Silver
Gap Assessment
You need to know where you stand.
- Timeline
- About 2 weeks
Compliance readiness
Get audit-ready without the guesswork
AABGM prepares your organization for HIPAA, SOC 2, ISO 27001, CMMC, NIST CSF and PCI DSS. We find the gaps, help you close them, and hand you the documentation an auditor expects.
How it works
- 1
Readiness check
A short questionnaire and a call. You learn where you stand and which package fits.
- 2
Assessment
We review your policies, systems and people against the framework and document every gap.
- 3
Fix and train
We help you close the gaps: policies, technical controls, incident response and staff training.
- 4
Audit-ready
You receive an organized evidence package, a mock audit if you need one, and a clean handoff to your auditor.
Frameworks we prepare you for
Already working toward more than one? We map overlapping controls so you do the work once.
HIPAA
Medical practices, home care agencies and their business associates.
There is no official HIPAA certification. We document your Security Rule risk analysis and readiness.
Learn moreSOC 2
SaaS, technology and service providers that hold customer data.
Prepares you for a Type I or Type II audit by an independent CPA firm.
Learn moreISO 27001
Organizations that need an internationally recognized security program.
Prepares you for certification by an accredited certification body.
Learn moreCMMC
Defense contractors that handle FCI or CUI.
Prepares you for a Level 1 self-assessment or a Level 2 assessment.
Learn moreNIST CSF 2.0
Any organization that wants a recognized security baseline.
A current profile, a target profile and a prioritized roadmap.
Learn morePCI DSS
Merchants and service providers that store, process or transmit card data.
Prepares you for a self-assessment questionnaire or a QSA assessment.
Learn moreReadiness packages
Every package is scoped to your framework, locations and systems. Pick the depth you need today and move up when you are ready.
Gold
Readiness Program
You want the gaps found and fixed.
- Timeline
- About 4 to 6 weeks
Platinum
Audit-Ready
You have an audit, contract or deadline coming.
- Timeline
- About 6 to 10 weeks
| What's included | Silver | Gold | Platinum |
|---|---|---|---|
| Kickoff and scoping | |||
| Gap analysis against the framework | Core controls | Full | Full, with control mapping |
| Risk assessment | High-level | Full | Full, with risk scoring |
| Policies and procedures | Review of existing policies | Review and update of core policies | Complete policy set |
| Technical security review | – | High-level | Comprehensive |
| Remediation plan | Prioritized list | Detailed plan with owners and dates | Plan plus hands-on remediation support |
| Staff security awareness training | Add-on | Training plus phishing simulation | |
| Incident response | Template | Written plan | Written plan plus tabletop exercise |
| Evidence and documentation | – | Organized evidence library | Audit-ready evidence package |
| Mock audit | – | – | |
| Auditor handoff and executive briefing | – | – | |
| Final deliverable | Summary report | Detailed report | Audit-ready handbook |
Enterprise
Several entities, many locations or more than one framework at once. We scope a custom program and combine frameworks so the same work is not done twice.
Ongoing compliance
Stay ready between audits with continuous control monitoring through our compliance platform partner, quarterly reviews, an annual risk assessment refresh and ongoing staff training.
Pricing depends on scope: locations, staff, systems and frameworks. Request a quote and we will send a fixed proposal.
AABGM provides readiness and advisory services. Audits, attestations and certifications are performed by independent, accredited firms.
Frequently asked questions
Do you perform the audit?
No. We prepare you for it. Audits, SOC 2 attestations and ISO certifications must be performed by independent, accredited firms. We get you ready and hand off a clean, organized package to your auditor.
Is there such a thing as HIPAA certification?
No. HIPAA has no official certification. What regulators and insurers look for is a documented risk analysis, current policies, trained staff and evidence that safeguards are in place. That is what our HIPAA packages produce.
How long does it take?
Most engagements run 2 to 10 weeks depending on the package, the number of locations and how quickly documents and people are available.
What do you need from us?
A point of contact, your existing policies and documentation, access to the systems in scope, and time with key staff for short interviews.
Will you see our patient or customer data?
We review how sensitive data is handled, not the records themselves. Engagements are covered by a signed confidentiality agreement, and a Business Associate Agreement for healthcare clients.
Can you cover more than one framework?
Yes. Many controls overlap across HIPAA, SOC 2, ISO 27001 and NIST. We map them once and reuse the evidence.
Not sure which package fits?
Tell us about your organization and your deadline. We will recommend the right package and send a fixed proposal.