Risk & Compliance practice
Pass the audit. Keep the trust.
The compliance arm of a cybersecurity and AI security consultancy. Readiness, audit support and AI governance built on one control set, with evidence that comes from our testing and SOC work, not from a scramble before fieldwork.
Simulated environment, real workflow.
One control set
Do the work once. Prove it to every auditor.
One unified set of controls, mapped clause by clause, so a fix made for SOC 2 is credited to ISO 27001, NIST CSF and HIPAA the same day.
- Each control written once, cross-mapped to every framework in scope
- Gaps ranked by how many frameworks a single fix closes
- Evidence tagged once and reused by each auditor
Services
Every framework your buyers name, under one practice.
Start with the one a customer asked for. We map it to the rest, so the second framework reuses the work of the first.
Attestation readiness
SOC 2
Scoping, gap assessment, controls, evidence and auditor coordination through the final report.
Certification readiness
ISO 27001
An ISMS fitted to how you work, an internal audit and support through Stage 1 and 2.
Privacy programs
Privacy (GDPR, CCPA)
Data maps, records of processing, DPIAs (AI features included), data subject requests and virtual DPO support.
Risk
Risk Assessment
Realistic loss scenarios, AI risk included, rated against your controls and quantified for budget decisions.
Third parties
Vendor Risk
Tiering, right-sized assessments, AI vendor due diligence, contract terms and monitoring after the deal closes.
Assurance
Internal Audit
Independent testing of control design and operation, with findings your auditors can rely on.
Everything else
All frameworks
One unified control set mapped to industry, government, EU and AI frameworks.
Ongoing
Continuous compliance
Evidence collected automatically, reviewed every quarter and ready when audit season arrives.
Talk to an expertAI governance
AI frameworks on the same control set.
Run with our AI Security practice, so the red team that tests your models also writes the evidence your governance framework asks for.
AI management system
ISO/IEC 42001
Built as an extension of your ISO 27001 ISMS: AI policy, risk and impact assessments, supplier oversight.
ExploreGovern · Map · Measure · Manage
NIST AI RMF
An AI risk register and controls aligned to the four functions and the generative AI profile (NIST AI 600-1).
ExploreReadiness, not guesswork
EU AI Act
Role and risk classification per system, then the documentation each tier needs. Phased obligations; dates confirmed at engagement.
ExploreHow it runs
Readiness, evidence and audit in one place.
You see the same console our practitioners work in, so status is never a meeting away.
Gaps ranked by audit risk
Every control mapped to the criteria, with owners and the shortest path to green.
- Gap assessment in weeks, not quarters
- Owners and due dates on every gap
- One fix credited to every framework it satisfies
app.resilientprivacy.com/grc/soc-2
Simulated environment, real workflow.
Evidence that collects itself
Integrations pull configuration, tickets and logs on a schedule, so evidence is current the day the auditor asks.
- Pulled from cloud, identity, HR and ticketing
- Freshness tracked per control
- Our SOC and testers add their records as they work
Evidence · librarySimulated environment, real workflow.
Fieldwork without the fire drill
Auditor requests land in one queue, answered from the evidence library with a named owner for each.
- One request queue shared with the auditor
- Answers linked to the evidence, not emailed
- Exceptions tracked to a management response
Audits · SOC 2 Type II fieldworkSimulated environment, real workflow.
One consultancy
Compliance as a by-product of security work.
The other practices produce the records auditors ask for. Risk & Compliance turns them into evidence, so you prove what you already do.
Offensive Security
Penetration tests and retests satisfy the testing requirements most frameworks set.
AI Security
Each AI red-team finding is delivered with the governance control it evidences.
Managed SOC
Every case our analysts handle is logged as incident-response evidence.
Platform
Cloud, identity and API findings become control evidence the moment they are fixed.
FAQ
Straight answers.
Which framework should I start with?
Usually the one a customer has asked for. We map it to the others so later frameworks reuse the work.
How long does SOC 2 take?
A first Type II often takes several months, most of it the observation window.
Do you issue the audit report?
The report comes from an independent auditor or certification body. We prepare you and coordinate with them.
Does the EU AI Act apply to us?
If you build or use AI in the EU market, probably. Obligations are phased and dates are confirmed at engagement; our AI governance practice classifies each system by role and risk tier first.
Can software keep us compliant?
It handles evidence. People still own the decisions, and we help with both.
Find out how close you are to audit-ready.
A 30-minute readiness conversation with a Risk & Compliance lead, scoped to the frameworks you are asked for.