Compliance as a Service

Compliance as a Service is ongoing work, not a fixed package. You pick the pods. A practitioner and CASK run those pods with your owners: the risk register, governance reviews, internal audits, and partner and vendor reviews. We agree the scope, the owners, and the cadence before the first month. Your team still approves changes and makes the risk decisions.

Scope the pods with us See how CASK works

Risk management

We keep one register, with an owner, a rating, and a treatment for each risk. Each month owners review their risks with a practitioner. CASK updates entries from the source files they point to. Leadership gets a quarterly report that shows which risks moved and why.

Monthly register updates, with a quarterly review

When this pod is the one you need

The risk register is last year's spreadsheet
Ratings get set in meetings and nobody writes down why
The board asked for a risk report and nobody has time to prepare it
Assessment findings need a home where someone tracks them

What stays current

Risk register
Risk treatment plans
Monthly owner review notes
Quarterly risk report
Risk acceptance log

The pod runs as a service to your point of contact.

Your point of contactReceives the service and approves decisions

Truvara

PractitionerRuns the pod with your contact

CASKDrafts and cites inside that work

What your contact receives

Risk register
Risk treatment plans
Monthly owner review notes
Quarterly risk report
Risk acceptance log

Every week

New risks from incidents, projects, and assessments logged

Every month

Owner reviews of ratings and treatment
Register updated and changes approved

Every quarter

Leadership risk report
Top risks and accepted risks re-checked

You decide every rating. The practitioner brings the evidence and a proposed rating. CASK stages the change and does not apply it.

ISO 31000:2018, ISO/IEC 27005:2022, NIST CSF 2.0, NIST AI RMF 1.0

Governance

We keep the policy set, the named owners, and the management review on a calendar. When a system or process changes, CASK drafts the policy update and a practitioner takes it to the owner for approval. Each quarter leadership reviews what changed, what is still open, and which decisions need a person.

Monthly policy and ownership checks, with a quarterly management review

When this pod is the one you need

Policies were written for the last audit and never opened again
Responsibilities live in a slide and the named people have left
The management review is rebuilt from scratch each quarter
Decisions get made in meetings and never written down

What stays current

Policy review log
Responsibility matrix
Decision log
Quarterly management review pack

The pod runs as a service to your point of contact.

Your point of contactReceives the service and approves decisions

Truvara

PractitionerRuns the pod with your contact

CASKDrafts and cites inside that work

What your contact receives

Policy review log
Responsibility matrix
Decision log
Quarterly management review pack

Every week

Follow up on policies and decisions that are due

Every month

Policy changes reviewed with owners
Responsibility matrix checked against people who left or joined

Every quarter

Management review pack
Scope checked against new systems, vendors, and teams

Your leadership still approves policy and the decisions in the management review. We prepare the pack and the log.

ISO/IEC 27001:2022, SOC 2, ISO/IEC 42001:2023

Internal audits

We build an annual audit plan from your risk register and the frameworks you hold, then test controls each quarter. Samples come from your systems, and each test result cites the evidence it used. Findings go to owners with dates, and we check the fix before recommending closure.

Quarterly testing against an annual plan

When this pod is the one you need

ISO/IEC 27001 requires internal audits and nobody objective is free to run them
The audit committee wants assurance on key controls between external audits
Findings from last year's audit are still open
A multi-site certificate needs site audits every year

What stays current

Annual internal audit plan
Test worksheets with samples
Internal audit reports
Findings tracker
Audit committee summary

The pod runs as a service to your point of contact.

Your point of contactReceives the service and approves decisions

Truvara

PractitionerRuns the pod with your contact

CASKDrafts and cites inside that work

What your contact receives

Annual internal audit plan
Test worksheets with samples
Internal audit reports
Findings tracker
Audit committee summary

Every week

Sample requests and follow-ups during fieldwork

Every month

Findings tracker updated from remediation evidence
Status note to the audit sponsor

Every quarter

Control testing for the planned audit areas
Internal audit report
Plan checked against new risks

This does not replace your external auditor or certification body. Reports go to your management, and every test cites the evidence it used.

IIA Global Internal Audit Standards, ISO 19011:2018, ISO/IEC 27001:2022, SOC 2

Partner and vendor risk management

This pod covers both directions. Inbound, we answer the questionnaires and auditor requests your customers and partners send you. Outbound, we keep the vendor inventory, send reviews sized to each vendor's tier, and track findings to a decision.

Per inbound request, and monthly for the vendor inventory

When this pod is the one you need

Security questionnaires land in sales every week and engineers end up answering them
The same question gets a different answer in different deals
Procurement signs vendors before security sees them
Vendor questionnaires come back and nobody reads them

What customers and partners send you

Send us the questionnaire, the portal link, or the auditor's request list. CASK drafts each answer from your policies and past responses and cites the file behind it. Where the workspace has no evidence, it marks the answer Not provided.

Completed questionnaires
Evidence pack for each review
Approved answer library
Review tracker with deadlines

The vendors you buy from

We keep a vendor inventory with a criticality tier. New and renewing vendors get a questionnaire sized to that tier. CASK checks the answers and reports they return. A practitioner records which risks you accept.

Vendor inventory with tiers
Questionnaire templates by tier
Vendor review reports
Findings and risk acceptance tracker

The pod runs as a service to your point of contact.

Your point of contactReceives the service and approves decisions

Truvara

PractitionerRuns the pod with your contact

CASKDrafts and cites inside that work

What your contact receives

Completed questionnaires
Evidence pack for each review
Approved answer library
Review tracker with deadlines
Vendor inventory with tiers
Questionnaire templates by tier
Vendor review reports
Findings and risk acceptance tracker

Every week

New questionnaires taken in
Vendor follow-ups on open reviews

Every month

Inventory updated from contracts and renewals
Summary of reviews closed and gaps still open

Every quarter

Old answers checked against current policies
Tier 1 vendors re-checked
Accepted vendor risks reviewed

An answer goes out only after you approve it. If no file supports it, we mark it Not provided and ask the owner. We do not invent a yes.

Shared Assessments SIG, CSA CAIQ, ISO/IEC 27036, ISO/IEC 27001:2022, SOC 2

What we need before the first month.

A sponsor who approves the scope and the reports
Named owners for the areas in scope
Access to the systems and folders where the records live
A regular slot to review what the period produced

The pods we agree. Risk management keeps the register and the reviews moving. Governance keeps policies, responsibilities, and the management review on a calendar. Internal audits run a risk-based plan and track findings. Partner and vendor risk management takes in questionnaires and keeps the vendor inventory and findings moving. An engagement usually covers some of these, not all of them.

For the parts we agreed, we do the work. Your owners still run their controls, and your leadership still approves risk and policy.

Yes. We add or remove tasks in writing. The calendar and the status report follow the current scope.

Evidence and drafts sit in a CASK workspace on the practitioner's machine, and approved exports go back to your systems. You pick the AI provider, and Truvara does not use workspace content to train models.

You get the calendar, the evidence index, and every approved document as ordinary files. A new owner can pick up from the last status report.

Teams often start with one of these.

Program

Risk, privacy, or compliance program setup

Set up one program with clear owners, review steps, records, and reporting, then support the first cycle.

ISO 31000:2018COSO ERMISO/IEC 27001:2022

Typically 8-12 weeks

ISO

ISO/IEC 27001 readiness and certification support

Prepare an information security management system, first-time or multi-site, with the scope, risk assessment, core documents, and evidence the certification audit asks for.

ISO/IEC 27001:2022ISO/IEC 27002:2022ISO/IEC 27005:2022

Typically 3-6 months

Privacy

Privacy assessment and improvement plan

Review how you handle personal data against the agreed requirements, such as DPDPA or ISO 27701, and prioritize the gaps.

DPDPA 2023DPDP Rules 2025GDPR

Typically 4-8 weeks

Compliance as a Service

Risk management

When this pod is the one you need

What stays current

Governance

When this pod is the one you need

What stays current

Internal audits

When this pod is the one you need

What stays current

Partner and vendor risk management

When this pod is the one you need

What customers and partners send you

The vendors you buy from

What we need before the first month.

Want us to run these pods with you?

Compliance as a Service

Risk management

When this pod is the one you need

What stays current

Governance

When this pod is the one you need

What stays current

Internal audits

When this pod is the one you need

What stays current

Partner and vendor risk management

When this pod is the one you need

What customers and partners send you

The vendors you buy from

What we need before the first month.

Want us to run these pods with you?

Compliance as a Service

Risk management

When this pod is the one you need

What stays current

Governance

When this pod is the one you need

What stays current

Internal audits

When this pod is the one you need

What stays current

Partner and vendor risk management

When this pod is the one you need

What customers and partners send you

The vendors you buy from

What we need before the first month.

What can Compliance as a Service include?

Are you our compliance team now?

Can the scope change later?

Where does the program data live?

What if we bring the work back in-house?

Teams often start with one of these.

Risk, privacy, or compliance program setup

ISO/IEC 27001 readiness and certification support

Privacy assessment and improvement plan

Want us to run these pods with you?

Compliance as a Service

Risk management

When this pod is the one you need

What stays current

Governance

When this pod is the one you need

What stays current

Internal audits

When this pod is the one you need

What stays current

Partner and vendor risk management

When this pod is the one you need

What customers and partners send you

The vendors you buy from

What we need before the first month.

What can Compliance as a Service include?

Are you our compliance team now?

Can the scope change later?

Where does the program data live?

What if we bring the work back in-house?

Teams often start with one of these.

Risk, privacy, or compliance program setup

ISO/IEC 27001 readiness and certification support

Privacy assessment and improvement plan

Want us to run these pods with you?