after the audit. For one rule in depth, see PCI DSS and HIPAA.
Tell us which audit or rule is ahead. We reply with the gaps we would check first and a rough estimate, free; on weekdays from 9 am to 6 pm Miami time, a new request gets an answer within 30 minutes.
