Preparation with explicit boundaries
Readiness asks whether your scope, controls, evidence, ownership, and remediation plan are prepared for scrutiny. An independent audit or certification is a separate engagement performed by a qualified party under its own rules.
These are proposed starting assumptions inUSD, current as of 2026-09-11. Final scope, price, allowances, dependencies, term, and billing are controlled by the signed statement of work.
$2,500/ month starting assumption
Establish the scope, gaps, owners, and remediation sequence for a first or newly expanded compliance target.
Best fit: Teams that need a defensible baseline before committing to a larger readiness program.
$7,500/ month starting assumption
Operate readiness as a recurring program so controls, evidence, exceptions, and ownership stay current.
Best fit: Growing teams preparing for a customer, assessor, certification-body, or regulator review on an active timeline.
$20,000/ month starting assumption
Pair readiness leadership with hands-on technical remediation and evidence automation across the engineering stack.
Best fit: Teams with material technical gaps, multiple environments or frameworks, or a compressed independent-review timeline.
Canonical Plus readiness packages do not promise an audit opinion, certification, authorization, legal conclusion, or successful outcome from an independent reviewer.
Scopes the program, maps requirements, identifies gaps, prioritizes remediation, and prepares an evidence package.
The output is management and implementation guidance. It can support an independent review, but it is not the reviewer’s conclusion.
Tests evidence and controls under the reviewer’s professional, regulatory, contractual, or accreditation requirements.
The reviewer decides the opinion, report, certification, authorization, score, or finding. Canonical Plus does not pre-approve that result.
Each phase records assumptions and dependencies so a future reviewer can understand how the readiness position was reached.
Clarify customer demands, contractual obligations, regulated data, public-sector goals, and timing.
Define products, cloud services, identities, code paths, vendors, data flows, and explicit exclusions.
Map current practices to requirements and assess design, operation, evidence quality, and ownership.
Sequence foundational and dependent work, define acceptance criteria, and track exceptions without hiding them.
Prepare a scope memo, control map, evidence index, open-issues log, and responsibility matrix for handoff.
Exact deliverables depend on scope. The following are planning targets, not promises of audit outcome or certification.
Systems, products, data, people, vendors, locations, and exclusions that define the readiness boundary.
Target requirements mapped to current controls, owners, evidence sources, and known exceptions.
Missing, partial, stale, or unverified controls and evidence, with assumptions kept visible.
Prioritized work with dependencies, owners, acceptance criteria, and evidence expectations.
A durable inventory of artifacts, systems of record, freshness windows, and access constraints.
A package for the qualified auditor, assessor, certification body, or other reviewer you select.
This fictional IAM example demonstrates the format of a working gap register. It is not a finding about any customer, an official control ID, a test result, or an independent auditor's conclusion.
Example reference IAM-04 · Identity and access management
The fictional team reports quarterly access reviews, but the available sample does not establish that every in-scope privileged account was reviewed. The control could exist even though evidence is incomplete.
Our role is to document the gap, recommend a remediation path, and prepare the evidence for qualified independent review. We do not certify that this control has passed an audit.
We distinguish implementation from proof. These are working readiness labels, not official assessor verdicts or a certification score.
A necessary control has not been established for the agreed scope.
The control exists only for some systems, identities, or required activities.
A control may operate, but supporting evidence has not been supplied or verified.
Artifacts are outdated, insufficiently scoped, or lack required context.
Current information is insufficient to conclude readiness; more review is needed.
The exclusion and its supporting rationale are recorded for independent review.
Applicability, exceptions, evidence quality, and final judgments are determined against each customer's chosen requirements by the appropriately qualified independent reviewer.
Some teams need technical remediation help; others need continuous evidence automation; others are ready to appoint an independent reviewer. The right answer can be a combination.