Compliance and Regulations.

We help you prepare and can support the review within the agreed scope. ISO certification is issued by a certification body; SOC 2 examinations and reports are provided by an appropriately licensed CPA firm. Cyber Essentials certification goes through the scheme’s certification process. These external services are separate from our preparation work. We do not issue certificates or guarantee an audit outcome.

We can help document payment flows, organise existing evidence, identify preparation gaps and coordinate remediation with your team. Your acquirer or payment brand confirms the required validation and reporting route, including whether a Self-Assessment Questionnaire is appropriate. We are not a Qualified Security Assessor. Where a QSA, Approved Scanning Vendor or other specialist is required, their work is separately arranged and scoped; our preparation does not replace it.

The scope depends on your target, number of systems and entities, existing documentation, evidence quality and the work your team can take on. We agree a fee, deliverables and schedule after scoping. External assessor fees, technical testing and any additional implementation are identified separately. A target date also needs to allow for the chosen assessor’s availability and any required period of operating evidence.

Yes. We can organise the preparation around your chosen reviewer’s evidence requests and use the tools you already have. We agree access, evidence locations and responsibilities first. Automation is considered where it is useful and feasible; it does not replace policy decisions, control ownership or an assessor’s judgement.

Yes. We can map common controls and reuse relevant evidence to reduce duplicate work. Each framework still has its own scope, criteria and review requirements. Evidence accepted for one purpose is not automatically sufficient for another, so framework-specific gaps remain part of the plan.

These can be included when they are relevant to the requirement. Work may cover supplier inventories and due-diligence records, data inventories and retention, privacy-impact assessment inputs, or AI inventories and responsibilities. We work with your legal and data-protection advisers where interpretation, contracts or formal advice are needed. This is scoped preparation support, not a blanket claim to resolve every regulatory obligation.

Tell us the requirement at the first conversation. Financial-services resilience, NHS DSPT preparation and other sector evidence can be considered after confirming scope and any specialist input. Cryptographic inventories and migration planning may also form part of a longer-term programme where relevant. These are agreed workstreams, not automatically included in every engagement.

Your organisation retains accountability, control ownership, approvals and ongoing operation. We document responsibilities and the evidence review routine during the handover. Internal audit and management review requirements must still be met; a readiness walkthrough is not a substitute. Any continuing support from Red Vault has its own agreed scope.

Start with the requirement or customer request, your target date, existing policies and a simple outline of the systems involved. We agree the evidence needed, confidentiality, storage and retention during scoping. Access is limited to the work, with read-only access where possible; production changes require a separate agreement.

Start here when you have a defined compliance, audit or customer-assurance requirement. If you first need to understand your wider security position and priorities, a Cybersecurity Assessment provides that starting point. Any compliance preparation that follows is scoped and priced separately.