What the work actually looked like, told by the companies that went through it. Each story names the framework, the starting point, the timeline and the sticking points. Start with our Compliance as a Service overview, or read the compliance library for the framework detail behind these engagements.
Engineered Intelligence held ISO 27001 for two years. Large utility customers then asked for a SOC 2 Type 2 report. Nank.ai ran the preparation end to
Every story here is a real engagement, published with the customer’s approval. We name the framework, the starting position, the timeline and what made it slower or faster than usual. Where a result turned on something unusual, the story says so. A number without its conditions is not much use to you.
These are companies in Canada and the United States, selling into enterprise, healthcare, financial services and the public sector. The buyer asking for the report changes. The work rarely does.
A story earns a place here when it teaches something. A shortcut that worked only because of a prior certification. An audit that ran long, and the reason. A control set that carried across two frameworks without being rebuilt. Writing that reads well and teaches nothing does not make it.
Readiness, control design, evidence and auditor coordination for the Trust Services Criteria. Buyers write it SOC2 or SOC 2. Same report.
Scoping, Statement of Applicability, risk assessment and internal audit, through Stage 1 and Stage 2 with an accredited certification body.
PIPEDA, PHIPA and GDPR advice, security program design and penetration testing coordination for teams without a CISO.
New here? The compliance platform shows how the controls, evidence and audits fit together, and about Nank.ai explains why we built it the way we did.
Tell us which framework your buyers are asking for and what you have in place today. We will tell you what the program looks like and how long it takes. A real compliance manager on the call, no obligation.
