Compliance that runs on evidence, not promises.
Certifications aren’t earned in a two-week evidence drive. They’re earned every day a control operates, gets logged, and gets reviewed. Because AlecTech runs the SOC, the backups, the access reviews, and the vulnerability program, audit evidence is the byproduct of live operations — not a pre-audit reconstruction. SOC 2, ISO 27001, PCI-DSS, HIPAA, PIPEDA, Law 25, CyberSecure Canada: one evidence library, many frameworks, boring auditor visits.
A program that clears the audit and stays clear.
Certification is the milestone; maintaining it is the work. Every engagement produces a program that a surveillance auditor, a new insurer, or a client’s procurement office recognizes on sight — and keeps recognizing year over year.
Twelve services, three mandates.
Certify runs the frameworks that carry a certificate or attestation. Comply covers the privacy and industry regulations that don’t end in a certificate but do end in regulator action. Operate keeps the program current between audits — which is the hard part.
Certify
Certifications & attestationsSOC 2 Type I & Type II
Trust Services Criteria scoping, readiness assessment, control design, evidence program, and audit operation through Type I and Type II. The attestation clients in Canada and the US now ask for before signing.
ISO/IEC 27001
ISMS design, Statement of Applicability, risk treatment, internal audit, and certification body engagement through Stage 1, Stage 2, and surveillance. Includes ISO 27002 control alignment.
PCI-DSS 4.0
Cardholder data environment scoping, segmentation review, SAQ or ROC preparation, and QSA liaison. Covers merchants and service providers through the 4.0 transition and new requirements taking full effect.
HIPAA
Security Rule and Privacy Rule program design, Business Associate Agreement management, and OCR-facing documentation for covered entities and business associates operating in or into the US healthcare market.
CyberSecure Canada
ISED CyberSecure Canada certification for SMBs — 13 baseline controls, program documentation, attestation, and ongoing evidence to maintain the mark. The federal-government-recognized SMB standard.
Comply
Privacy, regulators, insurersCanadian Privacy Program
PIPEDA, Quebec Law 25, Alberta PIPA, BC PIPA, and Ontario PHIPA program design. Privacy Officer advisory, privacy notices, consent frameworks, PIAs, and regulator-facing response capability.
GDPR & International Privacy
EU GDPR Article 30 records, UK GDPR, CCPA/CPRA readiness, and cross-border data transfer mechanisms. For Canadian organizations selling into the EU, the UK, and California.
Industry-Specific Regulation
OSFI B-13 (financial), FINTRAC, IIROC, Controlled Goods Program, ITAR/EAR, and Law Society cyber obligations. Program design calibrated to the regulator your business actually reports to.
Cyber Insurance Readiness
Underwriter questionnaire navigation, control attestations, evidence packaging, and claim-readiness review. Insurers now underwrite on program maturity — evidence is what moves the premium.
Operate
Keeping the program currentEvidence Library & Continuous Monitoring
Control inventory, evidence capture automation, and continuous-monitoring dashboard. Evidence is collected by the team running the control — not retrofitted from screenshots taken the week before the audit.
Policy & Standards Management
Policy library development, periodic review cadence, approval workflow, attestation tracking, and exception management. The paper trail auditors actually accept, kept current between cycles.
Auditor & Regulator Liaison
Audit planning, fieldwork coordination, finding response, and ongoing regulator engagement. Turn auditor weeks into auditor days — and keep the regulator’s file uneventful.
Audit evidence is a byproduct of running the control. Not an exercise before the audit.
Most GRC work is a reconstruction exercise: controls live in a GRC tool, operations live somewhere else, and once a year someone harvests screenshots to prove the two ever met. Because AlecTech runs the SOC, the backups, the vulnerability program, the access reviews, and the IR retainer, the evidence is the operational artifact — the SOC ticket closing, the backup test passing, the quarterly access review completing. The auditor sees what the business actually does, not what a consultant claims.
- Access reviews, patching records, backup restore tests, SOC alerts, and IR drills captured automatically
- One control inventory mapped across SOC 2, ISO 27001, PCI-DSS, HIPAA, and CyberSecure Canada — write once, audit many
- Surveillance audits become calendar events, not fire drills — evidence already exists
- Insurer questionnaires drawn from the same live evidence library as the audit response
Four frameworks. Four typical paths.
Each framework has a characteristic shape: readiness duration, audit cycle, and evidence intensity. Planning the program around the right cycle, with evidence reused across frameworks, is where time and cost compress.
SOC 2 Type II
Trust Services Criteria for service organizations. Type I is point-in-time; Type II observes controls over 3–12 months. The attestation most enterprise customers now require.
ISO/IEC 27001
Certification-based ISMS with Statement of Applicability and documented risk treatment. Stage 1, Stage 2, then surveillance audits year 1 and 2, recertification year 3.
PCI-DSS 4.0
Scoping around the cardholder data environment, SAQ or Report on Compliance, and QSA engagement. Merchant and service provider levels, with 4.0 requirements now fully in effect.
HIPAA
Security Rule and Privacy Rule program for covered entities and business associates. No certificate, but OCR-facing documentation and BAA posture that a US healthcare partner recognizes.
GRC is the paper. Operations are the proof.
A control framework is easy to write; harder to prove is still operating on a Tuesday in month 9. Pair GRC with the services that generate the evidence — MDR, vCISO, risk assessments, IR — and the auditor sees one program, not a collage. Same contract, same accountable team, same dashboard.
MDR & SOC
SOC tickets, detection coverage, and response metrics feed directly into SOC 2 CC6/CC7 and ISO 27001 A.12/A.16 evidence.
Virtual CISO
Named accountable leader, program charter, and board reporting that audit frameworks and insurers now both require.
Risk Assessments
Enterprise risk register, gap assessments, and quantified findings that feed the GRC program’s risk treatment plan.
Incident Response
IR retainer, tabletop exercises, and incident records — the audit evidence for "we rehearse" that auditors now insist on seeing.
From scope to surveillance in four phases.
Each certification follows the same sequence, whether it’s a first-time SOC 2 Type II or a three-year ISO 27001 cycle. Scope is tight; readiness is measured; audit is orchestrated; surveillance is a calendar item, not a scramble.
-
01Weeks 1–4
Scope & Readiness Framework scoping, gap assessment against target controls, evidence inventory, and a written readiness plan with owners, timelines, and budget signed off before remediation starts.
-
02Months 1–6
Design & Remediate Policy library development, control design, technical remediation, evidence-capture automation, and internal audit. Surface and close gaps before the external auditor ever sees them.
-
03Audit cycle
Evidence & Audit Audit planning, fieldwork coordination, evidence packaging, finding response, and certification-body or CPA liaison through Stage 1, Stage 2, or Type I/II attestation.
-
04Year 2+
Maintain & Expand Continuous monitoring, surveillance audit prep, policy review cycles, and framework expansion — adding ISO 27001 once SOC 2 is stable, PCI-DSS once a new product ships, and so on.
Every engagement is led by a named GRC lead — CISA, CRISC, or ISO 27001 LA credentialed — with a program coordinator running the operational cadence so leadership time is spent on judgment calls, not status work.
Standard deliverables: scope statement, control inventory, policy library, evidence library, risk register, internal audit report, audit-ready submission package, and a maintenance plan for surveillance.
Frameworks share the vast majority of their controls. Every control is captured once in the inventory and mapped across every framework in scope — so adding ISO 27001 to a SOC 2 program is weeks, not months.
Three shapes. Same operating rigor.
How the program is consumed depends on where the organization is. First-time certifications have a distinct shape. Ongoing programs with surveillance audits have a different cadence. Multi-framework operators need the crosswalk to hold. All three run on the same evidence library.
First-Time Certification
End-to-end readiness and certification of a single framework: SOC 2 Type I then Type II, ISO 27001, PCI-DSS, HIPAA, or CyberSecure Canada. Includes policy library, evidence library, internal audit, and audit-body liaison.
Annual Program & Surveillance
Maintain certified status year over year: continuous evidence capture, policy review cycles, internal audit, surveillance audit prep, and auditor engagement. Monthly program check-in, quarterly control reviews.
Multi-Framework Program
Unified GRC program across multiple frameworks: SOC 2 + ISO 27001 + PCI-DSS + HIPAA + privacy. One control inventory, one evidence library, one audit calendar, one named accountable leader.
Where the certificate is the ticket in.
GRC programs for sectors where certification isn’t a trophy — it’s the precondition to bid, close, or register. Regulated, audited, or procurement-facing.
Legal Firms
Law Society cyber obligations, client-panel security questionnaires, ISO 27001 expectations from enterprise clients, and Law 25 / PIPEDA privacy program duties.
Financial Services
OSFI B-13, FINTRAC, IIROC, SOC 2, ISO 27001, and cyber insurance questionnaires — the certifications and attestations that registration and bank counterparty relationships now require.
Aerospace & Defense
Controlled Goods Program, ITAR/EAR, CMMC-aligned programs, and the prime-contractor security flowdowns that cascade to every tier of the supply chain.
Make the auditor’s next visit boring.
A 30-minute scoping call with a senior GRC lead — not a sales rep. We’ll walk through the framework pressure, the audit window that matters, and which engagement model actually fits. A fixed-price readiness proposal follows inside a week.
