SOC 2
Service organizations
Readiness assessments, control design against the Trust Services Criteria, and evidence for Type I and Type II audits.
Compliance & audit
Controls that hold up. Evidence that's ready.
Since 2016, compliance and audit readiness has been at the core of what we do. We help you build the controls your frameworks require, produce the evidence auditors and examiners expect, and stay compliant year-round.
Frameworks we support
- SOC 2
- PCI DSS
- HIPAA
- GLBA
- FTC Safeguards Rule
- SEC Regulation S-P
- FINRA
- NERC CIP
- GDPR
How we work
From first gap assessment to clean audit.
Whether you're facing your first audit or your tenth, the path is the same: know where you stand, close the gaps, prove it and keep it that way.
- 01 Assess Gap and risk assessments show where you stand against each requirement and what matters most.
- 02 Remediate We design and help implement the controls, policies and procedures that close the gaps.
- 03 Evidence We organize the documentation and test results auditors and examiners ask for.
- 04 Audit We prepare your team, work alongside your auditor or assessor and respond to requests.
- 05 Maintain Ongoing testing, monitoring and reviews keep you compliant between audits, not just during them.
Frameworks
The requirements you're held to.
We support the regulatory and industry frameworks our clients answer to most, and we map overlapping controls so one program covers many requirements.
PCI DSS
Organizations that handle card data
Scoping, gap assessments against PCI DSS v4.0.1, ASV and internal scanning, penetration and segmentation testing.
HIPAA
Covered entities and business associates
Security Rule risk analysis, safeguards, policies and business associate oversight.
GLBA
Financial institutions and higher education
Information security programs that meet Safeguards requirements, including for federal student aid.
FTC Safeguards Rule
Non-bank financial institutions
A written security program, a qualified individual, risk assessments, required testing and incident reporting.
SEC Regulation S-P
Broker-dealers, investment advisers and funds
Incident response programs, customer notification procedures and service provider oversight.
FINRA
Broker-dealers
Cybersecurity controls, vendor supervision and business continuity planning that stand up to exams.
NERC CIP
Bulk electric system entities
Asset categorization, access and change controls, patching and evidence for audits.
GDPR
Organizations handling EU personal data
Security of processing, data protection impact assessments and breach notification readiness.
Working with another framework, such as NIST CSF, CMMC or ISO 27001? Ask us.
What you get
Deliverables auditors recognize.
Practical documents and results your team can use, organized the way auditors, assessors and examiners expect to see them.
- Gap assessments and readiness reports
- Risk assessments and risk registers
- Written information security programs
- Policies, standards and procedures
- Control design and implementation support
- Vendor and third-party risk management
- Incident response plans and tabletop exercises
- Penetration testing and vulnerability scanning reports
- Evidence collection and audit preparation
- Auditor, assessor and examiner liaison
Why Legion
Compliance backed by real security work.
Many requirements call for testing, monitoring and response, not just paperwork. Because we deliver those services too, the evidence comes from work that actually makes you more secure.
Common questions
Do you perform the audit or issue the report?
No. Audits such as SOC 2 must be performed by an independent firm, such as a licensed CPA firm. We get you ready, help build and operate the controls, and work alongside your auditor so the process goes smoothly.
We have to meet more than one framework. Do we start over for each?
No. Most frameworks share a common core of controls. We map your controls once and reuse the evidence across frameworks, so you aren't doing the same work twice.
How do your other services help with compliance?
Many requirements call for regular penetration testing, vulnerability scanning, logging, monitoring and incident response. Our testing and managed detection and response services produce that evidence as part of the work.
We just got a request from a customer, auditor or regulator. Can you help quickly?
Yes. Tell us what was requested and when it's due, and we'll help you prioritize and respond.
Have an audit coming up?
Tell us which frameworks you answer to and when. We'll help you get ready.