Methodology
A clear path from scope to audit-ready
We work in phases with weekly check-ins and shared evidence tracking.
Operating cadence
- Weekly status and risk reviews.
- Shared evidence register with owners.
- Clear audit narratives for every control.
Phases
Our phased delivery model
1
Scope and risk map
Define system boundaries, data flows, AI components, and applicable TRZT criteria.
2
Control and policy design
Update policies, implement technical controls, and establish AI governance.
3
Evidence and readiness
Collect evidence, close gaps, and prepare audit walkthroughs.
4
Active audit window
Conduct continuous probing for security and privacy issues with authorized access to live websites and systems under rules of engagement.
5
Continuous compliance
Quarterly reviews, evidence refresh, and model change governance.
Inputs
What we need from you
- System diagrams and data flow context.
- Access to product, security, and AI owners.
- Current policies and control documentation.
- A clear audit timeline and scope.
- Approved access to live websites and systems for active probing with monitoring and guardrails.
Tooling and integrations
We can work in your GRC stack, including Vanta, Drata, Secureframe, Hyperproof, or spreadsheets.
Flexible tooling
Example timeline
- Weeks 1-2: scoping and risk map.
- Weeks 3-6: control and policy design.
- Weeks 7-10: evidence and readiness.
- Ongoing: audit delivery and continuous compliance.
Start with a scoping workshop
We will define scope, AI risk areas, and a clear plan to get audit-ready.