Continuous compliance, for the months nobody is auditing you
A certificate or a report proves you were in good shape on the day. We help you stay that way between audits, so the next one is a visit and not a rescue.
Overview
What happens after the certificate
Most compliance programmes peak just before an audit and decay right after it. Evidence stops being collected, reviews slip, the risk register goes stale, and three months before the next audit someone starts reconstructing a year of records from memory.
Black Fox keeps the programme running. We hold the evidence calendar, test the controls on a schedule, run internal audits, review policies when they are due and prepare you for surveillance and renewal audits. The same work serves several frameworks at once where their requirements overlap, such as ISO/IEC 27001, SOC 2 and NIS2.
We do not issue certificates or reports. Certification bodies, CPA firms and the competent authorities do. We work with long-standing certification partners and coordinate surveillance and renewal audits with them or with the body you already use. What we keep in order is everything they will ask to see.
Who it is for
Organisations that already hold a certificate, a SOC report or regulatory obligations and want to keep them without a scramble every year, and teams answering to several frameworks who would rather run one programme than three.
The work, from scoping to evidence.
What we do
Evidence calendar
A calendar of every recurring control activity and the evidence it should produce, with owners and reminders, so nothing depends on memory.
Control testing
We sample and test controls during the year, the way an auditor would, and raise what fails while there is still time to fix it.
Internal audits
Internal audits run independently of the people who operate the controls, with findings tracked to closure.
Policy and risk reviews
Policies, procedures and the risk register reviewed when they are due and whenever the business changes.
Framework mapping
One set of controls mapped to the frameworks you answer to, so a single piece of evidence covers every requirement it can.
Audit support
Preparation for surveillance, renewal and attestation audits, help with auditor requests and with any findings that follow.
How the engagement runs
Kickoff
We agree the frameworks, the scope, the owners and the audit dates ahead, and sign an NDA first if you need one.
Programme review
We review the current state of your controls, evidence and documents and list what has slipped since the last audit.
Calendar and plan
We build the evidence calendar and a plan for the year: control tests, internal audits, reviews and audit preparation.
Running the year
We work through the plan with your owners, collect and check the evidence and report progress to management.
Audit preparation
Before each external audit we check readiness, close what we can and prepare the people who will be interviewed.
After the audit
We help you respond to findings and fold the lessons into next year's plan.
What you receive
- Evidence calendar with owners and due dates
- Control testing results and remediation tracker
- Internal audit reports
- Updated policies, procedures and risk register
- Control mapping across your frameworks
- Readiness summary before each external audit
Questions
Do you issue certificates or SOC reports?
No. ISO certificates are issued by accredited certification bodies and SOC reports by licensed CPA firms. Regulatory obligations such as NIS2 are supervised by the competent national authorities. We keep your programme and evidence ready for them.
Can one programme cover several frameworks?
Largely, yes. Many requirements overlap, for example in access control, risk management and incident handling. We map one set of controls to each framework and note where a framework asks for something the others do not.
Will this mean we pass the next audit?
Nobody can promise that. What it does mean is that controls are tested and evidence is collected throughout the year, so problems surface early and the auditor sees a programme that runs.
Do you replace our compliance manager?
Not necessarily. We can work alongside a compliance manager and take on the work they have no time for, or act as the person who keeps the programme moving if you have none.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Compliance and certificationSOC 2SOC 2 readiness from Black Fox Security: Trust Services Criteria scoping, gap assessment, control design and evidence preparation for your CPA firm's examination.
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
- Managed securityAccess reviewsPeriodic access reviews by Black Fox Security: user and privileged access across directories, cloud and key applications, joiners and leavers, audit evidence.
Keep the next audit boring
Tell us which frameworks you answer to and when the next audits are. We will show you what a year of continuous compliance looks like for you.