# Compliance Readiness

> A fixed-fee engagement that closes the gap between where you are and what an auditor needs. Priced as a fee, never in story points.

Source: https://www.koombea.com/ai-pods/catalog/compliance-readiness/

---

SOC 2, HIPAA or PCI has appeared in somebody else's procurement checklist and your deal is waiting behind it. A gap assessment, a remediation plan, and the evidence an auditor will ask for.


## The problem

Compliance work usually starts as a sales emergency. A large client sends a security questionnaire. The answer to nine questions is no. A signed deal is now waiting on something nobody owns.

The panic response is to buy a compliance platform. It produces a dashboard of red items, which is genuinely useful, and then it stops. A dashboard cannot make the changes. Closing the gaps is engineering work, and that is the part that takes months.

We do the engineering half. We also tell you which controls reduce real risk and which exist because the framework asks.

- Gap assessment against the actual framework, not a generic checklist
- Remediation scoped and sequenced by what blocks the audit first
- Evidence collected as the work happens, not reconstructed afterwards

## What this covers

- **Gap assessment**: Every control assessed against your actual systems, with the ones you already satisfy marked as satisfied rather than re-bought.
- **Technical remediation**: Access control, encryption, logging, backup and recovery brought to the standard the framework requires.
- **Policies that match reality**: Written to describe what your team actually does, because a policy nobody follows fails the audit more expensively than a missing one.
- **Evidence and audit support**: The artifacts an auditor asks for, collected in place, plus support through the audit itself.

## Why this is not priced in points

Governance, risk and compliance work is never story-point priced. A point is a unit of delivered software. The deliverable here is an opinion: whether your controls meet a standard.

Sizing an opinion in points would be a category error. It would also reward us for finding more work. So this is a fixed fee or a retainer, quoted after the gap assessment. Software built to close a gap is estimated in points as normal, and drawn from your existing lane.


## What an auditor follows


## What it costs

The gap assessment is a fixed fee. We quote it from the framework and the number of systems in scope. It produces the remediation estimate, and that estimate is a commitment rather than a range.

Most clients need the assessment before they can budget anything. That is exactly why it is sold on its own.

- Gap assessment: fixed fee, quoted upfront
- Remediation: fixed fee or retainer, quoted from the assessment
- Software built to close a gap is estimated in points, from your lane
- SOC 2, HIPAA, PCI DSS, ISO 27001 and GDPR